getsops/sops · error

failed to read '%s': file too long

Error message

failed to read '%s': file too long

What it means

Error "failed to read '%s': file too long" thrown in getsops/sops.

Source

Thrown at age/encrypted_keys.go:127

func unwrapIdentities(location string, reader io.Reader, allowMultipleKeysPerLine bool) (ParsedIdentities, error) {
	b := bufio.NewReader(reader)
	p, _ := b.Peek(14) // length of "age-encryption" and "-----BEGIN AGE"
	peeked := string(p)

	switch {
	// An age encrypted file, plain or armored.
	case peeked == "age-encryption" || peeked == "-----BEGIN AGE":
		var r io.Reader = b
		if peeked == "-----BEGIN AGE" {
			r = armor.NewReader(r)
		}
		const privateKeySizeLimit = 1 << 24 // 16 MiB
		contents, err := io.ReadAll(io.LimitReader(r, privateKeySizeLimit))
		if err != nil {
			return nil, fmt.Errorf("failed to read '%s': %w", location, err)
		}
		if len(contents) == privateKeySizeLimit {
			return nil, fmt.Errorf("failed to read '%s': file too long", location)
		}
		// We use Base32 encoding instead of Base64 encoding, since our GPG agent package percent-encodes
		// the cache ID. Base64 has two characters ('+' and '/') that would end up as a longer sequence,
		// whence using Base64 encoding can suddenly blow up the cache key to more than GPG's maximum of
		// 50 characters.
		// By using 25 bytes, that translate to 25 / 5 * 8 = 40 letters/digits, we have a cache key of
		// length 47, whose percent-encoding always has 47 characters.
		contentsHash := sha256.Sum256(contents)
		cacheKey := fmt.Sprintf("SopsAge%s", base32.StdEncoding.EncodeToString(contentsHash[:25]))
		IncorrectPassphrase := func() {
			conn, err := gpgagent.NewConn()
			if err != nil {
				return
			}
			defer func(conn *gpgagent.Conn) {
				if err := conn.Close(); err != nil {
					log.Errorf("failed to close connection with gpg-agent: %s", err)
				}

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at age/encrypted_keys.go:127 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/326196c691bec27f. Report an issue: GitHub.