JuliusBrussee/caveman · error

kms: plaintext is empty

Error message

kms: plaintext is empty

What it means

Error "kms: plaintext is empty" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/kms/kms.go:177

	if err != nil {
		return nil, err
	}
	return client.Encrypt(ctx, plaintext)
}

// EncryptPayload wraps an artifact data key with the dedicated payload KEK.
func EncryptPayload(ctx context.Context, plaintext []byte) ([]byte, error) {
	client, err := FromPayloadEnvironment()
	if err != nil {
		return nil, err
	}
	return client.Encrypt(ctx, plaintext)
}

// Encrypt delegates encryption to key manager.
func (c *Client) Encrypt(ctx context.Context, plaintext []byte) ([]byte, error) {
	if len(plaintext) == 0 {
		return nil, errors.New("kms: plaintext is empty")
	}
	if len(plaintext) > maxPlaintextBytes {
		return nil, fmt.Errorf("kms: plaintext exceeds %d bytes", maxPlaintextBytes)
	}
	var response struct {
		KeyID      string `json:"key_id"`
		Ciphertext string `json:"ciphertext"`
	}
	if err := c.call(ctx, c.region, c.keyID, "encrypt", map[string]string{
		"plaintext": base64.StdEncoding.EncodeToString(plaintext),
	}, &response); err != nil {
		return nil, err
	}
	if response.KeyID != c.keyID || strings.TrimSpace(response.Ciphertext) == "" {
		return nil, errors.New("kms: invalid encrypt response")
	}
	envelope, err := json.Marshal(Envelope{Provider: c.provider, Region: c.region, KeyID: response.KeyID, Ciphertext: response.Ciphertext})
	if err != nil {

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Provide non-empty plaintext to encrypt.

When it happens

Trigger: Thrown at shared/platform/kms/kms.go:177 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/4e5a367acd3a63c2. Report an issue: GitHub.