{"record":{"id":"70b3f7cb2df29636","repo":"getsops/sops","slug":"decryption-response-missing-plaintext","errorCode":null,"errorMessage":"decryption response missing plaintext","messagePattern":"decryption response missing plaintext","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":225,"sourceCode":"\n\tdecryptAlgorithm := model.GetDecryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT\n\n\trequest := &model.DecryptDataRequest{\n\t\tBody: &model.DecryptDataRequestBody{\n\t\t\tCipherText:          key.EncryptedKey,\n\t\t\tEncryptionAlgorithm: &decryptAlgorithm,\n\t\t\tKeyId:               &key.KeyUUID,\n\t\t},\n\t}\n\n\tresponse, err := client.DecryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}\n\n\tif response.PlainText == nil {\n\t\treturn nil, fmt.Errorf(\"decryption response missing plaintext\")\n\t}\n\tdecrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode decrypted data key: %w\", err)\n\t}\n\n\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption succeeded\")\n\treturn decrypted, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated or not.\nfunc (key *MasterKey) NeedsRotation() bool {\n\treturn time.Since(key.CreationDate) > hckmsTTL\n}\n\n// ToString converts the key to a string representation.\nfunc (key *MasterKey) ToString() string {","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L207-L243","documentation":"If DecryptData returns successfully but response.PlainText is nil, DecryptContext (hckms/keysource.go:225) throws this error. Like the ciphertext case, it indicates an HTTP-success response that lacks the expected plaintext field, so the data key cannot be recovered.","triggerScenarios":"client.DecryptData returns err == nil with a model.DecryptDataResponse whose PlainText pointer is nil — empty/anomalous 2xx response, or an intermediary returning 200 with an unexpected body.","commonSituations":"Proxy/gateway tampering with responses; SDK response deserialization issues with a newer/older SDK version against the live API; HuaweiCloud service anomaly.","solutions":["Dump the raw HTTP response of the DecryptData call to see what the server returned","Check for proxies/gateways altering the response (bypass HTTP_PROXY)","Pin/upgrade the huaweicloud-sdk-go-v3 version to one matching your KMS API","Retry the decrypt; contact HuaweiCloud support if reproducible"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":"func validDecryptResponse(r *model.DecryptDataResponse) bool {\n    return r != nil && r.PlainText != nil && *r.PlainText != \"\"\n}","tryCatchPattern":"dataKey, err := key.DecryptContext(ctx)\nif err != nil && strings.Contains(err.Error(), \"missing plaintext\") {\n    // retry once; if persistent, log raw response and report to HuaweiCloud support\n    return err\n}","preventionTips":["Bypass proxies/gateways that may strip response bodies","Pin a compatible huaweicloud-sdk-go-v3 version against your KMS API","Retry empty 2xx responses before failing"],"tags":["huaweicloud","kms","decryption","empty-response"],"backgroundTag":"kms-empty-response","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}