JuliusBrussee/caveman · error

envelope: unknown scheme %q

Error message

envelope: unknown scheme %q

What it means

The envelope metadata declares a scheme that is neither v1 nor v2, so no decryption path exists for it. This is the fail-closed branch for unknown/forward-versioned schemes: ciphertext from a newer or unrecognized format is refused rather than guessed at.

Source

Thrown at shared/platform/envelope/envelope.go:111

	metaJSON, err = json.Marshal(meta)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: marshal metadata: %w", err)
	}
	return ciphertext, metaJSON, nil
}

// Open reverses Seal: it unwraps the data key from metadata and decrypts the
// ciphertext. An unknown scheme fails closed.
func Open(ciphertext []byte, metaJSON []byte) ([]byte, error) {
	var meta Metadata
	if err := json.Unmarshal(metaJSON, &meta); err != nil {
		return nil, fmt.Errorf("envelope: parse metadata: %w", err)
	}
	if meta.Scheme == schemeV2 {
		return nil, fmt.Errorf("envelope: tenant scope required for scheme %q", meta.Scheme)
	}
	if meta.Scheme != schemeV1 {
		return nil, fmt.Errorf("envelope: unknown scheme %q", meta.Scheme)
	}
	return open(ciphertext, meta, nil)
}

// OpenForScope opens v2 ciphertext only for its authenticated scope. It also
// reads v1 ciphertext during migration; all new tenant-object writes use v2.
func OpenForScope(ciphertext []byte, metaJSON []byte, scope Scope) ([]byte, error) {
	var meta Metadata
	if err := json.Unmarshal(metaJSON, &meta); err != nil {
		return nil, fmt.Errorf("envelope: parse metadata: %w", err)
	}
	if meta.Scheme == schemeV1 {
		return open(ciphertext, meta, nil)
	}
	if meta.Scheme != schemeV2 {
		return nil, fmt.Errorf("envelope: unknown scheme %q", meta.Scheme)
	}
	aad, scopeHash, err := scopeAAD(scope)

View on GitHub (pinned to 766dce6b13)

Solutions

1. Upgrade this binary to a version that understands the envelope scheme in the metadata
2. Investigate how ciphertext with an unrecognized scheme entered storage

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:111 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/b0b294f36d6aee2f. Report an issue: GitHub.