{"record":{"id":"d826ae8e9a8d3002","repo":"getsops/sops","slug":"failed-to-base64-decode-decrypted-data-key-w","errorCode":null,"errorMessage":"failed to base64 decode decrypted data key: %w","messagePattern":"failed to base64 decode decrypted data key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":230,"sourceCode":"\t\t\tCipherText:          key.EncryptedKey,\n\t\t\tEncryptionAlgorithm: &decryptAlgorithm,\n\t\t\tKeyId:               &key.KeyUUID,\n\t\t},\n\t}\n\n\tresponse, err := client.DecryptData(request)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with HuaweiCloud KMS: %w\", err)\n\t}\n\n\tif response.PlainText == nil {\n\t\treturn nil, fmt.Errorf(\"decryption response missing plaintext\")\n\t}\n\tdecrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)\n\tif err != nil {\n\t\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption failed\")\n\t\treturn nil, fmt.Errorf(\"failed to base64 decode decrypted data key: %w\", err)\n\t}\n\n\tlog.WithField(\"keyID\", key.KeyID).Info(\"Decryption succeeded\")\n\treturn decrypted, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated or not.\nfunc (key *MasterKey) NeedsRotation() bool {\n\treturn time.Since(key.CreationDate) > hckmsTTL\n}\n\n// ToString converts the key to a string representation.\nfunc (key *MasterKey) ToString() string {\n\treturn key.KeyID\n}\n\n// ToMap converts the MasterKey to a map for serialization purposes.\nfunc (key MasterKey) ToMap() map[string]interface{} {","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L212-L248","documentation":"HuaweiCloud KMS returns decrypted plaintext as a base64 string; SOPS decodes it with base64.StdEncoding (hckms/keysource.go:230). If the returned string is not valid standard base64, this error wraps the decode failure — the data key bytes cannot be reconstructed.","triggerScenarios":"client.DecryptData succeeds but *response.PlainText fails base64.StdEncoding.DecodeString — corrupted or non-standard-encoded payload in the API response.","commonSituations":"Intermediary (proxy, service mesh) re-encoding or truncating the response body; custom KMS-compatible endpoint returning URL-safe base64 or raw bytes; SDK version mismatch producing malformed field content.","solutions":["Log the raw PlainText value to inspect its encoding","Remove any proxy/intermediary that could rewrite the response body and retry","Try decoding as RawURLEncoding/URLEncoding locally to diagnose a non-standard encoder at the endpoint","Ensure you are on an official KMS endpoint and a current huaweicloud-sdk-go-v3 release"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(s)\n    return err == nil\n}","tryCatchPattern":"if _, err := base64.StdEncoding.DecodeString(raw); err != nil {\n    if d, e2 := base64.URLEncoding.DecodeString(raw); e2 == nil {\n        _ = d // endpoint returned URL-safe base64: investigate endpoint\n    }\n}","preventionTips":["Use official KMS endpoints only; custom KMS-compatible servers may encode differently","Avoid response-rewriting intermediaries (proxies, service meshes)","Log raw responses when debugging decrypt failures"],"tags":["huaweicloud","kms","base64","decryption"],"backgroundTag":"base64-decode-failed","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}