{"record":{"id":"11058a5f9895ba22","repo":"getsops/sops","slug":"cannot-decode-base64-plaintext-into-data-key-bytes","errorCode":null,"errorMessage":"cannot decode base64 plaintext into data key bytes","messagePattern":"cannot decode base64 plaintext into data key bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hcvault/keysource.go","lineNumber":390,"sourceCode":"}\n\n// dataKeyFromSecret attempts to extract the data key from the data of the\n// provided secret.\nfunc dataKeyFromSecret(secret *api.Secret) ([]byte, error) {\n\tif secret == nil || secret.Data == nil {\n\t\treturn nil, fmt.Errorf(\"transit backend is empty\")\n\t}\n\tdecrypted, ok := secret.Data[\"plaintext\"]\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"no decrypted data\")\n\t}\n\tplaintext, ok := decrypted.(string)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"decrypted plaintext data cannot be cast to string\")\n\t}\n\tdataKey, err := base64.StdEncoding.DecodeString(plaintext)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot decode base64 plaintext into data key bytes\")\n\t}\n\treturn dataKey, nil\n}\n\n// vaultClient returns a new Vault client, configured with the given address\n// and token.\nfunc vaultClient(address, token string, hc *http.Client) (*api.Client, error) {\n\tcfg := api.DefaultConfig()\n\tcfg.Address = address\n\n\tallowlist, err := getAllowlist()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !allowlist.Allows(address) {\n\t\treturn nil, fmt.Errorf(\"Allowlist does not allow %s\", address)\n\t}\n","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hcvault/keysource.go#L372-L408","documentation":"Error \"cannot decode base64 plaintext into data key bytes\" thrown in getsops/sops.","triggerScenarios":"Thrown at hcvault/keysource.go:390 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}