{"record":{"id":"1fa94e6d376db1ac","repo":"getsops/sops","slug":"failed-to-base64-decode-azure-key-vault-encrypted","errorCode":null,"errorMessage":"failed to base64 decode Azure Key Vault encrypted key: %w","messagePattern":"failed to base64 decode Azure Key Vault encrypted key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"azkv/keysource.go","lineNumber":272,"sourceCode":"//\n// Consider using DecryptContext instead.\nfunc (key *MasterKey) Decrypt() ([]byte, error) {\n\treturn key.DecryptContext(context.Background())\n}\n\n// DecryptContext decrypts the EncryptedKey field with Azure Key Vault and returns\n// the result.\nfunc (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error) {\n\ttoken, err := key.getTokenCredential()\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to get Azure token credential to decrypt: %w\", err)\n\t}\n\n\trawEncryptedKey, err := base64.RawURLEncoding.DecodeString(key.EncryptedKey)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode Azure Key Vault encrypted key: %w\", err)\n\t}\n\n\tc, err := azkeys.NewClient(key.VaultURL, token, key.clientOptions)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to construct Azure Key Vault client to decrypt data: %w\", err)\n\t}\n\n\tresp, err := c.Decrypt(ctx, key.Name, key.Version, azkeys.KeyOperationParameters{\n\t\tAlgorithm: to.Ptr(azkeys.EncryptionAlgorithmRSAOAEP256),\n\t\tValue:     rawEncryptedKey,\n\t}, nil)\n\tif err != nil {\n\t\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with Azure Key Vault key '%s': %w\", key.ToString(), err)\n\t}\n\tlog.WithFields(logrus.Fields{\"key\": key.Name, \"version\": key.Version}).Info(\"Decryption succeeded\")\n\treturn resp.KeyOperationResult.Result, nil","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/azkv/keysource.go#L254-L290","documentation":"Raised in DecryptContext when the stored EncryptedKey string cannot be decoded as base64 RawURL encoding (no padding, URL-safe alphabet). The EncryptedKey on the MasterKey is corrupted or was not produced by this library's encoder.","triggerScenarios":"Calling Decrypt on an Azure KV MasterKey whose EncryptedKey was hand-edited, truncated, copied with standard-base64 '+'/'/' characters, contains whitespace/padding '=' characters, or was written by a different tooling version.","commonSituations":"Manually editing .sops.yaml and mangling the azure-vault encrypted key blob, copy-pasting the key through something that line-wrapped or re-encoded it, git merge conflicts partially resolved.","solutions":["Re-encrypt the file with `sops -e` using a valid Azure KV key to regenerate a clean EncryptedKey","Restore the original encrypted key blob from git history or backup","Check for trailing whitespace/newlines or '=' padding in the EncryptedKey field and remove/fix them","Verify the value is URL-safe base64 (no '+' or '/' characters)"],"exampleFix":"// before\nenc := \"a+b/c==\"  // standard base64, fails RawURL decode\n// after\nenc := \"a-b_c\"    // raw URL-safe base64 as produced by sops","handlingStrategy":"validation","validationCode":"func isValidRawURLBase64(s string) bool {\n\t_, err := base64.RawURLEncoding.DecodeString(strings.TrimSpace(s))\n\treturn err == nil\n}\n// before decrypt: if !isValidRawURLBaseKey(masterKey.EncryptedKey) { re-encrypt from a backup }","typeGuard":"func validEncryptedKey(s string) bool {\n\tif s == \"\" || strings.ContainsAny(s, \"+/ =\") { return false }\n\t_, err := base64.RawURLEncoding.DecodeString(s)\n\treturn err == nil\n}","tryCatchPattern":"if _, err := base64.RawURLEncoding.DecodeString(key.EncryptedKey); err != nil {\n\t// recover the original .sops.yaml from git: git checkout HEAD^ -- .sops.yaml\n\treturn fmt.Errorf(\"corrupted azure kv encrypted key, restore from git history: %w\", err)\n}","preventionTips":["Never hand-edit the encrypted key blobs in .sops.yaml","Let sops regenerate encrypted keys via `sops -e`/`sops -r -i` instead of pasting values","Avoid copy-paste through tools that wrap lines or convert base64 alphabets","Commit .sops.yaml to git so blobs can be restored from history"],"tags":["azure","base64","decryption","data-corruption"],"backgroundTag":"invalid-base64-encoding","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}