What causes "%s's entry %d is empty" in getsops/sops?

Remove the empty entry — delete duplicate, leading, or trailing commas from SOPS_HC_VAULT_ALLOWLIST

%s's entry %d is empty

Error message

%s's entry %d is empty

What it means

parseAllowlistString splits the SOPS_HC_VAULT_ALLOWLIST value on commas and rejects any entry that is empty after trimming spaces (hcvault/keysource.go:77). The error names the env var and the 1-based entry position, and aborts Vault client creation, so every Vault encrypt/decrypt fails until the variable is fixed or unset.

Source

Thrown at hcvault/keysource.go:77

func parseAllowlistString(allowlistStr string) (allowList, error) {
	switch allowlistStr {
	case AllowlistAllHosts:
		return allowList{
			All:  true,
			URIs: nil,
		}, nil
	case AllowlistNoHosts:
		return allowList{
			All:  false,
			URIs: nil,
		}, nil
	}
	uris := strings.Split(allowlistStr, ",")
	for idx, uri := range uris {
		uri = strings.Trim(uri, " ")
		if uri == "" {
			return allowList{}, fmt.Errorf("%s's entry %d is empty", SopsHCVaultAllowlist, idx+1)
		}
		if !strings.HasSuffix(uri, "/") {
			uri = uri + "/"
		}
		uris[idx] = uri
	}
	return allowList{
		All:  false,
		URIs: uris,
	}, nil
}

func getAllowlist() (allowList, error) {
	var allowlistStr = AllowlistDefault
	if allowlist, ok := os.LookupEnv(SopsHCVaultAllowlist); ok && len(allowlist) > 0 {
		allowlistStr = allowlist
	}
	return parseAllowlistString(allowlistStr)

View on GitHub (pinned to 13442bb981)

Solutions

Remove the empty entry — delete duplicate, leading, or trailing commas from SOPS_HC_VAULT_ALLOWLIST
Fix CI/templating so the variable is not expanded with blank segments
Unset the variable entirely to fall back to the default allowlist (AllowlistAllHosts)
Use the special values 'all' or 'none' if you intended allow/deny-all behavior

Example fix

// before
$ export SOPS_HC_VAULT_ALLOWLIST="https://vault1.example.com/,,https://vault2.example.com/"
// after
$ export SOPS_HC_VAULT_ALLOWLIST="https://vault1.example.com/,https://vault2.example.com/"

Defensive patterns

Strategy: validation

Validate before calling

// shell: validate the allowlist before running sops
for entry in $(echo "$SOPS_HC_VAULT_ALLOWLIST" | tr ',' '\n'); do
  [ -n "$entry" ] || { echo "empty allowlist entry"; exit 1; }
done

Type guard

func allowlistValid(s string) bool {
    for _, e := range strings.Split(s, ",") {
        if strings.Trim(e, " ") == "" { return false }
    }
    return len(strings.TrimSpace(s)) > 0
}

Try / catch

if _, err := getAllowlist(); err != nil {
    return fmt.Errorf("fix SOPS_HC_VAULT_ALLOWLIST (no empty entries): %w", err)
}

Prevention

Avoid trailing commas when composing the variable in scripts
Quote the value in shell to prevent word-splitting artifacts
Prefer setting the variable once in a shared profile over ad-hoc edits
Use 'all'/'none' keywords where you mean allow/deny-all

When it happens

Trigger: Setting SOPS_HC_VAULT_ALLOWLIST to a value with an empty element — e.g. 'https://a.example.com/,,https://b.example.com/', a trailing comma 'https://a.example.com/', a lone comma, or spaces-only entries like 'a, ,b'.

Common situations: Hand-edited env var with a trailing or double comma; templating/CI substitution that leaves a blank between commas; concatenating lists in shell scripts producing an empty segment.

Related errors

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/2ca1a735661680f5. Report an issue: GitHub.