getsops/sops · error

Unknown datatype: %s

Error message

Unknown datatype: %s

What it means

Decrypt in aes/cipher.go reconstructs the plaintext value from the decrypted bytes according to the `type:` field stored in the ENC[] metadata. When that datatype string is not one of str, int, float, bool, time, comment, or the other supported types, the switch hits its default branch and this error is returned. It means the encrypted document contains a datatype label the current version of the SOPS AES cipher does not understand.

Source

Thrown at aes/cipher.go:121

	switch encryptedValue.datatype {
	case "str":
		plaintext = decryptedValue
	case "int":
		plaintext, err = strconv.Atoi(decryptedValue)
	case "float":
		plaintext, err = strconv.ParseFloat(decryptedValue, 64)
	case "bytes":
		plaintext = decryptedBytes
	case "bool":
		plaintext, err = strconv.ParseBool(decryptedValue)
	case "time":
		var value time.Time
		err = value.UnmarshalText(decryptedBytes)
		plaintext = value
	case "comment":
		plaintext = sops.Comment{Value: decryptedValue}
	default:
		return nil, fmt.Errorf("Unknown datatype: %s", encryptedValue.datatype)
	}
	c.stash[stashKey{plaintext: plaintext, additionalData: additionalData}] = encryptedValue.iv
	return plaintext, err
}

func isEmpty(value interface{}) bool {
	switch value := value.(type) {
	case string:
		return value == ""
	case []byte:
		return len(value) == 0
	case sops.Comment:
		return isEmpty(value.Value)
	default:
		return false
	}
}

View on GitHub (pinned to 13442bb981)

Solutions

1. Check the `type:` field of the failing ENC[] value and correct it to a supported datatype (str, int, float, bool, time, comment).
2. Re-encrypt the file with a matching version of SOPS so datatypes are rewritten to ones this cipher knows.
3. Add the missing datatype to the switch statement in Decrypt if you maintain a fork and need to support a new type.

Example fix

// before
ENC[AES256_GCM,data:xxxx,iv:yyy,tag:zzz,type:string]
// after
ENC[AES256_GCM,data:xxxx,iv:yyy,tag:zzz,type:str]

supported := map[string]bool{"str":true,"int":true,"float":true,"bool":true,"time":true,"comment":true}
if !supported[datatype] {
    return fmt.Errorf("datatype %q not supported by this sops version", datatype)
}

plaintext, err := cipher.Decrypt(v, key, ad)
if err != nil && strings.HasPrefix(err.Error(), "Unknown datatype") {
    // fall back to re-encrypting with a compatible sops version
}

When it happens

Trigger: Calling Cipher.Decrypt on an EncryptedValue whose `datatype` field is unrecognized — e.g. a manually edited or hand-crafted `ENC[AES256_GCM,...,type:xyz]` string, or a file produced by a newer SOPS version that added a new datatype this code does not know.

Common situations: Hand-editing encrypted values and mistyping the type suffix; opening files written by a newer/older SOPS with a datatype mismatch; tools that programmatically rewrite the ENC[] string and corrupt the type field.

Related errors

• Value to encrypt has unsupported type %T
• Could not initialize AES GCM encryption cipher: %s
• Could not generate random bytes for IV: %s
• Could not create GCM: %s
• Error marshaling timestamp %q: %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/ca647331ee0a520d. Report an issue: GitHub.