{"record":{"id":"fc8172dbb9a9deff","repo":"getsops/sops","slug":"invalid-key-id-format-expected-region-key-uuid","errorCode":null,"errorMessage":"invalid key ID format: expected 'region:key-uuid', got %q","messagePattern":"invalid key ID format: expected 'region:key-uuid', got %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hckms/keysource.go","lineNumber":103,"sourceCode":"\t\ts = strings.TrimSpace(s)\n\t\tif s == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tk, err := NewMasterKey(s)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tkeys = append(keys, k)\n\t}\n\treturn keys, nil\n}\n\n// parseKeyID parses a key ID in format \"region:key-uuid\" and returns the region and UUID.\nfunc parseKeyID(keyID string) (string, string, error) {\n\tkeyID = strings.TrimSpace(keyID)\n\tparts := strings.SplitN(keyID, \":\", 2)\n\tif len(parts) != 2 {\n\t\treturn \"\", \"\", fmt.Errorf(\"invalid key ID format: expected 'region:key-uuid', got %q\", keyID)\n\t}\n\tregion := strings.TrimSpace(parts[0])\n\tkeyUUID := strings.TrimSpace(parts[1])\n\tif region == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"region cannot be empty in key ID: %q\", keyID)\n\t}\n\tif keyUUID == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"key UUID cannot be empty in key ID: %q\", keyID)\n\t}\n\treturn region, keyUUID, nil\n}\n\n// Credentials is a wrapper around auth.ICredential used for authentication\n// towards HuaweiCloud KMS.\ntype Credentials struct {\n\tcredential auth.ICredential\n}\n","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hckms/keysource.go#L85-L121","documentation":"HuaweiCloud KMS key IDs in SOPS must be 'region:key-uuid'. parseKeyID splits on ':' and requires exactly two non-empty parts; when the input has no colon at all, this error is returned with the offending key ID quoted.","triggerScenarios":"NewMasterKey (or parsing keys from .sops.yaml huawei kms entries) given an ID like 'arn:...'-style string, a bare UUID, or a whitespace-only string with no ':' separator.","commonSituations":"Copying the raw KMS key UUID from the HuaweiCloud console without prefixing the region; pasting a full CMK ARN-like identifier; YAML entry missing the region part after an edit.","solutions":["Format the key ID as region:key-uuid, e.g. 'eu-west-0:12345678-90ab-cdef-1234-567890abcdef'.","Check the region prefix matches your KMS endpoint region (e.g. eu-west-0, ap-southeast-1).","Ensure the ':' separator exists — a bare UUID without region also triggers this error.","Quote the value in YAML if it contains characters your parser mangles."],"exampleFix":"// before\n// huawei://9a8b7c6d-1234-5678-9abc-def012345678\n// after\n// huawei://eu-west-0:9a8b7c6d-1234-5678-9abc-def012345678","handlingStrategy":"validation","validationCode":"func validHwKeyID(id string) bool {\n    parts := strings.SplitN(strings.TrimSpace(id), \":\", 2)\n    return len(parts) == 2 && strings.TrimSpace(parts[0]) != \"\" && strings.TrimSpace(parts[1]) != \"\"\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Always write HuaweiCloud key refs as region:uuid in .sops.yaml.","Add a CI lint that rejects huawei:// URIs lacking a colon-separated region.","Keep a canonical key inventory with full region:uuid values."],"tags":["huaweicloud","kms","validation","configuration"],"backgroundTag":"invalid-key-id-format","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}