Activity

1. chirayuk commented on Jul 22, 2025

   

   chirayuk

   on Jul 22, 2025

   Last edited by chirayuk

   More actions

   I'm experiencing this issue as well on v3.10.2 (and v3.10.1). Unix socket fails (tcp works fine). No logs on the server process.
2. felixfontein

   added

   bug

   area/keyservice

   on Jul 23, 2025
3. felixfontein commented on Jul 23, 2025

   

   felixfontein

   on Jul 23, 2025

   Contributor

   More actions

   I can confirm that this is caused by 060f7a4.

   When playing around a bit, it seems that

   diff --git a/cmd/sops/main.go b/cmd/sops/main.go
   index f40b181ee..cef927f35 100644
   --- a/cmd/sops/main.go
   +++ b/cmd/sops/main.go
   @@ -2178,22 +2178,26 @@ func keyservices(c *cli.Context) (svcs []keyservice.KeyServiceClient) {
                           continue
                   }
                   addr := url.Host
   -               if url.Scheme == "unix" {
   -                       addr = url.Path
   -               }
   +               addrToUse := addr
                   opts := []grpc.DialOption{
                           grpc.WithTransportCredentials(insecure.NewCredentials()),
   -                       grpc.WithContextDialer(
   -                               func(ctx context.Context, addr string) (net.Conn, error) {
   -                                       return (&net.Dialer{}).DialContext(ctx, url.Scheme, addr)
   -                               },
   -                       ),
   +               }
   +               if url.Scheme == "unix" {
   +                       addr = url.Path
   +                       addrToUse = uri
   +               } else {
   +                       opts = append(opts,
   +                               grpc.WithContextDialer(
   +                                       func(ctx context.Context, addr string) (net.Conn, error) {
   +                                               return (&net.Dialer{}).DialContext(ctx, url.Scheme, addr)
   +                                       },
   +                               ))
                   }
                   log.WithField(
                           "address",
                           fmt.Sprintf("%s://%s", url.Scheme, addr),
                   ).Infof("Connecting to key service")
   -               conn, err := grpc.NewClient(addr, opts...)
   +               conn, err := grpc.NewClient(addrToUse, opts...)
                   if err != nil {
                           log.Fatalf("failed to listen: %v", err)
                   }

   solves the problem. I cannot really claim that I understand whether it has unwanted side-effects, though...

   @getsops/maintainers does anyone of you have a better idea about this?

   😄React with 😄1Reacted by Chirayu Krishnappa
4. matheuscscp commented on Aug 10, 2025

   

   matheuscscp

   on Aug 10, 2025

   Contributor

   More actions

   @felixfontein This fix is completely safe, the *net.Dialer that will be used for unix sockets without the grpc.WithContextDialer() option is the following:

   https://github.com/grpc/grpc-go/blob/57b69b47a2da17098c387c8c64c4aab5295cbd3e/internal/tcp_keepalive_unix.go#L30-L54

   // NetDialerWithTCPKeepalive returns a net.Dialer that enables TCP keepalives on
   // the underlying connection with OS default values for keepalive parameters.
   //
   // TODO: Once https://github.com/golang/go/issues/62254 lands, and the
   // appropriate Go version becomes less than our least supported Go version, we
   // should look into using the new API to make things more straightforward.
   func NetDialerWithTCPKeepalive() *net.Dialer {
   	return &net.Dialer{
   		// Setting a negative value here prevents the Go stdlib from overriding
   		// the values of TCP keepalive time and interval. It also prevents the
   		// Go stdlib from enabling TCP keepalives by default.
   		KeepAlive: time.Duration(-1),
   		// This method is called after the underlying network socket is created,
   		// but before dialing the socket (or calling its connect() method). The
   		// combination of unconditionally enabling TCP keepalives here, and
   		// disabling the overriding of TCP keepalive parameters by setting the
   		// KeepAlive field to a negative value above, results in OS defaults for
   		// the TCP keepalive interval and time parameters.
   		Control: func(_, _ string, c syscall.RawConn) error {
   			return c.Control(func(fd uintptr) {
   				unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_KEEPALIVE, 1)
   			})
   		},
   	}
   }

   For unix sockets, this *net.Dialer is functionally equivalent to the one being used before (i.e. &net.Dialer{}), because there's no such thing as TCP keepalive in unix sockets.

   Note: We could also remove the grpc.WithContextDialer() option entirely, as this default *net.Dialer chosen by grpc is probably fine for TCP. However, to fully maintain the current TCP behavior I would go with your fix as-is. PR: #1910

   👍React with 👍1Reacted by Chirayu Krishnappa
5. felixfontein

   closed this as completedin #1910on Sep 9, 2025
6. RussellAult commented on Sep 9, 2025

   

   RussellAult

   on Sep 9, 2025

   Contributor

   More actions

   Thanks for fixing this! Is there any chance of getting a release with the fix soon?