sops-install-secrets built with Go 1.25.10 crashes before main with runtime bad TinySizeClass

[bogorad]

Summary

After updating sops-nix to commit 9ed65852b6257fbeae4355bc24ecfea307ca759a, my NixOS system build fails because the generated sops-install-secrets binary crashes before entering main.

The binary was built with Go 1.25.10.

Pinning sops-nix back to c591bf665727040c6cc5cb409079acb22dcce33c fixes the build.

Failure

The failing derivation is a generated manifest.json derivation whose checkPhase runs:

sops-install-secrets -check-mode=sopsfile "$out"

That check crashes with:

fatal error: bad TinySizeClass
runtime: panic before malloc heap initialized

runtime stack:
runtime.throw({0x1b4027c?, 0x2cfa7a0?})
        runtime/panic.go:1094 +0x48
runtime.mallocinit()
        runtime/malloc.go:377 +0x39d
runtime.schedinit()
        runtime/proc.go:875 +0xfd
runtime.rt0_go()
        runtime/asm_amd64.s:349 +0x11c

Running the built binary directly also reproduces the crash, without needing any secrets or manifest input:

/nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets --help

Binary Metadata

go version -m reports:

/nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets: go1.25.10
path    github.com/Mic92/sops-nix/pkgs/sops-install-secrets
build   -buildmode=exe
build   -compiler=gc
build   -trimpath=true
build   CGO_ENABLED=1
build   GOARCH=amd64
build   GOOS=linux
build   GOAMD64=v1

The executable is dynamically linked:

ELF 64-bit LSB executable, x86-64, dynamically linked
interpreter: glibc-2.42-61/lib/ld-linux-x86-64.so.2

Version Range

Broken:

sops-nix rev 9ed65852b6257fbeae4355bc24ecfea307ca759a
Go compiler/runtime: go1.25.10

Working after rollback:

sops-nix rev c591bf665727040c6cc5cb409079acb22dcce33c

Impact

This prevents nixos-rebuild from completing on a system using the NixOS sops-nix module, because manifest.json.drv fails, then activate.drv, dry-activate.drv, and the final nixos-system-* derivation fail as downstream dependencies.

Notes

The crash happens before program code runs, so this does not appear to be caused by a malformed secret or manifest. The same binary crashes on --help.

[SuperSandro2000]

You are on nixos-25.11-small, right?

[bogorad]

nope, 26.05

   chuck@nix-sp
   ------------
   OS: NixOS 26.05 (Yarara) x86_64
   Host: KVM/QEMU Standard PC (i440FX + PIIX, 1996) (pc-i440fx-11.0)
   Kernel: Linux 6.18.33
   Uptime: 4 days, 10 hours, 17 mins
   Packages: 1505 (nix-system), 432 (nix-user)
   Shell: zsh 5.9
   Terminal: tmux 3.6a
   Locale: en_US.UTF-8

[SuperSandro2000]

Hmmm, cannot reproduce this. Maybe your nix store is corrupted?

[sedlund]

nix run github:mic92/sops-nix/9ed65852b6257fbeae4355bc24ecfea307ca759a#sops-install-secrets -- --help

Usage: /nix/store/1krad1xiljpnpb5x66khhm08q6wx302v-sops-install-secrets-0.0.1/bin/sops-install-secrets [OPTION] manifest.json
  -check-mode string
    	Validate configuration without installing it (possible values: "manifest","sopsfile","off") (default "off")
  -ignore-passwd
    	Don't look up anything in /etc/passwd. Causes everything to be owned by root:root or the user executing the tool in user mode

go 1.25.10 is the current default for nixpkgs 25.11 . what input overrides are you using ?

[bogorad]

Input overrides used for the retest:

sudo nixos-rebuild switch \
  --accept-flake-config \
  --flake /persist/nix-config/nx-ago-testing \
  --option eval-cache false \
  --override-input sops-nix github:Mic92/sops-nix \
  --no-update-lock-file \
  --no-write-lock-file

That resolves sops-nix to:

github:Mic92/sops-nix/9ed65852b6257fbeae4355bc24ecfea307ca759a
narHash=sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=
date shown by Nix: 2026-06-04

The working pinned input is:

github:Mic92/sops-nix/c591bf665727040c6cc5cb409079acb22dcce33c
narHash=sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=
date shown by Nix: 2026-05-05

No separate Go override is applied to sops-install-secrets in this retest. The generated failing derivation records:

binary: /nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets
Go runtime: go1.25.10
module path: github.com/Mic92/sops-nix/pkgs/sops-install-secrets
sops dependency: github.com/getsops/sops/v3 v3.12.2
CGO_ENABLED=1
GOARCH=amd64
GOOS=linux
GOAMD64=v1
dynamic linker: /nix/store/57iz36553175g3178pvxjij8z5rcsd4n-glibc-2.42-61/lib/ld-linux-x86-64.so.2
deriver: /nix/store/whdzz6qx6p6f1ijxqm5r4mi49l71ccl1-sops-install-secrets-0.0.1.drv

The failure still reproduces with Nix eval cache disabled:

Failed derivation: /nix/store/irzmn91qgr7p61wbyrfwdxwww7lplasc-manifest-for-users.json.drv
Failed check phase:
/nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets -check-mode=sopsfile "$out"

fatal error: bad TinySizeClass
runtime: panic before malloc heap initialized

runtime stack:
runtime.throw({0x1b4027c?, 0x2cfa7a0?})
    runtime/panic.go:1094 +0x48
runtime.mallocinit()
    runtime/malloc.go:377 +0x39d
runtime.schedinit()
    runtime/proc.go:875 +0xfd
runtime.rt0_go()
    runtime/asm_amd64.s:349 +0x11c

The same generated binary also panics on --help, before flag parsing.

Host details:

OS: NixOS 26.05 (Yarara) x86_64
Kernel: Linux 6.18.33
nixos-version: 26.05.20260603.6b31628 (Yarara)
nix: 2.34.7
go on PATH: go1.26.3 linux/amd64
sops on PATH: sops 3.13.1
glibc: 2.42
Host: KVM/QEMU Standard PC (i440FX + PIIX, 1996)
CPU: QEMU Virtual version 2.5+ (7) @ 1.80 GHz

[SuperSandro2000]

I have the same exact version as you and for me it works.

 ➜ /nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets --help
Usage: /nix/store/3m6yipp6zkjip9vhvdv7wg3mqf1s15a4-sops-install-secrets-0.0.1/bin/sops-install-secrets [OPTION] manifest.json
  -check-mode string
        Validate configuration without installing it (possible values: "manifest","sopsfile","off") (default "off")
  -ignore-passwd
        Don't look up anything in /etc/passwd. Causes everything to be owned by root:root or the user executing the tool in user mode