What causes "kms: probe encrypt: %w" in JuliusBrussee/caveman?

Unwrap the chained error (%w) to see the root cause from Encrypt/call.

kms: probe encrypt

Error message

kms: probe encrypt: %w

What it means

Probe performs a live Encrypt of random bytes to verify key access; any Encrypt failure is re-wrapped as "kms: probe encrypt: %w". This surfaces the underlying cause (size guard, HTTP failure, invalid API response, or envelope encoding) while making clear it happened during the probe round trip, not on tenant data.

Solutions

Unwrap the chained error (%w) to see the root cause from Encrypt/call.
Verify the API token is valid and not expired; check key existence and IAM permissions in the target region.
Confirm network egress to the Scaleway Key Manager endpoint and DNS resolution.
Run New with the correct region/keyID and re-Probe after fixing credentials or connectivity.

Example fix

// before
if err := client.Probe(ctx); err != nil { log.Fatal(err) } // kms: probe encrypt: kms: ...
// after
if err := client.Probe(ctx); err != nil {
    var root = err
    for errors.Unwrap(root) != nil { root = errors.Unwrap(root) }
    log.Fatalf("probe failed (root cause: %v)", root)
}

Defensive patterns

Strategy: try-catch

Validate before calling

if token == "" {
    return errors.New("Scaleway API token missing; set x-auth-token credential")
}
if _, err := url.Parse(apiBaseURL + "/key-manager"); err != nil {
    return fmt.Errorf("bad KMS endpoint: %v", err)
}

Try / catch

if err := client.Probe(ctx); err != nil {
    var apiErr *kms.APIError // or inspect the unwrapped chain
    if errors.As(err, &apiErr) {
        return fmt.Errorf("key manager rejected probe (status %d): %w", apiErr.Status, err)
    }
    return err
}

Prevention

Call Probe at startup to fail fast on bad credentials or network.
Rotate tokens before expiry and store them in a secret manager.
Unwrap %w chains to find the root Encrypt failure.
Monitor egress/DNS to the Key Manager endpoint in restricted networks.

When it happens

Trigger: Calling Probe when the underlying Encrypt fails: empty/oversized plaintext (not applicable to the fixed 32-byte probe), Scaleway API returning non-200, invalid or missing key_id/ciphertext in the response, or network/timeout errors inside client.call.

Common situations: Expired or missing x-auth-token; wrong region/keyID in config; key deleted or access revoked; egress blocked from the host to the Key Manager endpoint; API version drift.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/dd45c364a33ffdf3. Report an issue: GitHub.

Appendix: source

Thrown at shared/platform/kms/kms.go:324

	if !runtimeenv.IsProduction() {
		return nil
	}
	client, err := FromPayloadEnvironment()
	if err != nil {
		return err
	}
	return client.Probe(ctx)
}

// Probe verifies live key access without persisting tenant data.
func (c *Client) Probe(ctx context.Context) error {
	plaintext := make([]byte, 32)
	if _, err := rand.Read(plaintext); err != nil {
		return fmt.Errorf("kms: generate probe: %w", err)
	}
	envelope, err := c.Encrypt(ctx, plaintext)
	if err != nil {
		return fmt.Errorf("kms: probe encrypt: %w", err)
	}
	decrypted, err := c.Decrypt(ctx, envelope)
	if err != nil {
		return fmt.Errorf("kms: probe decrypt: %w", err)
	}
	if !bytes.Equal(decrypted, plaintext) {
		return errors.New("kms: probe plaintext mismatch")
	}
	return nil
}

func validateLocation(region, keyID string) error {
	if !regionPattern.MatchString(region) {
		return errors.New("kms: invalid Scaleway region")
	}
	if !keyIDPattern.MatchString(keyID) {
		return errors.New("kms: invalid Scaleway key ID")
	}

View on GitHub (pinned to 3ee70a1026)