Go panic when field that should be encrypted is not a string

Encrypt a document, e.g. secret: foo, and add an unencrypted trailing document, e.g.

secret: ENC[AES256_GCM,data:b/TD,iv:pJkVi56lj53ZxW8LIoMgadKbfeyAZK4yonV9cS3pQfE=,tag:8Hlrmt9nvwFGw14HoAVpEg==,type:str]
sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqMzJ5Znd0OW5ZZnFPRkpu
            cTlCdmloRng1RExHalE2dEVvQXVYblBJVkFZCmhNVVV0ZnlCVWlZTnh1MlVkUnBU
            VXdJREdwWDNObnRUUysvK0Zsd2ovWEEKLS0tIEU2YTBFVGRpV2hnQXZLTC9nQ0Rs
            d2RtZWNJVFlWQzdXME11SURwNU9SNW8KlSw1WSzYnEw2S9dv5LLZdFhgPN0a2WY5
            gf7Qi2NEr+eY6TNvhDRWRiV3BVJ3wsIea+RYVw24ug5LKFXSU9lC/g==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1zmmyk04g4p3l795sdf8a5h36ezxxvd7slu9wzz24shspy9wxtgfs58jw9f
    lastmodified: "2026-06-20T16:58:13Z"
    mac: ENC[AES256_GCM,data:hf2i9neMWvfYzilRbJAScJkd/9EuOYx/o1YOeMUzhEXX4a5QuJ8yC/OaGeKyNxp5FTaQGexNzQSHTE0Y7mK8rRTQYQvVDz+iOnqM1PKGuinfAIw87e+tZ3gqXNPHcvuEupXgTSnd7HPjiJBJVxZJo4XZvNRcDSLPP2KHM9lqZq8=,iv:UTroFPIzG0xMhGqEjRdx0hLcZ7mcRFKHudmQv1xeR/Y=,tag:uPuquOG+JdERCOMUL5sXiQ==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.0
---
added-key: true

Trying to decrypt this with sops decrypt gives the following:

panic: interface conversion: interface {} is bool, not string

goroutine 1 [running]:
github.com/getsops/sops/v3.Tree.Decrypt.Tree.Decrypt.func1.func2({0x55931d0b6e60, 0x55931bce4168}, {0x289a2e4bbb0, 0x1, 0x1}, {0x289a2f2a180?, 0x55931d0b6a60?, 0x55931a5beec5?})
	github.com/getsops/sops/v3/sops.go:616 +0x54e
github.com/getsops/sops/v3.TreeBranch.walkValue({0x289a2f963c0?, 0x55931d0b6a60?, 0x289a2e4a470?}, {0x55931d0b6e60?, 0x55931bce4168?}, {0x289a2e4bbb0, 0x1, 0x1}, {0x289a2f2a180, 0x1, ...}, ...)
	github.com/getsops/sops/v3/sops.go:348 +0xcd
github.com/getsops/sops/v3.TreeBranch.walkBranch({0x289a2f963c0, 0x1, 0x1}, {0x289a2f963c0, 0x1, 0x1}, {0x55931d737600, 0x0, 0x0}, {0x55931d737600, ...}, ...)
	github.com/getsops/sops/v3/sops.go:424 +0x94d
github.com/getsops/sops/v3.Tree.Decrypt.func1(...)
	github.com/getsops/sops/v3/sops.go:597
github.com/getsops/sops/v3.Tree.Decrypt({{{0x0, 0xee1c8bda5, 0x0}, {0x289a2fabc20, 0xc}, {0x0, 0x0}, {0x0, 0x0}, {0x0, ...}, ...}, ...}, ...)
	github.com/getsops/sops/v3/sops.go:639 +0x265
github.com/getsops/sops/v3/cmd/sops/common.DecryptTree({0x289a2a2ee00, {0x289a2e4a4c0, 0x1, 0x1}, {0x55931d65a160, 0x2, 0x2}, 0x0, {0x55931d5b5370, 0x289a2edfcb0}})
	github.com/getsops/sops/v3/cmd/sops/common/common.go:90 +0x14c
main.decryptTree({{0x55931d5b5370, 0x289a2edfcb0}, {0x7f4e4c3bfa00, 0x289a2fab908}, {0x7f4e4c3bfa00, 0x289a2faba98}, {0x289a30305a0, 0x2d}, 0x0, 0x0, ...})
	github.com/getsops/sops/v3/cmd/sops/decrypt.go:42 +0x229
main.decrypt({{0x55931d5b5370, 0x289a2edfcb0}, {0x7f4e4c3bfa00, 0x289a2fab908}, {0x7f4e4c3bfa00, 0x289a2faba98}, {0x289a30305a0, 0x2d}, 0x0, 0x0, ...})
	github.com/getsops/sops/v3/cmd/sops/decrypt.go:57 +0x88
main.main.func11(0x289a2c2f080)
	github.com/getsops/sops/v3/cmd/sops/main.go:877 +0x8a5
github.com/urfave/cli.HandleAction({0x55931d0f3340?, 0x55931d580160?}, 0x7?)
	github.com/urfave/cli@v1.22.17/app.go:524 +0x9f
github.com/urfave/cli.Command.Run({{0x55931bbd0443, 0x7}, {0x0, 0x0}, {0x0, 0x0, 0x0}, {0x55931bc55967, 0x61}, {0x0, ...}, ...}, ...)
	github.com/urfave/cli@v1.22.17/command.go:175 +0x6c6
github.com/urfave/cli.(*App).Run(0x289a2c32e00, {0x289a2aa6390, 0x3, 0x3})
	github.com/urfave/cli@v1.22.17/app.go:277 +0xc45
main.main()
	github.com/getsops/sops/v3/cmd/sops/main.go:2106 +0x1e95

