{"record":{"id":"19604ddce43f8682","repo":"getsops/sops","slug":"encryption-response-missing-ciphertext","errorCode":null,"errorMessage":"encryption response missing ciphertext","messagePattern":"encryption response missing ciphertext","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":167,"sourceCode":"\tplaintext := base64.StdEncoding.EncodeToString(dataKey)\n\tencryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT\n\n\trequest := &model.EncryptDataRequest{\n\t\tBody: &model.EncryptDataRequestBody{\n\t\t\tKeyId:               key.KeyUUID,\n\t\t\tPlainText:           plaintext,\n\t\t\tEncryptionAlgorithm: &encryptAlgorithm,\n\t\t},\n\t}\n\n\tresponse, err := client.EncryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption failed\")\n\t\treturn fmt.Errorf(\"failed to encrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}\n\n\tif response.CipherText == nil {\n\t\treturn fmt.Errorf(\"encryption response missing ciphertext\")\n\t}\n\tkey.EncryptedKey = *response.CipherText\n\tlog.WithField(\"keyID\", key.KeyID).Info(\"Encryption succeeded\")\n\treturn nil\n}\n\n// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been\n// encrypted yet.\nfunc (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {\n\tif key.EncryptedKey == \"\" {\n\t\treturn key.Encrypt(dataKey)\n\t}\n\treturn nil\n}\n\n// EncryptedDataKey returns the encrypted data key this master key holds.\nfunc (key *MasterKey) EncryptedDataKey() []byte {\n\treturn []byte(key.EncryptedKey)","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L149-L185","documentation":"After a successful (err == nil) HuaweiCloud KMS EncryptData call, SOPS checks that response.CipherText is populated (hckms/keysource.go:167). If the API returned HTTP 200 without the ciphertext field, this error is thrown because the data key could not be captured.","triggerScenarios":"client.EncryptData succeeds at the transport level but the returned model.EncryptDataResponse has a nil CipherText pointer — an anomalous/empty KMS response, or a proxy/gateway returning an unexpected 2xx body that deserialized into an empty response struct.","commonSituations":"Corporate proxy or API gateway intercepting the KMS call and returning a 200 with an unexpected body; HuaweiCloud service-side anomaly; SDK/region endpoint misconfiguration pointing EncryptData at a non-KMS service that answers 200.","solutions":["Log the raw response body of the EncryptData call to confirm what the server actually returned","Check for a proxy or gateway between the client and the KMS endpoint that may rewrite responses (unset HTTP_PROXY or bypass it)","Verify the region endpoint is a genuine KMS endpoint (kms.<region>.myhuaweicloud.com)","Retry the encryption; if it reproduces, file the SDK request/response with HuaweiCloud support"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":"func validEncryptResponse(r *model.EncryptDataResponse) bool {\n    return r != nil && r.CipherText != nil && *r.CipherText != \"\"\n}","tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    if strings.Contains(err.Error(), \"missing ciphertext\") {\n        // unexpected 2xx: retry once, then surface raw response for support\n    }\n    return err\n}","preventionTips":["Avoid proxies between sops and the KMS endpoint that rewrite responses","Point the region at the official KMS endpoint","Retry on anomalous empty responses before failing the operation"],"tags":["huaweicloud","kms","encryption","empty-response"],"backgroundTag":"kms-empty-response","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}