getsops/sops · error

key UUID cannot be empty in key ID: %q

Error message

key UUID cannot be empty in key ID: %q

What it means

The mirror case of error 87: the region part parsed fine but the UUID segment after the colon is empty after trimming, so parseKeyID rejects the ID because without a key UUID no KMS key can be addressed.

Source

Thrown at hckms/keysource.go:111

		keys = append(keys, k)
	}
	return keys, nil
}

// parseKeyID parses a key ID in format "region:key-uuid" and returns the region and UUID.
func parseKeyID(keyID string) (string, string, error) {
	keyID = strings.TrimSpace(keyID)
	parts := strings.SplitN(keyID, ":", 2)
	if len(parts) != 2 {
		return "", "", fmt.Errorf("invalid key ID format: expected 'region:key-uuid', got %q", keyID)
	}
	region := strings.TrimSpace(parts[0])
	keyUUID := strings.TrimSpace(parts[1])
	if region == "" {
		return "", "", fmt.Errorf("region cannot be empty in key ID: %q", keyID)
	}
	if keyUUID == "" {
		return "", "", fmt.Errorf("key UUID cannot be empty in key ID: %q", keyID)
	}
	return region, keyUUID, nil
}

// Credentials is a wrapper around auth.ICredential used for authentication
// towards HuaweiCloud KMS.
type Credentials struct {
	credential auth.ICredential
}

// NewCredentials returns a Credentials object with the provided auth.ICredential.
func NewCredentials(c auth.ICredential) *Credentials {
	return &Credentials{credential: c}
}

// ApplyToMasterKey configures the credentials on the provided key.
func (c Credentials) ApplyToMasterKey(key *MasterKey) {
	key.credentials = c.credential

View on GitHub (pinned to 13442bb981)

Solutions

1. Append the actual KMS key UUID after the colon.
2. Copy the key ID from HuaweiCloud KMS console (key details page) to get the full UUID.
3. Verify template variables: both REGION and KEY_ID must render non-empty.

Example fix

// before
// huawei://eu-west-0:
// after
// huawei://eu-west-0:9a8b7c6d-1234-5678-9abc-def012345678

parts := strings.SplitN(strings.TrimSpace(keyID), ":", 2)
if len(parts) == 2 && strings.TrimSpace(parts[1]) == "" {
    return errors.New("key UUID segment empty: append the KMS key UUID after the colon")
}

null

null

When it happens

Trigger: NewMasterKey given a key ID like 'eu-west-0:' or 'eu-west-0: ' — colon present but the key UUID segment is blank after TrimSpace.

Common situations: Truncating the ID during copy-paste so only the region and colon remain; a placeholder like 'REGION:' left un-substituted from a template; YAML key dropped from an env-var-driven value.

Related errors

• invalid key ID format: expected 'region:key-uuid', got %q
• region cannot be empty in key ID: %q
• no valid resource ID found in %q
• invalid region %q: %w
• failed to create HuaweiCloud KMS client: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/c694dd253f8e6ea0. Report an issue: GitHub.