getsops / getsops/sops

SOPS_AGE_SSH_PRIVATE_KEY_FILE fails without an error

Open
#1,999 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/keyservice bug keyservice/age
Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

I'm using sops 3.11.0 and trying to decrypt a file. This seems to be failing with basically output about why it fails. I'm using the following command: sops -d secret_file. This is the output:

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  [AGE KEY]: FAILED
    - | failed to create reader for decrypting sops data key with
      | age: no identity matched any of the recipients. Did not find
      | keys in locations 'SOPS_AGE_SSH_PRIVATE_KEY_FILE',
      | '/home/<user>/.ssh/id_rsa', 'SOPS_AGE_KEY',
      | 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'.

[ANOTHER KEY]: FAILED
...

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

I have an ssh key file which should be able to decrypt this file, and I'm using the following command to try and get sops to recognize that:
env SOPS_AGE_SSH_PRIVATE_KEY_FILE=/path/to/ssh_key sops -d secret_file. This produces the following output:

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  [AGE KEY]: FAILED
    - | failed to create reader for decrypting sops data key with
      | age: no identity matched any of the recipients. Did not find
      | keys in locations '/home/<user>/.ssh/id_rsa',
      | 'SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'.

  [ANOTHER KEY]: FAILED
  ...

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

So it... checks the path? But seems to quietly fail???? The only weirdness here that I can think of is that the ssh key file is in a linked directory. It's annoying that I'm just getting - no additional info about WHY the key I provided fails.

When I run the command with --verbose I just get the following additional output:

[AGE]	 INFO[0000] Decryption failed
[PGP]	 INFO[0003] Decryption failed                             fingerprint=[ANOTHER KEY]

Anyways - not really sure what to do with this or how to even start debugging this since there is no real output.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by tracing handling of SOPS_AGE_SSH_PRIVATE_KEY_FILE through the age decryption error path, comparing it with the other identity sources; done means a configured SSH key failure reports why the key was unusable instead of silently omitting it from the locations list.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.