getsops/sops · error

failed to base64 decode decrypted data key: %w

Error message

failed to base64 decode decrypted data key: %w

What it means

HuaweiCloud KMS returns decrypted plaintext as a base64 string; SOPS decodes it with base64.StdEncoding (hckms/keysource.go:230). If the returned string is not valid standard base64, this error wraps the decode failure — the data key bytes cannot be reconstructed.

Source

Thrown at hckms/keysource.go:230

			CipherText:          key.EncryptedKey,
			EncryptionAlgorithm: &decryptAlgorithm,
			KeyId:               &key.KeyUUID,
		},
	}

	response, err := client.DecryptData(request)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to decrypt sops data key with HuaweiCloud KMS: %w", err)
	}

	if response.PlainText == nil {
		return nil, fmt.Errorf("decryption response missing plaintext")
	}
	decrypted, err := base64.StdEncoding.DecodeString(*response.PlainText)
	if err != nil {
		log.WithField("keyID", key.KeyID).Info("Decryption failed")
		return nil, fmt.Errorf("failed to base64 decode decrypted data key: %w", err)
	}

	log.WithField("keyID", key.KeyID).Info("Decryption succeeded")
	return decrypted, nil
}

// NeedsRotation returns whether the data key needs to be rotated or not.
func (key *MasterKey) NeedsRotation() bool {
	return time.Since(key.CreationDate) > hckmsTTL
}

// ToString converts the key to a string representation.
func (key *MasterKey) ToString() string {
	return key.KeyID
}

// ToMap converts the MasterKey to a map for serialization purposes.
func (key MasterKey) ToMap() map[string]interface{} {

View on GitHub (pinned to 13442bb981)

Solutions

1. Log the raw PlainText value to inspect its encoding
2. Remove any proxy/intermediary that could rewrite the response body and retry
3. Try decoding as RawURLEncoding/URLEncoding locally to diagnose a non-standard encoder at the endpoint
4. Ensure you are on an official KMS endpoint and a current huaweicloud-sdk-go-v3 release

func isBase64(s string) bool {
    _, err := base64.StdEncoding.DecodeString(s)
    return err == nil
}

if _, err := base64.StdEncoding.DecodeString(raw); err != nil {
    if d, e2 := base64.URLEncoding.DecodeString(raw); e2 == nil {
        _ = d // endpoint returned URL-safe base64: investigate endpoint
    }
}

When it happens

Trigger: client.DecryptData succeeds but *response.PlainText fails base64.StdEncoding.DecodeString — corrupted or non-standard-encoded payload in the API response.

Common situations: Intermediary (proxy, service mesh) re-encoding or truncating the response body; custom KMS-compatible endpoint returning URL-safe base64 or raw bytes; SDK version mismatch producing malformed field content.

Related errors

• failed to decrypt sops data key with HuaweiCloud KMS: %w
• decryption response missing plaintext
• failed to base64 decode Azure Key Vault encrypted key: %w
• failed to decrypt sops data key with GCP KMS key: %w
• invalid key ID format: expected 'region:key-uuid', got %q

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/d826ae8e9a8d3002. Report an issue: GitHub.