Internal error: unexpected metadata conversion result %T

Error message

Internal error: unexpected metadata conversion result %T

What it means

An internal invariant failure in metadataToTreeBranch: the internal metadata conversion (goMapToInternal→convertMetadata) returned a value that is not a sops.TreeBranch. This should be impossible with valid code paths, so the error indicates an unexpected programming-level inconsistency rather than bad user input.

Source

Thrown at stores/metadata.go:265

	config := mapstructure.DecoderConfig{
		Result: &mdMap,
	}
	d, err := mapstructure.NewDecoder(&config)
	if err != nil {
		return nil, err
	}
	err = d.Decode(md)
	if err != nil {
		return nil, err
	}
	metadata, err := goToSops(mdMap)
	if err != nil {
		return nil, err
	}
	if tb, ok := metadata.(sops.TreeBranch); ok {
		return tb, nil
	}
	return nil, fmt.Errorf("Internal error: unexpected metadata conversion result %T", metadata)
}

// SerializeMetadata embeds the metadata of `data` into its tree branches.
func SerializeMetadata(data sops.Tree, opts MetadataOpts) (sops.TreeBranches, error) {
	md, err := metadataToTreeBranch(metadataFromInternal(data.Metadata))
	if err != nil {
		return nil, fmt.Errorf("Error while serializing metadata: %w", err)
	}
	if opts.Flatten != MetadataFlattenNone {
		var prefix string
		if opts.Flatten == MetadataFlattenFull {
			prefix = SopsPrefix
		}
		md, err = flattenTreeBranch(md, prefix)
		if err != nil {
			return nil, fmt.Errorf("Error while flattening metadata: %w", err)
		}
		if opts.EscapeNewlines {

View on GitHub (pinned to 13442bb981)

Solutions

Report the issue upstream to sops with the wrapped input metadata and version
Pin/return to an official sops release instead of a custom build
Verify no local modifications changed the metadata conversion return type
As a workaround, rebuild the tree via standard APIs (LoadEncryptedFile → EmitEncryptedFile) rather than custom conversion

Defensive patterns

Strategy: try-catch

Try / catch

tb, err := stores.SerializeMetadata(tree, opts)
if err != nil {
	if strings.Contains(err.Error(), "Internal error: unexpected metadata conversion result") {
		return fmt.Errorf("sops internal invariant violated; report upstream with version and repro: %w", err)
	}
	return err
}

Prevention

Use official sops releases, not patched forks
Avoid altering the metadata conversion pipeline
Populate trees via standard APIs (LoadEncryptedFile)
Report occurrences upstream as library bugs

When it happens

Trigger: Calling SerializeMetadata (directly or via EmitEncryptedFile) when the metadata conversion pipeline returns a non-TreeBranch value — realistically only via a modified/patched library, a custom Metadata type, or a genuine sops bug.

Common situations: Forked or monkey-patched sops code, custom builds where the metadata conversion was altered, or a library bug — end users of stock sops should essentially never see this.

Related errors

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/f877cfd69bc5478a. Report an issue: GitHub.