getsops/sops · error

Error encoding key

Error message

Error encoding key: %s

What it means

encodeTree adds each key inside a section via section.NewKey(key, stores.ValToString(value)). The gopkg.in/ini.v1 library rejects keys whose names contain reserved characters (like '=' or '['), and this wraps that failure. Note it also implies keyVal.Key was expected to be a string (non-string keys would panic on the assertion, so this error is specifically about invalid key names or value conversion issues surfacing from NewKey).

Solutions

1. Rename the offending key to remove reserved INI characters (=, [, ], newlines)
2. Inspect the wrapped ini.v1 error message to find the exact key and invalid character
3. Sanitize keys at load/creation time before building the TreeBranch
4. Use a different store format if your key names cannot be INI-safe

Example fix

// before
sops.TreeBranch{{Key: "a=b", Value: "1"}}

// after
sops.TreeBranch{{Key: "a_b", Value: "1"}}

func validIniKeyName(name string) bool {
	return !strings.ContainsAny(name, "=[]\n\r") && !strings.HasPrefix(name, ";") && name != ""
}

out, err := store.EmitEncryptedFile(tree)
if err != nil {
	if strings.Contains(err.Error(), "Error encoding key:") {
		// sanitize the offending key name and retry
	}
	return err
}

When it happens

Trigger: Calling EmitEncryptedFile/EmitPlainFile with a section containing a TreeItem whose string key contains characters ini.v1 cannot encode, e.g. a key named "a=b" or containing a newline produced by escaped metadata values.

Common situations: Config keys copied from YAML/JSON that include '=' or unusual characters; generated keys from paths with separators; corrupted trees where the sops metadata keys were mangled before serialization.

Related errors

• Error encoding section
• Could not unmarshal input data
• Error encoding section: Section values should always be…
• Error marshaling metadata
• Error while unflattening

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/5f0a85e028ea2839. Report an issue: GitHub.

Appendix: source

Thrown at stores/ini/store.go:63

			first := 0
			if len(itemTree) > 0 {
				if sectionComment, ok := itemTree[0].Key.(sops.Comment); ok {
					section.Comment = sectionComment.Value
					first = 1
				}
			}

			var lastItem *ini.Key
			for i := first; i < len(itemTree); i++ {
				keyVal := itemTree[i]
				if comment, ok := keyVal.Key.(sops.Comment); ok {
					if lastItem != nil {
						lastItem.Comment = comment.Value
					}
				} else {
					lastItem, err = section.NewKey(keyVal.Key.(string), stores.ValToString(keyVal.Value))
					if err != nil {
						return nil, fmt.Errorf("Error encoding key: %s", err)
					}
				}
			}
		}
	}
	var buffer bytes.Buffer
	iniFile.WriteTo(&buffer)
	return buffer.Bytes(), nil
}

func (store Store) stripCommentChar(comment string) string {
	if strings.HasPrefix(comment, ";") {
		comment = strings.TrimLeft(comment, "; ")
	} else if strings.HasPrefix(comment, "#") {
		comment = strings.TrimLeft(comment, "# ")
	}
	return comment
}

View on GitHub (pinned to 13442bb981)