{"record":{"id":"8cd3f5f54463032a","repo":"getsops/sops","slug":"failed-to-execute-command-s-w","errorCode":null,"errorMessage":"failed to execute command %s: %w","messagePattern":"failed to execute command (.+?): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"age/keysource.go","lineNumber":313,"sourceCode":"}\n\n// getOutputFromCmd executes a shell command provided in param 'cmdString',\n// optionally adding env vars provided in param 'envVars',\n// and returns the command's output and error\nfunc getOutputFromCmd(cmdString string, envVars []string) ([]byte, error) {\n\tvar out []byte\n\n\targs, err := shlex.Split(cmdString)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse command %s: %w\", cmdString, err)\n\t}\n\tcmd := exec.Command(args[0], args[1:]...)\n\tif envVars != nil {\n\t\tcmd.Env = append(os.Environ(), envVars[0:]...)\n\t}\n\tout, err = cmd.Output()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to execute command %s: %w\", cmdString, err)\n\t}\n\n\treturn out, nil\n}\n\n// loadAgeSSHIdentity attempts to load age SSH identities in this order:\n// 1. An SSH private key from the SopsAgeSshPrivateKeyFileEnv environment variable.\n// 2. An SSH private key returned by executing the command from the\n// SopsAgeSshPrivateKeyCmdEnv environment variable\n// 3. `~/.ssh/id_ed25519` or `~/.ssh/id_rsa`.\n// If no age SSH identity is found, it will return nil.\nfunc (key *MasterKey) loadAgeSSHIdentities() ([]age.Identity, []string, errSet) {\n\tvar identities []age.Identity\n\tvar unusedLocations []string\n\tvar errs errSet\n\n\tsshKeyFilePath, ok := os.LookupEnv(SopsAgeSshPrivateKeyFileEnv)\n\tif ok {","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/age/keysource.go#L295-L331","documentation":"The command configured in SOPS_AGE_SSH_PRIVATE_KEY_CMD was parsed successfully and executed via exec.Command(...).Output(), but it returned a non-zero exit status or failed to start. SOPS wraps that error, so the underlying message (e.g. 'exit status 1' or 'executable file not found') is chained in %w. This means SOPS could not obtain age identities from that command.","triggerScenarios":"getOutputFromCmd runs the SOPS_AGE_SSH_PRIVATE_KEY_CMD binary; error occurs if the binary is missing, not executable, or exits non-zero (no matching key in ssh-agent, pass/gopass entry missing, wrong passphrase).","commonSituations":"ssh-agent not running or key not loaded; pass store entry absent on a new machine; typo in binary name; CI environment lacking the secret store; script failing due to missing HOME or TTY.","solutions":["Run the command from SOPS_AGE_SSH_PRIVATE_KEY_CMD directly in a shell and check its exit status/output; fix whatever it reports (missing key, locked store, etc.).","Verify the binary exists and is executable: command -v <binary> and check the PATH in the environment running sops.","If it uses ssh-agent, ensure the agent is running and the identity is added (ssh-add -l).","For pass/gopass-backed commands, initialize/unlock the store and confirm the exact entry name exists.","Wrap the command in a script that logs stderr so the real failure is visible, then point the env var at it."],"exampleFix":"// before\nexport SOPS_AGE_SSH_PRIVATE_KEY_CMD=\"pass show age-key\"  # entry doesn't exist\n// failed to execute command pass show age-key: exit status 1\n\n// after\npass ls | grep age-key            # confirm the entry name\nexport SOPS_AGE_SSH_PRIVATE_KEY_CMD=\"pass show age/identity\"\nsops -d secrets.enc.yaml","handlingStrategy":"try-catch","validationCode":"// shell: pre-flight the command exactly as sops would run it\nCMD=\"$SOPS_AGE_SSH_PRIVATE_KEY_CMD\"\n$CMD > /dev/null || { echo \"key command failed: $?\"; exit 1; }\ncommand -v \"${CMD%% *}\" >/dev/null || { echo \"binary not on PATH\"; exit 1; }","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"sops\", \"-d\", file).Output()\nvar ee *exec.ExitError\nif errors.As(err, &ee) && strings.Contains(string(ee.Stderr), \"failed to execute command\") {\n    return fmt.Errorf(\"SOPS_AGE_SSH_PRIVATE_KEY_CMD binary failed; check agent/store: %w\", err)\n}","preventionTips":["Run the key command manually on each host before deploying sops workflows.","Ensure ssh-agent is running and identities loaded (ssh-add -l) when the command uses agent keys.","Provision secret-store entries (pass/gopass) as part of machine bootstrap.","Check PATH for non-interactive contexts (cron, systemd, CI) — login shell PATH often differs.","Capture stderr in wrapper scripts so failures are diagnosable."],"tags":["age","exec","env-var","command"],"backgroundTag":"command-exec-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}