{"record":{"id":"559f14d240146fa2","repo":"getsops/sops","slug":"error-marshaling-metadata-s-559f14","errorCode":null,"errorMessage":"Error marshaling metadata: %s","messagePattern":"Error marshaling metadata: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"stores/ini/store.go","lineNumber":170,"sourceCode":"\n// LoadPlainFile loads a plaintext INI file's bytes onto a sops.TreeBranches runtime object\nfunc (store *Store) LoadPlainFile(in []byte) (sops.TreeBranches, error) {\n\tbranches, err := store.treeBranchesFromIni(in)\n\tif err != nil {\n\t\treturn branches, fmt.Errorf(\"Could not unmarshal input data: %s\", err)\n\t}\n\treturn branches, nil\n}\n\n// EmitEncryptedFile returns encrypted INI file bytes corresponding to a sops.Tree\n// runtime object\nfunc (store *Store) EmitEncryptedFile(in sops.Tree) ([]byte, error) {\n\tbranches, err := stores.SerializeMetadata(in, stores.MetadataOpts{\n\t\tFlatten:        stores.MetadataFlattenBelowTop,\n\t\tEscapeNewlines: true,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Error marshaling metadata: %s\", err)\n\t}\n\treturn store.EmitPlainFile(branches)\n}\n\n// EmitPlainFile returns the plaintext INI file bytes corresponding to a sops.TreeBranches object\nfunc (store *Store) EmitPlainFile(in sops.TreeBranches) ([]byte, error) {\n\tout, err := store.iniFromTreeBranches(in)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Error marshaling to INI: %s\", err)\n\t}\n\treturn out, nil\n}\n\nfunc (store Store) encodeValue(v interface{}) ([]byte, error) {\n\tswitch v := v.(type) {\n\tcase sops.TreeBranches:\n\t\treturn store.encodeTree(v)\n\tdefault:","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/stores/ini/store.go#L152-L188","documentation":"EmitEncryptedFile first serializes the tree's sops metadata via stores.SerializeMetadata with MetadataFlattenBelowTop and newline escaping. If serializing the metadata branch fails (e.g. the sops section contains values or shapes the flattener cannot represent, such as key collisions or non-string keys in the sops branch), this error is returned instead of writing the file.","triggerScenarios":"Calling EmitEncryptedFile on a sops.Tree whose Metadata/sops branch cannot be flattened: e.g. a sops metadata branch containing a key collision under MetadataFlattenBelowTop, non-string keys inside the sops section, or a corrupted metadata structure after programmatic modification.","commonSituations":"Custom tooling that manipulates tree.Metadata and writes it back in an unexpected shape; migrating a file between store formats so metadata keys lost their expected form; bugs in extensions that inject extra keys into the sops section.","solutions":["Inspect the wrapped SerializeMetadata error and fix the offending key in the tree's sops metadata branch","Avoid manually editing the sops metadata section; let sops generate it (e.g. via sops.Tree.Metadata and the normal encrypt path)","Ensure all keys added to the sops branch are strings and unique after flattening","Re-encrypt from the plaintext file with the official sops CLI if metadata was corrupted"],"exampleFix":"// before: custom key injected into metadata branch\nbranch = append(branch, sops.TreeItem{Key: 42, Value: \"x\"})\n\n// after\nbranch = append(branch, sops.TreeItem{Key: \"custom_key\", Value: \"x\"})","handlingStrategy":"validation","validationCode":"if tree.Metadata == (generic.Metadata{}) {\n\treturn errors.New(\"tree has no metadata; cannot emit encrypted file\")\n}\nfor _, item := range tree.Branches[0] {\n\tif k, ok := item.Key.(string); ok && k == \"sops\" {\n\t\tif _, ok := item.Value.(sops.TreeBranch); !ok {\n\t\t\treturn errors.New(\"sops branch has unexpected shape\")\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"out, err := store.EmitEncryptedFile(tree)\nif err != nil {\n\tif strings.Contains(err.Error(), \"Error marshaling metadata\") {\n\t\treturn fmt.Errorf(\"fix sops metadata branch before emitting: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Don't hand-edit the sops metadata section","Let sops construct Metadata via its encrypt path","Keep metadata keys strings and collision-free","Re-encrypt from a known-good plaintext if metadata is corrupted"],"tags":["go","sops","ini","metadata","serialization"],"backgroundTag":"metadata-serialization-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}