cache-replay: verifier environment variable %q is invalid or

Error message

cache-replay: verifier environment variable %q is invalid or credential-bearing

What it means

Error "cache-replay: verifier environment variable %q is invalid or credential-bearing" thrown in JuliusBrussee/caveman.

Source

Thrown at cacheengine/cmd/cache-replay/main.go:407

				return errors.New("cache-replay: Bedrock bearer token or AWS access credentials unavailable")
			}
		default:
			return fmt.Errorf("cache-replay: unsupported provider %q", provider)
		}
	}
	return nil
}

func verifierEnvironment(extra []string) ([]string, error) {
	allowed := map[string]bool{"PATH": true, "LANG": true, "LC_ALL": true, "TMPDIR": true}
	blocked := map[string]bool{
		"OPENAI_API_KEY": true, "ANTHROPIC_API_KEY": true, "GEMINI_API_KEY": true,
		"AWS_BEARER_TOKEN_BEDROCK": true, "AWS_ACCESS_KEY_ID": true, "AWS_SECRET_ACCESS_KEY": true, "AWS_SESSION_TOKEN": true,
	}
	for _, name := range extra {
		name = strings.TrimSpace(name)
		if !validEnvironmentName(name) || blocked[name] {
			return nil, fmt.Errorf("cache-replay: verifier environment variable %q is invalid or credential-bearing", name)
		}
		allowed[name] = true
	}
	names := make([]string, 0, len(allowed))
	for name := range allowed {
		names = append(names, name)
	}
	sort.Strings(names)
	result := make([]string, 0, len(names))
	for _, name := range names {
		if value, ok := os.LookupEnv(name); ok {
			result = append(result, name+"="+value)
		}
	}
	return result, nil
}

func validEnvironmentName(value string) bool {

View on GitHub (pinned to 27d5a3981a)

Solutions

Remove or rename the verifier environment variable; it is invalid or credential-bearing.

When it happens

Trigger: Thrown at cacheengine/cmd/cache-replay/main.go:407 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/60f66db093e8b84a. Report an issue: GitHub.