{"record":{"id":"ca647331ee0a520d","repo":"getsops/sops","slug":"unknown-datatype-s","errorCode":null,"errorMessage":"Unknown datatype: %s","messagePattern":"Unknown datatype: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"aes/cipher.go","lineNumber":121,"sourceCode":"\tswitch encryptedValue.datatype {\n\tcase \"str\":\n\t\tplaintext = decryptedValue\n\tcase \"int\":\n\t\tplaintext, err = strconv.Atoi(decryptedValue)\n\tcase \"float\":\n\t\tplaintext, err = strconv.ParseFloat(decryptedValue, 64)\n\tcase \"bytes\":\n\t\tplaintext = decryptedBytes\n\tcase \"bool\":\n\t\tplaintext, err = strconv.ParseBool(decryptedValue)\n\tcase \"time\":\n\t\tvar value time.Time\n\t\terr = value.UnmarshalText(decryptedBytes)\n\t\tplaintext = value\n\tcase \"comment\":\n\t\tplaintext = sops.Comment{Value: decryptedValue}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"Unknown datatype: %s\", encryptedValue.datatype)\n\t}\n\tc.stash[stashKey{plaintext: plaintext, additionalData: additionalData}] = encryptedValue.iv\n\treturn plaintext, err\n}\n\nfunc isEmpty(value interface{}) bool {\n\tswitch value := value.(type) {\n\tcase string:\n\t\treturn value == \"\"\n\tcase []byte:\n\t\treturn len(value) == 0\n\tcase sops.Comment:\n\t\treturn isEmpty(value.Value)\n\tdefault:\n\t\treturn false\n\t}\n}\n","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/aes/cipher.go#L103-L139","documentation":"Decrypt in aes/cipher.go reconstructs the plaintext value from the decrypted bytes according to the `type:` field stored in the ENC[] metadata. When that datatype string is not one of str, int, float, bool, time, comment, or the other supported types, the switch hits its default branch and this error is returned. It means the encrypted document contains a datatype label the current version of the SOPS AES cipher does not understand.","triggerScenarios":"Calling Cipher.Decrypt on an EncryptedValue whose `datatype` field is unrecognized — e.g. a manually edited or hand-crafted `ENC[AES256_GCM,...,type:xyz]` string, or a file produced by a newer SOPS version that added a new datatype this code does not know.","commonSituations":"Hand-editing encrypted values and mistyping the type suffix; opening files written by a newer/older SOPS with a datatype mismatch; tools that programmatically rewrite the ENC[] string and corrupt the type field.","solutions":["Check the `type:` field of the failing ENC[] value and correct it to a supported datatype (str, int, float, bool, time, comment).","Re-encrypt the file with a matching version of SOPS so datatypes are rewritten to ones this cipher knows.","Add the missing datatype to the switch statement in Decrypt if you maintain a fork and need to support a new type."],"exampleFix":"// before\nENC[AES256_GCM,data:xxxx,iv:yyy,tag:zzz,type:string]\n// after\nENC[AES256_GCM,data:xxxx,iv:yyy,tag:zzz,type:str]","handlingStrategy":"validation","validationCode":"supported := map[string]bool{\"str\":true,\"int\":true,\"float\":true,\"bool\":true,\"time\":true,\"comment\":true}\nif !supported[datatype] {\n    return fmt.Errorf(\"datatype %q not supported by this sops version\", datatype)\n}","typeGuard":null,"tryCatchPattern":"plaintext, err := cipher.Decrypt(v, key, ad)\nif err != nil && strings.HasPrefix(err.Error(), \"Unknown datatype\") {\n    // fall back to re-encrypting with a compatible sops version\n}","preventionTips":["Never hand-edit the type: field of ENC[] strings","Keep sops versions consistent across teams writing the same files","Validate encrypted files with `sops -d` in CI before use"],"tags":["sops","aes","decryption","unsupported-type"],"backgroundTag":"unknown-datatype","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}