{"record":{"id":"728a79a12a759f85","repo":"getsops/sops","slug":"region-cannot-be-empty-in-key-id-q","errorCode":null,"errorMessage":"region cannot be empty in key ID: %q","messagePattern":"region cannot be empty in key ID: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":108,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tkeys = append(keys, k)\n\t}\n\treturn keys, nil\n}\n\n// parseKeyID parses a key ID in format \"region:key-uuid\" and returns the region and UUID.\nfunc parseKeyID(keyID string) (string, string, error) {\n\tkeyID = strings.TrimSpace(keyID)\n\tparts := strings.SplitN(keyID, \":\", 2)\n\tif len(parts) != 2 {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid key ID format: expected 'region:key-uuid', got %q\", keyID)\n\t}\n\tregion := strings.TrimSpace(parts[0])\n\tkeyUUID := strings.TrimSpace(parts[1])\n\tif region == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"region cannot be empty in key ID: %q\", keyID)\n\t}\n\tif keyUUID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"key UUID cannot be empty in key ID: %q\", keyID)\n\t}\n\treturn region, keyUUID, nil\n}\n\n// Credentials is a wrapper around auth.ICredential used for authentication\n// towards HuaweiCloud KMS.\ntype Credentials struct {\n\tcredential auth.ICredential\n}\n\n// NewCredentials returns a Credentials object with the provided auth.ICredential.\nfunc NewCredentials(c auth.ICredential) *Credentials {\n\treturn &Credentials{credential: c}\n}\n","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L90-L126","documentation":"After splitting 'region:key-uuid' on the colon, parseKeyID trims the region part; if it is empty (e.g. the ID starts with ':' or the region is only spaces), it rejects the key ID because a region is required to build the KMS client endpoint.","triggerScenarios":"NewMasterKey given a key ID like ':uuid' or ': uuid' — colon present but the region segment is blank after TrimSpace.","commonSituations":"Deleting the region prefix during a config edit but leaving the colon; templating a .sops.yaml where the region variable rendered empty; copy-paste losing text before the colon.","solutions":["Add the region before the colon, e.g. 'cn-north-4:<key-uuid>'.","If region comes from a variable/template, verify it is non-empty at render time.","Check for stray whitespace-only values that TrimSpace reduces to \"\"."],"exampleFix":"// before\n// huawei://:9a8b7c6d-1234-5678-9abc-def012345678\n// after\n// huawei://cn-north-4:9a8b7c6d-1234-5678-9abc-def012345678","handlingStrategy":"validation","validationCode":"parts := strings.SplitN(strings.TrimSpace(keyID), \":\", 2)\nif len(parts) == 2 && strings.TrimSpace(parts[0]) == \"\" {\n    return errors.New(\"region segment empty: prefix key ID with the HuaweiCloud region\")\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Verify templated region variables render non-empty before deploying .sops.yaml.","Never hand-edit the region prefix; copy full IDs from a key inventory."],"tags":["huaweicloud","kms","validation","configuration"],"backgroundTag":"invalid-key-id-format","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}