getsops/sops · error

cannot decode base64 plaintext into data key bytes

Error message

cannot decode base64 plaintext into data key bytes

What it means

Error "cannot decode base64 plaintext into data key bytes" thrown in getsops/sops.

Source

Thrown at hcvault/keysource.go:390

}

// dataKeyFromSecret attempts to extract the data key from the data of the
// provided secret.
func dataKeyFromSecret(secret *api.Secret) ([]byte, error) {
	if secret == nil || secret.Data == nil {
		return nil, fmt.Errorf("transit backend is empty")
	}
	decrypted, ok := secret.Data["plaintext"]
	if !ok {
		return nil, fmt.Errorf("no decrypted data")
	}
	plaintext, ok := decrypted.(string)
	if !ok {
		return nil, fmt.Errorf("decrypted plaintext data cannot be cast to string")
	}
	dataKey, err := base64.StdEncoding.DecodeString(plaintext)
	if err != nil {
		return nil, fmt.Errorf("cannot decode base64 plaintext into data key bytes")
	}
	return dataKey, nil
}

// vaultClient returns a new Vault client, configured with the given address
// and token.
func vaultClient(address, token string, hc *http.Client) (*api.Client, error) {
	cfg := api.DefaultConfig()
	cfg.Address = address

	allowlist, err := getAllowlist()
	if err != nil {
		return nil, err
	}
	if !allowlist.Allows(address) {
		return nil, fmt.Errorf("Allowlist does not allow %s", address)
	}

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at hcvault/keysource.go:390 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/11058a5f9895ba22. Report an issue: GitHub.