What causes "kms: plaintext is empty" in JuliusBrussee/caveman?

Check len(plaintext) > 0 before calling Encrypt and return a domain-specific empty-input error otherwise

kms: plaintext is empty

Error message

kms: plaintext is empty

What it means

Client.Encrypt rejects an empty plaintext slice before any network call, because the Scaleway KMS API has no meaningful zero-byte encryption and the library guards its size envelope invariants. The caller must supply at least one byte.

Solutions

Check len(plaintext) > 0 before calling Encrypt and return a domain-specific empty-input error otherwise
Handle the empty-input case explicitly at a higher level (skip encryption, store empty marker)
If empty values are legitimate, encode them as a sentinel (e.g. encrypt a versioned wrapper) rather than raw zero bytes

Example fix

// before
out, err := client.Encrypt(ctx, []byte(s)) // panics-free but errors when s==""
// after
if s == "" { return nil, errors.New("nothing to encrypt") }
out, err := client.Encrypt(ctx, []byte(s))

Defensive patterns

Strategy: validation

Validate before calling

if len(plaintext) == 0 {
	return errors.New("nothing to encrypt")
}

Prevention

Check length of byte payloads before encryption calls
Handle empty inputs (empty files/fields) explicitly in business logic
Convert strings to bytes only after confirming non-empty

When it happens

Trigger: Calling Encrypt(ctx, nil) or Encrypt(ctx, []byte{}) — e.g. encrypting an empty file, an empty string converted with []byte(""), or data that was trimmed to nothing upstream.

Common situations: Empty uploads or fields processed by a pipeline that does not check length, refactoring that changed a value from a string to bytes without guarding empty, test scaffolding passing zero values.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/4e5a367acd3a63c2. Report an issue: GitHub.

Appendix: source

Thrown at shared/platform/kms/kms.go:177

	if err != nil {
		return nil, err
	}
	return client.Encrypt(ctx, plaintext)
}

// EncryptPayload wraps an artifact data key with the dedicated payload KEK.
func EncryptPayload(ctx context.Context, plaintext []byte) ([]byte, error) {
	client, err := FromPayloadEnvironment()
	if err != nil {
		return nil, err
	}
	return client.Encrypt(ctx, plaintext)
}

// Encrypt delegates encryption to key manager.
func (c *Client) Encrypt(ctx context.Context, plaintext []byte) ([]byte, error) {
	if len(plaintext) == 0 {
		return nil, errors.New("kms: plaintext is empty")
	}
	if len(plaintext) > maxPlaintextBytes {
		return nil, fmt.Errorf("kms: plaintext exceeds %d bytes", maxPlaintextBytes)
	}
	var response struct {
		KeyID      string `json:"key_id"`
		Ciphertext string `json:"ciphertext"`
	}
	if err := c.call(ctx, c.region, c.keyID, "encrypt", map[string]string{
		"plaintext": base64.StdEncoding.EncodeToString(plaintext),
	}, &response); err != nil {
		return nil, err
	}
	if response.KeyID != c.keyID || strings.TrimSpace(response.Ciphertext) == "" {
		return nil, errors.New("kms: invalid encrypt response")
	}
	envelope, err := json.Marshal(Envelope{Provider: c.provider, Region: c.region, KeyID: response.KeyID, Ciphertext: response.Ciphertext})
	if err != nil {

View on GitHub (pinned to 3ee70a1026)