{"record":{"id":"2ac76064cdb9f8cc","repo":"getsops/sops","slug":"could-not-read-config-file-s","errorCode":null,"errorMessage":"could not read config file: %s","messagePattern":"could not read config file: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/config.go","lineNumber":456,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tvaultKeys, err := hcvault.NewMasterKeysFromURIs(strings.Join(vaultKeyUris, \",\"))\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tfor _, k := range vaultKeys {\n\t\t\tkeyGroup = append(keyGroup, k)\n\t\t}\n\t\tgroups = append(groups, keyGroup)\n\t}\n\treturn groups, nil\n}\n\nfunc loadConfigFile(confPath string) (*configFile, error) {\n\tconfBytes, err := os.ReadFile(confPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not read config file: %s\", err)\n\t}\n\tconf := &configFile{}\n\tconf.Stores = *NewStoresConfig()\n\terr = conf.load(confBytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error loading config: %s\", err)\n\t}\n\treturn conf, nil\n}\n\nfunc configFromRule(rule *creationRule, kmsEncryptionContext map[string]*string) (*Config, error) {\n\tcryptRuleCount := 0\n\tif rule.UnencryptedSuffix != \"\" {\n\t\tcryptRuleCount++\n\t}\n\tif rule.EncryptedSuffix != \"\" {\n\t\tcryptRuleCount++\n\t}","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/config/config.go#L438-L474","documentation":"loadConfigFile wraps any error returned by os.ReadFile when the sops config file cannot be read from disk. This is a pre-parse failure: the file is missing, unreadable, or the path is a directory. sops aborts config loading because no rules can be evaluated without the file contents.","triggerScenarios":"Calling sops with a --config path that does not exist, the default .sops.yaml is absent in a repo where config loading is attempted, or the process lacks read permission on the file.","commonSituations":"Running sops from a different working directory than the repo root; CI checkouts missing dotfiles; typo in --config flag; file permissions restricted by umask or CI user.","solutions":["Verify the config path exists and is a regular file before running sops: ls -la <path>","Run sops from the directory containing .sops.yaml (or use --config with an absolute path)","Fix file permissions so the invoking user can read the file (chmod/chown)","If no config is needed, remove the --config flag or ensure creation rules are passed another way"],"exampleFix":"// before\nsops --config ./conf/sops.yaml encrypt file.yaml\n// after\nsops --config $(pwd)/.sops.yaml encrypt file.yaml  # path exists and is absolute","handlingStrategy":"validation","validationCode":"info, err := os.Stat(confPath)\nif err != nil {\n    return fmt.Errorf(\"config not accessible at %s: %w\", confPath, err)\n}\nif info.IsDir() {\n    return fmt.Errorf(\"%s is a directory, not a config file\", confPath)\n}","typeGuard":null,"tryCatchPattern":"groups, err := loadConfigFile(confPath)\nif err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) && os.IsNotExist(perr) {\n        // fall back to defaults or create a template config\n    }\n    return err\n}","preventionTips":["Always resolve the config path with filepath.Abs and stat it before invoking sops","Ensure .sops.yaml is committed to the repo so CI checkouts include it","Use --config with an explicit absolute path in scripts","Add a preflight check in CI that the expected config files exist"],"tags":["config","file-io","sops"],"backgroundTag":"config-file-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}