getsops/sops · error

encryption response missing ciphertext

Error message

encryption response missing ciphertext

What it means

After a successful (err == nil) HuaweiCloud KMS EncryptData call, SOPS checks that response.CipherText is populated (hckms/keysource.go:167). If the API returned HTTP 200 without the ciphertext field, this error is thrown because the data key could not be captured.

Solutions

1. Log the raw response body of the EncryptData call to confirm what the server actually returned
2. Check for a proxy or gateway between the client and the KMS endpoint that may rewrite responses (unset HTTP_PROXY or bypass it)
3. Verify the region endpoint is a genuine KMS endpoint (kms.<region>.myhuaweicloud.com)
4. Retry the encryption; if it reproduces, file the SDK request/response with HuaweiCloud support

func validEncryptResponse(r *model.EncryptDataResponse) bool {
    return r != nil && r.CipherText != nil && *r.CipherText != ""
}

if err := key.EncryptContext(ctx, dataKey); err != nil {
    if strings.Contains(err.Error(), "missing ciphertext") {
        // unexpected 2xx: retry once, then surface raw response for support
    }
    return err
}

When it happens

Trigger: client.EncryptData succeeds at the transport level but the returned model.EncryptDataResponse has a nil CipherText pointer — an anomalous/empty KMS response, or a proxy/gateway returning an unexpected 2xx body that deserialized into an empty response struct.

Common situations: Corporate proxy or API gateway intercepting the KMS call and returning a 200 with an unexpected body; HuaweiCloud service-side anomaly; SDK/region endpoint misconfiguration pointing EncryptData at a non-KMS service that answers 200.

Related errors

• decryption response missing plaintext
• failed to create HuaweiCloud KMS client
• failed to encrypt sops data key with HuaweiCloud KMS
• cannot create GCP KMS service
• failed to base64 decode decrypted data key

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/19604ddce43f8682. Report an issue: GitHub.

Appendix: source

Thrown at hckms/keysource.go:167

	plaintext := base64.StdEncoding.EncodeToString(dataKey)
	encryptAlgorithm := model.GetEncryptDataRequestBodyEncryptionAlgorithmEnum().SYMMETRIC_DEFAULT

	request := &model.EncryptDataRequest{
		Body: &model.EncryptDataRequestBody{
			KeyId:               key.KeyUUID,
			PlainText:           plaintext,
			EncryptionAlgorithm: &encryptAlgorithm,
		},
	}

	response, err := client.EncryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Encryption failed")
		return fmt.Errorf("failed to encrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.CipherText == nil {
		return fmt.Errorf("encryption response missing ciphertext")
	}
	key.EncryptedKey = *response.CipherText
	log.WithField("keyID", key.KeyID).Info("Encryption succeeded")
	return nil
}

// EncryptIfNeeded encrypts the provided SOPS data key, if it has not been
// encrypted yet.
func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error {
	if key.EncryptedKey == "" {
		return key.Encrypt(dataKey)
	}
	return nil
}

// EncryptedDataKey returns the encrypted data key this master key holds.
func (key *MasterKey) EncryptedDataKey() []byte {
	return []byte(key.EncryptedKey)

View on GitHub (pinned to 13442bb981)