{"record":{"id":"e390f501e7bbac98","repo":"getsops/sops","slug":"failed-to-decrypt-sops-data-key-with-pgp-s","errorCode":null,"errorMessage":"failed to decrypt sops data key with pgp: %s","messagePattern":"failed to decrypt sops data key with pgp: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgp/keysource.go","lineNumber":455,"sourceCode":"\t\treturn nil, fmt.Errorf(\"reading PGP message failed: %s\", err)\n\t}\n\tif b, err := io.ReadAll(md.UnverifiedBody); err == nil {\n\t\treturn b, nil\n\t}\n\treturn nil, fmt.Errorf(\"the key could not be decrypted with any of the PGP entries\")\n}\n\n// decryptWithGnuPG attempts to obtain the data key from the EncryptedKey using\n// GnuPG and returns the result. If DisableAgent is configured on the MasterKey,\n// the GnuPG agent is not enabled. When the decryption command fails, it returns\n// the error from stdout.\nfunc (key *MasterKey) decryptWithGnuPG(ctx context.Context) ([]byte, error) {\n\targs := []string{\n\t\t\"-d\",\n\t}\n\tstdout, stderr, err := gpgExec(ctx, key.gnuPGHomeDir, args, strings.NewReader(key.EncryptedKey))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with pgp: %s\",\n\t\t\tstrings.TrimSpace(stderr.String()))\n\t}\n\tresult := stdout.Bytes()\n\tif len(result) == 0 {\n\t\t// This can happen if an older GnuPG version is used to decrypt a key encrypted with a\n\t\t// newer GnuPG version that used an AEAD cipher, which the old version does not support.\n\t\t// Apparently some GnuPG versions drop the unspuported packets, which results in a decrypted\n\t\t// data of 0 bytes, and returns nothing with exit code 0.\n\t\t//\n\t\t// (See https://github.com/getsops/sops/issues/896#issuecomment-2688079300 for more infos.)\n\t\treturn nil, fmt.Errorf(\"failed to decrypt sops data key with pgp: zero bytes returned\")\n\t}\n\treturn result, nil\n}\n\n// NeedsRotation returns whether the data key needs to be rotated\n// or not.\nfunc (key *MasterKey) NeedsRotation() bool {","sourceCodeStart":437,"sourceCodeEnd":473,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/pgp/keysource.go#L437-L473","documentation":"Error \"failed to decrypt sops data key with pgp: %s\" thrown in getsops/sops.","triggerScenarios":"Thrown at pgp/keysource.go:455 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}