{"record":{"id":"2ca1a735661680f5","repo":"getsops/sops","slug":"s-s-entry-d-is-empty","errorCode":null,"errorMessage":"%s's entry %d is empty","messagePattern":"(.+?)'s entry (.+?) is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hcvault/keysource.go","lineNumber":77,"sourceCode":"\nfunc parseAllowlistString(allowlistStr string) (allowList, error) {\n\tswitch allowlistStr {\n\tcase AllowlistAllHosts:\n\t\treturn allowList{\n\t\t\tAll:  true,\n\t\t\tURIs: nil,\n\t\t}, nil\n\tcase AllowlistNoHosts:\n\t\treturn allowList{\n\t\t\tAll:  false,\n\t\t\tURIs: nil,\n\t\t}, nil\n\t}\n\turis := strings.Split(allowlistStr, \",\")\n\tfor idx, uri := range uris {\n\t\turi = strings.Trim(uri, \" \")\n\t\tif uri == \"\" {\n\t\t\treturn allowList{}, fmt.Errorf(\"%s's entry %d is empty\", SopsHCVaultAllowlist, idx+1)\n\t\t}\n\t\tif !strings.HasSuffix(uri, \"/\") {\n\t\t\turi = uri + \"/\"\n\t\t}\n\t\turis[idx] = uri\n\t}\n\treturn allowList{\n\t\tAll:  false,\n\t\tURIs: uris,\n\t}, nil\n}\n\nfunc getAllowlist() (allowList, error) {\n\tvar allowlistStr = AllowlistDefault\n\tif allowlist, ok := os.LookupEnv(SopsHCVaultAllowlist); ok && len(allowlist) > 0 {\n\t\tallowlistStr = allowlist\n\t}\n\treturn parseAllowlistString(allowlistStr)","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hcvault/keysource.go#L59-L95","documentation":"parseAllowlistString splits the SOPS_HC_VAULT_ALLOWLIST value on commas and rejects any entry that is empty after trimming spaces (hcvault/keysource.go:77). The error names the env var and the 1-based entry position, and aborts Vault client creation, so every Vault encrypt/decrypt fails until the variable is fixed or unset.","triggerScenarios":"Setting SOPS_HC_VAULT_ALLOWLIST to a value with an empty element — e.g. 'https://a.example.com/,,https://b.example.com/', a trailing comma 'https://a.example.com/', a lone comma, or spaces-only entries like 'a, ,b'.","commonSituations":"Hand-edited env var with a trailing or double comma; templating/CI substitution that leaves a blank between commas; concatenating lists in shell scripts producing an empty segment.","solutions":["Remove the empty entry — delete duplicate, leading, or trailing commas from SOPS_HC_VAULT_ALLOWLIST","Fix CI/templating so the variable is not expanded with blank segments","Unset the variable entirely to fall back to the default allowlist (AllowlistAllHosts)","Use the special values 'all' or 'none' if you intended allow/deny-all behavior"],"exampleFix":"// before\n$ export SOPS_HC_VAULT_ALLOWLIST=\"https://vault1.example.com/,,https://vault2.example.com/\"\n// after\n$ export SOPS_HC_VAULT_ALLOWLIST=\"https://vault1.example.com/,https://vault2.example.com/\"","handlingStrategy":"validation","validationCode":"// shell: validate the allowlist before running sops\nfor entry in $(echo \"$SOPS_HC_VAULT_ALLOWLIST\" | tr ',' '\\n'); do\n  [ -n \"$entry\" ] || { echo \"empty allowlist entry\"; exit 1; }\ndone","typeGuard":"func allowlistValid(s string) bool {\n    for _, e := range strings.Split(s, \",\") {\n        if strings.Trim(e, \" \") == \"\" { return false }\n    }\n    return len(strings.TrimSpace(s)) > 0\n}","tryCatchPattern":"if _, err := getAllowlist(); err != nil {\n    return fmt.Errorf(\"fix SOPS_HC_VAULT_ALLOWLIST (no empty entries): %w\", err)\n}","preventionTips":["Avoid trailing commas when composing the variable in scripts","Quote the value in shell to prevent word-splitting artifacts","Prefer setting the variable once in a shared profile over ad-hoc edits","Use 'all'/'none' keywords where you mean allow/deny-all"],"tags":["vault","configuration","environment","allowlist"],"backgroundTag":"invalid-env-var-format","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}