JuliusBrussee/caveman · error

envelope: decode wrapped key: %w

Error message

envelope: decode wrapped key: %w

What it means

open() could not base64-decode the WrappedDataKey field from the envelope metadata. The stored metadata is malformed at the key-encoding level (corruption or a non-standard encoding), so the data key cannot be unwrapped and decryption fails closed before any KMS call.

Source

Thrown at shared/platform/envelope/envelope.go:142

		return open(ciphertext, meta, nil)
	}
	if meta.Scheme != schemeV2 {
		return nil, fmt.Errorf("envelope: unknown scheme %q", meta.Scheme)
	}
	aad, scopeHash, err := scopeAAD(scope)
	if err != nil {
		return nil, err
	}
	if meta.ScopeHash != scopeHash {
		return nil, fmt.Errorf("envelope: tenant scope mismatch")
	}
	return open(ciphertext, meta, aad)
}

func open(ciphertext []byte, meta Metadata, aad []byte) ([]byte, error) {
	wrapped, err := base64.StdEncoding.DecodeString(meta.WrappedDataKey)
	if err != nil {
		return nil, fmt.Errorf("envelope: decode wrapped key: %w", err)
	}
	dataKey, err := secretbox.DecryptPayloadKey(wrapped)
	if err != nil {
		return nil, fmt.Errorf("envelope: unwrap data key: %w", err)
	}
	block, err := aes.NewCipher(dataKey)
	if err != nil {
		return nil, fmt.Errorf("envelope: aes: %w", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, fmt.Errorf("envelope: gcm: %w", err)
	}
	ns := gcm.NonceSize()
	if len(ciphertext) < ns {
		return nil, fmt.Errorf("envelope: ciphertext too short")
	}
	nonce, ct := ciphertext[:ns], ciphertext[ns:]

View on GitHub (pinned to 766dce6b13)

Solutions

1. Verify the metadata blob integrity; restore from backup if corrupted
2. Ensure producers write standard base64 (StdEncoding) wrapped keys

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:142 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/0336ef9fbf6429e9. Report an issue: GitHub.