{"record":{"id":"592e02082f5f1fc5","repo":"getsops/sops","slug":"error-marshaling-metadata-s-592e02","errorCode":null,"errorMessage":"Error marshaling metadata: %s","messagePattern":"Error marshaling metadata: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"stores/json/store.go","lineNumber":352,"sourceCode":"// LoadPlainFile loads plaintext json file bytes onto a sops.TreeBranches object\nfunc (store *Store) LoadPlainFile(in []byte) (sops.TreeBranches, error) {\n\tbranch, err := store.treeBranchFromJSON(in)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Could not unmarshal input data: %s\", err)\n\t}\n\treturn sops.TreeBranches{\n\t\tbranch,\n\t}, nil\n}\n\n// EmitEncryptedFile returns the encrypted bytes of the json file corresponding to a\n// sops.Tree runtime object\nfunc (store *Store) EmitEncryptedFile(in sops.Tree) ([]byte, error) {\n\tbranches, err := stores.SerializeMetadata(in, stores.MetadataOpts{\n\t\tFlatten: stores.MetadataFlattenNone,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Error marshaling metadata: %s\", err)\n\t}\n\treturn store.EmitPlainFile(branches)\n}\n\n// EmitPlainFile returns the plaintext bytes of the json file corresponding to a\n// sops.TreeBranches runtime object\nfunc (store *Store) EmitPlainFile(in sops.TreeBranches) ([]byte, error) {\n\tout, err := store.jsonFromTreeBranch(in[0])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Error marshaling to json: %s\", err)\n\t}\n\tout = append(out, '\\n')\n\treturn out, nil\n}\n\n// EmitValue returns bytes corresponding to a single encoded value\n// in a generic interface{} object\nfunc (store *Store) EmitValue(v interface{}) ([]byte, error) {","sourceCodeStart":334,"sourceCodeEnd":370,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/stores/json/store.go#L334-L370","documentation":"Emitted by the JSON Store's EmitEncryptedFile when stores.SerializeMetadata fails to convert the tree's sops.Metadata struct into an embeddable tree branch. This indicates the in-memory metadata of the tree could not be serialized (typically a required metadata field conversion failure, not a user data problem).","triggerScenarios":"Calling EmitEncryptedFile on a sops.Tree whose Metadata field is incomplete or invalid — e.g. a programmatically built tree missing message authentication, key groups, or having a zero-value Metadata that fails metadataFromInternal/serialization.","commonSituations":"Custom tooling that constructs a sops.Tree by hand (missing Shards/KeyGroups/LastModified), edits to metadata after decryption, or library version changes where metadata fields were added that a hand-built Metadata struct lacks.","solutions":["Build the tree via LoadEncryptedFile/decryption rather than hand-constructing Metadata, so all fields are populated","Inspect the wrapped error (%s) to identify which metadata field failed to convert","Verify every required Metadata field is set (MAC, KeyGroups, ShamirThreshold, Version, etc.) in custom code","Upgrade/downgrade sops to match the metadata version of the file being processed"],"exampleFix":"// before\nmd := sops.Metadata{} // empty metadata\ntree.Metadata = md\nout, err := store.EmitEncryptedFile(tree) // \"Error marshaling metadata\"\n// after\ntree.Metadata.Version = version // populate all required fields, or:\ntree, _ = store.LoadEncryptedFile(originalBytes) // derive metadata from a real file","handlingStrategy":"try-catch","validationCode":"func metadataComplete(md sops.Metadata) bool {\n\treturn len(md.KeyGroups) > 0 && md.Version != \"\" && len(md.MAC) > 0 || md.Version != \"\" && md.MessageAuthenticationCode != nil\n}\n// ensure tree.Metadata is populated (from LoadEncryptedFile) before emitting","typeGuard":null,"tryCatchPattern":"out, err := store.EmitEncryptedFile(tree)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"Error marshaling metadata\") {\n\t\treturn fmt.Errorf(\"tree.Metadata is incomplete/invalid: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Derive trees from LoadEncryptedFile rather than constructing Metadata by hand","Set every required Metadata field (KeyGroups, ShamirThreshold, MAC, Version)","Keep library and file metadata versions in sync"],"tags":["metadata","serialization","sops"],"backgroundTag":"metadata-serialization-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}