getsops/sops · error

failed to create new GnuPG home

Error message

failed to create new GnuPG home: %w

What it means

NewGnuPGHome creates a temporary directory (os.MkdirTemp with prefix 'sops-gnupghome-') to serve as an isolated GNUPGHOME. This error wraps a failure of MkdirTemp itself, meaning the OS refused to create the temp directory. It is rare and points to filesystem or environment problems with the temp directory.

Solutions

1. Check that $TMPDIR (or /tmp) exists and is writable: `ls -ld $TMPDIR /tmp`, then fix permissions or unset a bad TMPDIR.
2. Free disk space / raise quota if the filesystem is full.
3. Run `mktemp -d` manually to confirm temp creation works in your environment.
4. If TMPDIR must be nonstandard, set TMPDIR to a writable absolute path before running the program/tests.

Example fix

// before
export TMPDIR=/readonly/dir
// after
export TMPDIR=/tmp  # must exist and be writable by the current user

// Go: check temp dir writability before creating a GnuPG home
d := os.Getenv("TMPDIR"); if d == "" { d = os.TempDir() }
if fi, err := os.Stat(d); err != nil || !fi.IsDir() {
  return fmt.Errorf("temp dir %q unusable: %w", d, err)
}

// Go
home, err := pgp.NewGnuPGHome()
if err != nil {
  return fmt.Errorf("cannot create GnuPG home (check TMPDIR/disk space): %w", err)
}

When it happens

Trigger: Calling NewGnuPGHome (directly or via tests/helpers) when os.MkdirTemp("", "sops-gnupghome-") fails because TMPDIR is unwritable/nonexistent, the disk is full, or permission bits on the temp base directory forbid creation.

Common situations: TMPDIR pointing to a read-only or deleted directory; running as a user without write access to /tmp; disk quota/full disk in CI runners.

Related errors

• cannot read armored key data from file
• GNUPGHOME does not exist
• cannot import armored key data into GnuPG keyring
• cannot stat GNUPGHOME
• empty GNUPGHOME path

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/79282c7ba16661b4. Report an issue: GitHub.

Appendix: source

Thrown at pgp/keysource.go:125

	}
	for _, s := range strings.Split(fingerprint, ",") {
		keys = append(keys, NewMasterKeyFromFingerprint(s))
	}
	return keys
}

// GnuPGHome is the absolute path to a GnuPG home directory.
// A new keyring can be constructed by combining the use of NewGnuPGHome() and
// Import() or ImportFile().
type GnuPGHome string

// NewGnuPGHome initializes a new GnuPGHome in a temporary directory.
// The caller is expected to handle the garbage collection of the created
// directory.
func NewGnuPGHome() (GnuPGHome, error) {
	tmpDir, err := os.MkdirTemp("", "sops-gnupghome-")
	if err != nil {
		return "", fmt.Errorf("failed to create new GnuPG home: %w", err)
	}
	return GnuPGHome(tmpDir), nil
}

// Import attempts to import the armored key bytes into the GnuPGHome keyring.
// It returns an error if the GnuPGHome does not pass Validate, or if the
// import failed.
//
// Consider using ImportContext instead.
func (d GnuPGHome) Import(armoredKey []byte) error {
	return d.ImportContext(context.Background(), armoredKey)
}

// ImportContext attempts to import the armored key bytes into the GnuPGHome keyring.
// It returns an error if the GnuPGHome does not pass Validate, or if the
// import failed.
func (d GnuPGHome) ImportContext(ctx context.Context, armoredKey []byte) error {
	if err := d.Validate(); err != nil {

View on GitHub (pinned to 13442bb981)