JuliusBrussee/caveman · error

kms: envelope ciphertext is empty

Error message

kms: envelope ciphertext is empty

What it means

Error "kms: envelope ciphertext is empty" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/kms/kms.go:246

	}
	var envelope Envelope
	if err := json.Unmarshal(blob[len(prefix):], &envelope); err != nil {
		return nil, fmt.Errorf("kms: decode envelope: %w", err)
	}
	if envelope.Provider != c.provider {
		return nil, errors.New("kms: envelope provider does not match configured provider")
	}
	if err := validateLocation(envelope.Region, envelope.KeyID); err != nil {
		return nil, err
	}
	if envelope.Region != c.region {
		return nil, errors.New("kms: envelope region is not approved")
	}
	if _, ok := c.decryptKeyIDs[envelope.KeyID]; !ok {
		return nil, errors.New("kms: envelope key ID is not approved")
	}
	if strings.TrimSpace(envelope.Ciphertext) == "" {
		return nil, errors.New("kms: envelope ciphertext is empty")
	}
	var response struct {
		KeyID     string `json:"key_id"`
		Plaintext string `json:"plaintext"`
	}
	if err := c.call(ctx, envelope.Region, envelope.KeyID, "decrypt", map[string]string{
		"ciphertext": envelope.Ciphertext,
	}, &response); err != nil {
		return nil, err
	}
	if response.KeyID != envelope.KeyID || response.Plaintext == "" {
		return nil, errors.New("kms: invalid decrypt response")
	}
	plaintext, err := base64.StdEncoding.DecodeString(response.Plaintext)
	if err != nil {
		return nil, errors.New("kms: decrypt response plaintext is not valid base64")
	}
	if len(plaintext) == 0 || len(plaintext) > maxPlaintextBytes {

View on GitHub (pinned to 27d5a3981a)

Solutions

1. The envelope ciphertext is empty; provide a valid envelope.

When it happens

Trigger: Thrown at shared/platform/kms/kms.go:246 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/93f90e5d4d359cb8. Report an issue: GitHub.