getsops/sops · error

Error encoding key: %s

Error message

Error encoding key: %s

What it means

encodeTree adds each key inside a section via section.NewKey(key, stores.ValToString(value)). The gopkg.in/ini.v1 library rejects keys whose names contain reserved characters (like '=' or '['), and this wraps that failure. Note it also implies keyVal.Key was expected to be a string (non-string keys would panic on the assertion, so this error is specifically about invalid key names or value conversion issues surfacing from NewKey).

Source

Thrown at stores/ini/store.go:63

			first := 0
			if len(itemTree) > 0 {
				if sectionComment, ok := itemTree[0].Key.(sops.Comment); ok {
					section.Comment = sectionComment.Value
					first = 1
				}
			}

			var lastItem *ini.Key
			for i := first; i < len(itemTree); i++ {
				keyVal := itemTree[i]
				if comment, ok := keyVal.Key.(sops.Comment); ok {
					if lastItem != nil {
						lastItem.Comment = comment.Value
					}
				} else {
					lastItem, err = section.NewKey(keyVal.Key.(string), stores.ValToString(keyVal.Value))
					if err != nil {
						return nil, fmt.Errorf("Error encoding key: %s", err)
					}
				}
			}
		}
	}
	var buffer bytes.Buffer
	iniFile.WriteTo(&buffer)
	return buffer.Bytes(), nil
}

func (store Store) stripCommentChar(comment string) string {
	if strings.HasPrefix(comment, ";") {
		comment = strings.TrimLeft(comment, "; ")
	} else if strings.HasPrefix(comment, "#") {
		comment = strings.TrimLeft(comment, "# ")
	}
	return comment
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Rename the offending key to remove reserved INI characters (=, [, ], newlines)
2. Inspect the wrapped ini.v1 error message to find the exact key and invalid character
3. Sanitize keys at load/creation time before building the TreeBranch
4. Use a different store format if your key names cannot be INI-safe

Example fix

// before
sops.TreeBranch{{Key: "a=b", Value: "1"}}

// after
sops.TreeBranch{{Key: "a_b", Value: "1"}}

func validIniKeyName(name string) bool {
	return !strings.ContainsAny(name, "=[]\n\r") && !strings.HasPrefix(name, ";") && name != ""
}

out, err := store.EmitEncryptedFile(tree)
if err != nil {
	if strings.Contains(err.Error(), "Error encoding key:") {
		// sanitize the offending key name and retry
	}
	return err
}

When it happens

Trigger: Calling EmitEncryptedFile/EmitPlainFile with a section containing a TreeItem whose string key contains characters ini.v1 cannot encode, e.g. a key named "a=b" or containing a newline produced by escaped metadata values.

Common situations: Config keys copied from YAML/JSON that include '=' or unusual characters; generated keys from paths with separators; corrupted trees where the sops metadata keys were mangled before serialization.

Related errors

• Error encoding section %s: %s
• Error encoding section: Section values should always be Tree
• Could not unmarshal input data: %s
• Error marshaling metadata: %s
• Failed to read %q: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/5f0a85e028ea2839. Report an issue: GitHub.