SOPS_AGE_SSH_PRIVATE_KEY_FILE fails without an error
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
I'm using sops 3.11.0 and trying to decrypt a file. This seems to be failing with basically output about why it fails. I'm using the following command: sops -d secret_file. This is the output:
Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
[AGE KEY]: FAILED
- | failed to create reader for decrypting sops data key with
| age: no identity matched any of the recipients. Did not find
| keys in locations 'SOPS_AGE_SSH_PRIVATE_KEY_FILE',
| '/home/<user>/.ssh/id_rsa', 'SOPS_AGE_KEY',
| 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'.
[ANOTHER KEY]: FAILED
...
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
I have an ssh key file which should be able to decrypt this file, and I'm using the following command to try and get sops to recognize that:
env SOPS_AGE_SSH_PRIVATE_KEY_FILE=/path/to/ssh_key sops -d secret_file. This produces the following output:
Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
[AGE KEY]: FAILED
- | failed to create reader for decrypting sops data key with
| age: no identity matched any of the recipients. Did not find
| keys in locations '/home/<user>/.ssh/id_rsa',
| 'SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'.
[ANOTHER KEY]: FAILED
...
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
So it... checks the path? But seems to quietly fail???? The only weirdness here that I can think of is that the ssh key file is in a linked directory. It's annoying that I'm just getting - no additional info about WHY the key I provided fails.
When I run the command with --verbose I just get the following additional output:
[AGE] INFO[0000] Decryption failed
[PGP] INFO[0003] Decryption failed fingerprint=[ANOTHER KEY]
Anyways - not really sure what to do with this or how to even start debugging this since there is no real output.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Start by tracing handling of SOPS_AGE_SSH_PRIVATE_KEY_FILE through the age decryption error path, comparing it with the other identity sources; done means a configured SSH key failure reports why the key was unusable instead of silently omitting it from the locations list.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100