What causes "can not compile regexp: %w" in getsops/sops?

Validate the regex with a RE2-compatible checker (regex101 with Golang flavor) before putting it in config

can not compile regexp: %w

Error message

can not compile regexp: %w

What it means

Creation rules carry a path_regex used to match the file being encrypted/decrypted. sops compiles each rule's PathRegex with regexp.Compile and wraps any Go regexp syntax error in this message. An invalid regular expression in the config makes the whole rule unusable.

Source

Thrown at config/config.go:593

	configDir, err := filepath.Abs(filepath.Dir(confPath))
	if err != nil {
		return nil, err
	}

	// compare file path relative to path of config file
	filePath = strings.TrimPrefix(filePath, configDir+string(filepath.Separator))

	var rule *creationRule

	for _, r := range conf.CreationRules {
		if r.PathRegex == "" {
			rule = &r
			break
		}
		reg, err := regexp.Compile(r.PathRegex)
		if err != nil {
			return nil, fmt.Errorf("can not compile regexp: %w", err)
		}
		if reg.MatchString(filePath) {
			rule = &r
			break
		}
	}

	if rule == nil {
		return nil, fmt.Errorf("error loading config: no matching creation rules found")
	}

	config, err := configFromRule(rule, kmsEncryptionContext)
	if err != nil {
		return nil, err
	}

	return config, nil
}

View on GitHub (pinned to 13442bb981)

Solutions

Validate the regex with a RE2-compatible checker (regex101 with Golang flavor) before putting it in config
Escape properly: use '[0-9]' instead of '\d', and quote the regex in YAML with single quotes so backslashes survive
Test the exact pattern with go: regexp.MatchString or sops editorconfig-checker style dry run
Start from a known-good pattern like path_regex: '\.ya?ml$' and extend incrementally

Example fix

# before (invalid in RE2)
- path_regex: '\d+/secrets/.*'
# after
- path_regex: '[0-9]+/secrets/.*'

Defensive patterns

Strategy: validation

Validate before calling

if _, err := regexp.Compile(rule.PathRegex); err != nil {
    return fmt.Errorf("invalid path_regex %q in creation rule: %w", rule.PathRegex, err)
}

Try / catch

cfg, err := loadConfigFile(confPath)
if err != nil && strings.Contains(err.Error(), "can not compile regexp") {
    return fmt.Errorf("fix path_regex syntax (Go RE2) in %s: %w", confPath, err)
}

Prevention

Validate all path_regex entries with Go's regexp package (RE2) in a CI config check
Use single-quoted YAML strings so backslashes are preserved
Avoid PCRE-only syntax (\d, lookaheads) — use RE2 equivalents like [0-9]
Test regexes on regex101 with the Golang flavor before committing

When it happens

Trigger: A creation_rules (or destination rule lookup) entry has a path_regex with invalid syntax, e.g. an unbalanced parenthesis, dangling '*', bad escape like '\d' in Go RE2 (must be '[0-9]' or '\\d' in YAML), or unclosed character class.

Common situations: Regex written for PCRE/JS engines but pasted into sops (Go uses RE2); unescaped dots or slashes; YAML single vs double quoting stripping backslashes incorrectly.

Related errors

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/b9f8fd93b7fe6cbf. Report an issue: GitHub.