If added-key is a string instead, I get

Error decrypting tree: Error walking tree: Could not decrypt value: Input string bar does not match sops' data format

While this isn't a valid file for SOPS (the added-key value should be encrypted), it definitely shouldn't panic.

While this isn't a valid file for SOPS (the added-key value should be encrypted), it definitely shouldn't panic.

Seems like this doesn't need to be a multi document, simply taking a key that's supposed to be encrypted and making it something other than a string causes it, for example

secret: true
sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNU1sT1FkZHVnNWlhZTFW
            cUdhc3MrN004UklMOTUwRkszK0lvNS84ZFFJCkhSUXloU2JxZGJDNnRYR01xcXA0
            VWw2dUtwSWcvUFIwK3NFUkRCdEVFODgKLS0tIHA0cUtudEw3VWlZY2lmcmlVQ1Ro
            SEVtRm5FOUhhb3ZZZ041NksybHlBajAKYd3FgnysN6TFpPjpJ2yG9A/FKfInE60q
            EclUX17O7Rj98HJOZ9RJvSKo6kiFJgXwzZ+fKfde0E40BJoH6d/M8w==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1zmmyk04g4p3l795sdf8a5h36ezxxvd7slu9wzz24shspy9wxtgfs58jw9f
    lastmodified: "2026-06-20T17:14:10Z"
    mac: ENC[AES256_GCM,data:2v+J/0AVmJLX27vw0DqDrq9RfF3YBo6axa0IHzFQTTwrxlcL9XbOR5A0S8qs3sxdznxclMFMK4CS5GEDUqG5ZcZ9u3XHyrGac1+EN7/krF6b95W13IhpqeHWxXMN3UQ1Vzcc1nnqamjuG2PKVyVsyE67OA6ln4SxNVqcNzyRPcg=,iv:DS7nom/N26pVFoxR/h2CismyT9aJXnd0fFg/4K5Rkfc=,tag:YglaKz+9umRQjb81cm9DJw==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.1

fix(decrypt): handle non-string values to prevent panic on multi-doc …

Navigation Menu

Repository navigation

Go panic when field that should be encrypted is not a string #2225

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Go panic when field that should be encrypted is not a string #2225

Description

Activity

felixfontein commented on Jun 20, 2026

tremwil commented on Jun 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions