malformed SSH identity returned by running SOPS_AGE_SSH_PRIV

Error message

malformed SSH identity returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD: %q

What it means

Error "malformed SSH identity returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD: %q" thrown in getsops/sops.

Source

Thrown at age/keysource.go:583

		return plugin.NewIdentity(s, pluginTerminalUI)
	case strings.HasPrefix(s, "AGE-SECRET-KEY-PQ-1"):
		return age.ParseHybridIdentity(s)
	case strings.HasPrefix(s, "AGE-SECRET-KEY-1"):
		return age.ParseX25519Identity(s)
	default:
		return nil, fmt.Errorf("unknown identity type")
	}
}

// parseSSHIdentityFromPrivateKeyCmdOutput returns an age.Identity from the given
// private key. Note that encrypted private keys are not supported.
func parseSSHIdentityFromPrivateKeyCmdOutput(key []byte) (age.Identity, error) {
	id, err := agessh.ParseIdentity(key)
	if sshErr, ok := err.(*ssh.PassphraseMissingError); ok {
		return nil, fmt.Errorf("the SSH key returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD is password protected, which is unsupported. (%q)", sshErr)
	}
	if err != nil {
		return nil, fmt.Errorf("malformed SSH identity returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD: %q", err)
	}
	return id, nil
}

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at age/keysource.go:583 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/37213a2c5ebb4fea. Report an issue: GitHub.