JuliusBrussee/caveman · error

kms: encode envelope: %w

Error message

kms: encode envelope: %w

What it means

Client.Encrypt wraps the json.Marshal failure while serializing the KMS Envelope (provider, region, key_id, ciphertext) after a successful encrypt call. Marshal of these four plain string fields essentially never fails — this is a defensive wrap for an unexpected marshaling error; the at-fault input would be a malformed value in the client's provider/region/keyID/ciphertext strings.

Source

Thrown at shared/platform/kms/kms.go:196

	}
	if len(plaintext) > maxPlaintextBytes {
		return nil, fmt.Errorf("kms: plaintext exceeds %d bytes", maxPlaintextBytes)
	}
	var response struct {
		KeyID      string `json:"key_id"`
		Ciphertext string `json:"ciphertext"`
	}
	if err := c.call(ctx, c.region, c.keyID, "encrypt", map[string]string{
		"plaintext": base64.StdEncoding.EncodeToString(plaintext),
	}, &response); err != nil {
		return nil, err
	}
	if response.KeyID != c.keyID || strings.TrimSpace(response.Ciphertext) == "" {
		return nil, errors.New("kms: invalid encrypt response")
	}
	envelope, err := json.Marshal(Envelope{Provider: c.provider, Region: c.region, KeyID: response.KeyID, Ciphertext: response.Ciphertext})
	if err != nil {
		return nil, fmt.Errorf("kms: encode envelope: %w", err)
	}
	return append([]byte(prefix), envelope...), nil
}

// Decrypt delegates to configured environment client.
func Decrypt(ctx context.Context, blob []byte) ([]byte, error) {
	client, err := FromEnvironment()
	if err != nil {
		return nil, err
	}
	return client.Decrypt(ctx, blob)
}

// DecryptPayload unwraps an artifact data key with the dedicated payload KEK,
// while allowing the explicitly configured legacy secrets key during cutover.
func DecryptPayload(ctx context.Context, blob []byte) ([]byte, error) {
	client, err := FromPayloadEnvironment()
	if err != nil {

View on GitHub (pinned to 766dce6b13)

Solutions

1. Retry the operation; this error is unexpected for string-only envelopes
2. Inspect the wrapped error to find which envelope field caused the marshal failure
3. Report as a bug if reproducible — valid provider/region/key/ciphertext strings always marshal

When it happens

Trigger: Thrown at shared/platform/kms/kms.go:196 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/a77897a4f771e3be. Report an issue: GitHub.