getsops/sops · error

the SSH key returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD

Error message

the SSH key returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD is password protected, which is unsupported. (%q)

What it means

Error "the SSH key returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD is password protected, which is unsupported. (%q)" thrown in getsops/sops.

Source

Thrown at age/keysource.go:580

func parseIdentity(s string) (age.Identity, error) {
	switch {
	case strings.HasPrefix(s, "AGE-PLUGIN-"):
		return plugin.NewIdentity(s, pluginTerminalUI)
	case strings.HasPrefix(s, "AGE-SECRET-KEY-PQ-1"):
		return age.ParseHybridIdentity(s)
	case strings.HasPrefix(s, "AGE-SECRET-KEY-1"):
		return age.ParseX25519Identity(s)
	default:
		return nil, fmt.Errorf("unknown identity type")
	}
}

// parseSSHIdentityFromPrivateKeyCmdOutput returns an age.Identity from the given
// private key. Note that encrypted private keys are not supported.
func parseSSHIdentityFromPrivateKeyCmdOutput(key []byte) (age.Identity, error) {
	id, err := agessh.ParseIdentity(key)
	if sshErr, ok := err.(*ssh.PassphraseMissingError); ok {
		return nil, fmt.Errorf("the SSH key returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD is password protected, which is unsupported. (%q)", sshErr)
	}
	if err != nil {
		return nil, fmt.Errorf("malformed SSH identity returned by running SOPS_AGE_SSH_PRIVATE_KEY_CMD: %q", err)
	}
	return id, nil
}

View on GitHub (pinned to 13442bb981)

When it happens

Trigger: Thrown at age/keysource.go:580 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/094abdd163e035f5. Report an issue: GitHub.