getsops/sops · error

encryption response missing ciphertext

Error message

encryption response missing ciphertext

What it means

After a successful (err == nil) HuaweiCloud KMS EncryptData call, SOPS checks that response.CipherText is populated (hckms/keysource.go:167). If the API returned HTTP 200 without the ciphertext field, this error is thrown because the data key could not be captured.

Source

Thrown at hckms/keysource.go:167

	plaintext := base64.StdEncoding.EncodeToString(dataKey)
	encryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.EncryptDataRequest{
		Body: &model.EncryptDataRequestBody{
			KeyId:               key.KeyUUID,
			PlainText:           plaintext,
			EncryptionAlgorithm: &encryptAlgorithm,
		},
	}

	response, err := client.EncryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.CipherText == nil {
		return fmt.Errorf("encryption response missing ciphertext")
	}
	key.EncryptedKey = *response.CipherText
	log.WithField("keyID", key.KeyID).Info("Encryption succeeded")
	return nil
}

// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been
// encrypted yet.
func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {
	if key.EncryptedKey == "" {
		return key.Encrypt(dataKey)
	}
	return nil
}

// EncryptedDataKey returns the encrypted data key this master key holds.
func (key *MasterKey) EncryptedDataKey() []byte {
	return []byte(key.EncryptedKey)

View on GitHub (pinned to 13442bb981)

Solutions

1. Log the raw response body of the EncryptData call to confirm what the server actually returned
2. Check for a proxy or gateway between the client and the KMS endpoint that may rewrite responses (unset HTTP_PROXY or bypass it)
3. Verify the region endpoint is a genuine KMS endpoint (kms.<region>.myhuaweicloud.com)
4. Retry the encryption; if it reproduces, file the SDK request/response with HuaweiCloud support

func validEncryptResponse(r *model.EncryptDataResponse) bool {
    return r != nil && r.CipherText != nil && *r.CipherText != ""
}

if err := key.EncryptContext(ctx, dataKey); err != nil {
    if strings.Contains(err.Error(), "missing ciphertext") {
        // unexpected 2xx: retry once, then surface raw response for support
    }
    return err
}

When it happens

Trigger: client.EncryptData succeeds at the transport level but the returned model.EncryptDataResponse has a nil CipherText pointer — an anomalous/empty KMS response, or a proxy/gateway returning an unexpected 2xx body that deserialized into an empty response struct.

Common situations: Corporate proxy or API gateway intercepting the KMS call and returning a 200 with an unexpected body; HuaweiCloud service-side anomaly; SDK/region endpoint misconfiguration pointing EncryptData at a non-KMS service that answers 200.

Related errors

• failed to create HuaweiCloud KMS client: %w
• failed to encrypt sops data key with HuaweiCloud KMS: %w
• decryption response missing plaintext
• cannot create GCP KMS service: %w
• failed to encrypt sops data key with GCP KMS key: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/19604ddce43f8682. Report an issue: GitHub.