{"record":{"id":"07d479d516c256f6","repo":"getsops/sops","slug":"failed-to-decrypt-sops-data-key-with-pgp-zero-byt","errorCode":null,"errorMessage":"failed to decrypt sops data key with pgp: zero bytes returned","messagePattern":"failed to decrypt sops data key with pgp: zero bytes returned","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgp/keysource.go","lineNumber":466,"sourceCode":"// the error from stdout.\nfunc (key *MasterKey) decryptWithGnuPG(ctx context.Context) ([]byte, error) {\n\targs := []string{\n\t\t\"-d\",\n\t}\n\tstdout, stderr, err := gpgExec(ctx, key.gnuPGHomeDir, args, strings.NewReader(key.EncryptedKey))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with pgp: %s\",\n\t\t\tstrings.TrimSpace(stderr.String()))\n\t}\n\tresult := stdout.Bytes()\n\tif len(result) == 0 {\n\t\t// This can happen if an older GnuPG version is used to decrypt a key encrypted with a\n\t\t// newer GnuPG version that used an AEAD cipher, which the old version does not support.\n\t\t// Apparently some GnuPG versions drop the unspuported packets, which results in a decrypted\n\t\t// data of 0 bytes, and returns nothing with exit code 0.\n\t\t//\n\t\t// (See https://github.com/getsops/sops/issues/896#issuecomment-2688079300 for more infos.)\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with pgp: zero bytes returned\")\n\t}\n\treturn result, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated\n// or not.\nfunc (key *MasterKey) NeedsRotation() bool {\n\treturn time.Since(key.CreationDate) > (pgpTTL)\n}\n\n// ToString returns the string representation of the key, i.e. its\n// fingerprint.\nfunc (key *MasterKey) ToString() string {\n\treturn key.Fingerprint\n}\n\n// ToMap converts the MasterKey into a map for serialization purposes.\nfunc (key MasterKey) ToMap() map[string]interface{} {","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/pgp/keysource.go#L448-L484","documentation":"Error \"failed to decrypt sops data key with pgp: zero bytes returned\" thrown in getsops/sops.","triggerScenarios":"Thrown at pgp/keysource.go:466 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}