{"record":{"id":"5f0a85e028ea2839","repo":"getsops/sops","slug":"error-encoding-key-s","errorCode":null,"errorMessage":"Error encoding key: %s","messagePattern":"Error encoding key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"stores/ini/store.go","lineNumber":63,"sourceCode":"\t\t\tfirst := 0\n\t\t\tif len(itemTree) > 0 {\n\t\t\t\tif sectionComment, ok := itemTree[0].Key.(sops.Comment); ok {\n\t\t\t\t\tsection.Comment = sectionComment.Value\n\t\t\t\t\tfirst = 1\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tvar lastItem *ini.Key\n\t\t\tfor i := first; i < len(itemTree); i++ {\n\t\t\t\tkeyVal := itemTree[i]\n\t\t\t\tif comment, ok := keyVal.Key.(sops.Comment); ok {\n\t\t\t\t\tif lastItem != nil {\n\t\t\t\t\t\tlastItem.Comment = comment.Value\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlastItem, err = section.NewKey(keyVal.Key.(string), stores.ValToString(keyVal.Value))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"Error encoding key: %s\", err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tvar buffer bytes.Buffer\n\tiniFile.WriteTo(&buffer)\n\treturn buffer.Bytes(), nil\n}\n\nfunc (store Store) stripCommentChar(comment string) string {\n\tif strings.HasPrefix(comment, \";\") {\n\t\tcomment = strings.TrimLeft(comment, \"; \")\n\t} else if strings.HasPrefix(comment, \"#\") {\n\t\tcomment = strings.TrimLeft(comment, \"# \")\n\t}\n\treturn comment\n}","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/stores/ini/store.go#L45-L81","documentation":"encodeTree adds each key inside a section via section.NewKey(key, stores.ValToString(value)). The gopkg.in/ini.v1 library rejects keys whose names contain reserved characters (like '=' or '['), and this wraps that failure. Note it also implies keyVal.Key was expected to be a string (non-string keys would panic on the assertion, so this error is specifically about invalid key names or value conversion issues surfacing from NewKey).","triggerScenarios":"Calling EmitEncryptedFile/EmitPlainFile with a section containing a TreeItem whose string key contains characters ini.v1 cannot encode, e.g. a key named \"a=b\" or containing a newline produced by escaped metadata values.","commonSituations":"Config keys copied from YAML/JSON that include '=' or unusual characters; generated keys from paths with separators; corrupted trees where the sops metadata keys were mangled before serialization.","solutions":["Rename the offending key to remove reserved INI characters (=, [, ], newlines)","Inspect the wrapped ini.v1 error message to find the exact key and invalid character","Sanitize keys at load/creation time before building the TreeBranch","Use a different store format if your key names cannot be INI-safe"],"exampleFix":"// before\nsops.TreeBranch{{Key: \"a=b\", Value: \"1\"}}\n\n// after\nsops.TreeBranch{{Key: \"a_b\", Value: \"1\"}}","handlingStrategy":"validation","validationCode":"func validIniKeyName(name string) bool {\n\treturn !strings.ContainsAny(name, \"=[]\\n\\r\") && !strings.HasPrefix(name, \";\") && name != \"\"\n}","typeGuard":null,"tryCatchPattern":"out, err := store.EmitEncryptedFile(tree)\nif err != nil {\n\tif strings.Contains(err.Error(), \"Error encoding key:\") {\n\t\t// sanitize the offending key name and retry\n\t}\n\treturn err\n}","preventionTips":["Keep INI keys free of =, [, ] and newlines","Sanitize keys converted from other formats","Test round-trip encrypt/decrypt on files with unusual key names"],"tags":["go","sops","ini","encoding"],"backgroundTag":"invalid-ini-key-name","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}