{"record":{"id":"6e51b6413509dd90","repo":"getsops/sops","slug":"failed-to-read-q-w-6e51b6","errorCode":null,"errorMessage":"Failed to read %q: %w","messagePattern":"Failed to read %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"decrypt/decrypt.go","lineNumber":24,"sourceCode":"\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"time\"\n\n\t\"github.com/getsops/sops/v3/aes\"\n\t\"github.com/getsops/sops/v3/cmd/sops/common\"\n\t. \"github.com/getsops/sops/v3/cmd/sops/formats\" // Re-export\n\t\"github.com/getsops/sops/v3/config\"\n)\n\n// File is a wrapper around Data that reads a local encrypted\n// file and returns its cleartext data in an []byte\nfunc File(path, format string) (cleartext []byte, err error) {\n\t// Read the file into an []byte\n\tencryptedData, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to read %q: %w\", path, err)\n\t}\n\n\t// uses same logic as cli.\n\tformatFmt := FormatForPathOrString(path, format)\n\treturn DataWithFormat(encryptedData, formatFmt)\n}\n\n// DataWithFormat is a helper that takes encrypted data, and a format enum value,\n// decrypts the data and returns its cleartext in an []byte.\nfunc DataWithFormat(data []byte, format Format) (cleartext []byte, err error) {\n\n\tstore := common.StoreForFormat(format, config.NewStoresConfig())\n\n\t// Load SOPS file and access the data key\n\ttree, err := store.LoadEncryptedFile(data)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/decrypt/decrypt.go#L6-L42","documentation":"decrypt.File is a convenience wrapper that reads a local encrypted file with os.ReadFile before handing the bytes to DataWithFormat. This error wraps the os.ReadFile failure, meaning the encrypted input file could not be opened or read — sops never got to any decryption step.","triggerScenarios":"Calling decrypt.File(path, format) with a path that doesn't exist, points to a directory, or is unreadable by the current user; also when the process lacks filesystem permissions (e.g. restricted container).","commonSituations":"Wrong relative path after changing working directory; file deleted between write and decrypt in CI; secret file mounted with wrong permissions in Kubernetes/Docker; passing an sops URL or S3 URI where a local path is required.","solutions":["Verify the path exists and is a file: os.Stat / ls -la before calling decrypt.File","Convert to an absolute path (filepath.Abs) so the call is independent of the working directory","Check read permissions for the running user (chmod/chown or run with correct uid)","If the data is remote (S3/GCS), fetch it yourself first and pass the bytes to decrypt.Data instead"],"exampleFix":"// before\ncleartext, err := decrypt.File(\"secrets.enc.yaml\", \"yaml\")\n// after\nabs, _ := filepath.Abs(\"secrets.enc.yaml\")\nif _, err := os.Stat(abs); err != nil {\n    return fmt.Errorf(\"encrypted file missing: %w\", err)\n}\ncleartext, err := decrypt.File(abs, \"yaml\")","handlingStrategy":"try-catch","validationCode":"abs, err := filepath.Abs(path)\nif err != nil {\n    return err\n}\ninfo, err := os.Stat(abs)\nif err != nil {\n    return fmt.Errorf(\"encrypted file not readable: %w\", err)\n}\nif info.IsDir() {\n    return fmt.Errorf(\"%s is a directory\", abs)\n}","typeGuard":null,"tryCatchPattern":"cleartext, err := decrypt.File(path, format)\nif err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) && os.IsNotExist(perr) {\n        return fmt.Errorf(\"encrypted input %q does not exist\", path)\n    }\n    return err\n}","preventionTips":["Resolve to absolute paths before calling decrypt.File","Stat the file in preflight when paths come from flags or env vars","For remote data, fetch bytes yourself and use decrypt.Data instead","Check container/CI users have read permission on mounted secret files"],"tags":["file-io","decryption","go","sops"],"backgroundTag":"file-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}