getsops/sops · error

empty GNUPGHOME path

Error message

empty GNUPGHOME path

What it means

GnuPGHome.Validate rejects a zero-length home path with this message. ImportContext, Cleanup, and ApplyToMasterKey all call Validate first, so any use of an empty GnuPGHome (e.g. the zero value of the string type) is blocked with this descriptive error rather than passed to gpg.

Source

Thrown at pgp/keysource.go:193

	}
	return d.Import(b)
}

// Cleanup deletes the GnuPGHome if it passes Validate.
// It returns an error if the GnuPGHome does not pass Validate, or if the
// removal failed.
func (d GnuPGHome) Cleanup() error {
	if err := d.Validate(); err != nil {
		return err
	}
	return os.RemoveAll(d.String())
}

// Validate ensures the GnuPGHome is a valid GnuPG home directory path.
// When validation fails, it returns a descriptive reason as error.
func (d GnuPGHome) Validate() error {
	if d == "" {
		return fmt.Errorf("empty GNUPGHOME path")
	}
	if !filepath.IsAbs(d.String()) {
		return fmt.Errorf("GNUPGHOME must be an absolute path")
	}
	fi, err := os.Lstat(d.String())
	if err != nil {
		if os.IsNotExist(err) {
			return fmt.Errorf("GNUPGHOME does not exist")
		}
		return fmt.Errorf("cannot stat GNUPGHOME: %w", err)
	}
	if !fi.IsDir() {
		return fmt.Errorf("GNUGPHOME is not a directory")
	}
	if perm := fi.Mode().Perm(); perm != 0o700 {
		return fmt.Errorf("GNUPGHOME has invalid permissions: got %#o wanted %#o", perm, 0o700)
	}
	return nil

View on GitHub (pinned to 13442bb981)

Solutions

1. Initialize the home with pgp.NewGnuPGHome() and check the returned error before use.
2. If you keep the error from NewGnuPGHome, return early instead of using the zero value.
3. Add a Validate() call before Import/Cleanup in your own code to fail fast with clear context.

Example fix

// before
home, _ := pgp.NewGnuPGHome() // error ignored -> home == ""
home.Import(key)
// after
home, err := pgp.NewGnuPGHome()
if err != nil { return err }
if err := home.Validate(); err != nil { return err }

// Go
func ensureHome(home pgp.GnuPGHome) error {
  if home == "" { return errors.New("GnuPGHome not initialized: call pgp.NewGnuPGHome()") }
  return home.Validate()
}

func initialized(home pgp.GnuPGHome) bool { return home != "" }

// Go
if err := home.Validate(); err != nil && strings.Contains(err.Error(), "empty GNUPGHOME path") {
  return fmt.Errorf("GnuPGHome was never initialized: %w", err)
}

When it happens

Trigger: Declaring `var d pgp.GnuPGHome` without initializing, a failed NewGnuPGHome whose error was ignored leaving "", or code paths that blank out the field.

Common situations: Ignoring the error from NewGnuPGHome and using the returned zero value; struct literal pgp.GnuPGHome{} in tests; accidental reset of the field during copy.

Related errors

• cannot import armored key data into GnuPG keyring: %w
• GNUPGHOME must be an absolute path
• GNUPGHOME does not exist
• failed to create new GnuPG home: %w
• cannot read armored key data from file: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/269574997cd2cffd. Report an issue: GitHub.