JuliusBrussee/caveman · error

kms: unknown envelope format

Error message

kms: unknown envelope format

What it means

Error "kms: unknown envelope format" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/kms/kms.go:224

	}
	return client.Decrypt(ctx, blob)
}

// DecryptPayload unwraps an artifact data key with the dedicated payload KEK,
// while allowing the explicitly configured legacy secrets key during cutover.
func DecryptPayload(ctx context.Context, blob []byte) ([]byte, error) {
	client, err := FromPayloadEnvironment()
	if err != nil {
		return nil, err
	}
	return client.Decrypt(ctx, blob)
}

// Decrypt unwraps versioned KMS envelope. Metadata can choose only validated
// key identity under configured provider; it can never choose host or token.
func (c *Client) Decrypt(ctx context.Context, blob []byte) ([]byte, error) {
	if !IsEnvelope(blob) {
		return nil, errors.New("kms: unknown envelope format")
	}
	if len(blob) > maxEnvelopeBytes {
		return nil, errors.New("kms: envelope exceeds size limit")
	}
	var envelope Envelope
	if err := json.Unmarshal(blob[len(prefix):], &envelope); err != nil {
		return nil, fmt.Errorf("kms: decode envelope: %w", err)
	}
	if envelope.Provider != c.provider {
		return nil, errors.New("kms: envelope provider does not match configured provider")
	}
	if err := validateLocation(envelope.Region, envelope.KeyID); err != nil {
		return nil, err
	}
	if envelope.Region != c.region {
		return nil, errors.New("kms: envelope region is not approved")
	}
	if _, ok := c.decryptKeyIDs[envelope.KeyID]; !ok {

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Use a known KMS envelope format.

When it happens

Trigger: Thrown at shared/platform/kms/kms.go:224 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/d8f38eda718cf729. Report an issue: GitHub.