JuliusBrussee/caveman · error

secretbox: decrypt %s: %w

Error message

secretbox: decrypt %s: %w

What it means

ResolveEnvironmentSecret base64-decoded the envelope but the subsequent Decrypt (KMS or local AES-GCM) failed. The wrapped error says which layer failed: KMS availability/permissions, or GCM authentication (wrong key/tampered data). The message names the ciphertext variable for easy tracing.

Source

Thrown at shared/platform/secretbox/secretbox.go:182

// secretbox/KMS envelope in ciphertextEnv. Local development may continue using
// plaintextEnv. An entirely absent optional secret returns an empty string.
func ResolveEnvironmentSecret(plaintextEnv, ciphertextEnv string) (string, error) {
	plain := strings.TrimSpace(os.Getenv(plaintextEnv))
	encoded := strings.TrimSpace(os.Getenv(ciphertextEnv))
	production := runtimeenv.IsProduction()
	if production && plain != "" {
		return "", fmt.Errorf("secretbox: production refuses plaintext %s; use %s", plaintextEnv, ciphertextEnv)
	}
	if encoded == "" {
		return plain, nil
	}
	wrapped, err := base64.StdEncoding.DecodeString(encoded)
	if err != nil {
		return "", fmt.Errorf("secretbox: %s is not valid base64", ciphertextEnv)
	}
	decrypted, err := Decrypt(wrapped)
	if err != nil {
		return "", fmt.Errorf("secretbox: decrypt %s: %w", ciphertextEnv, err)
	}
	if len(decrypted) == 0 {
		return "", fmt.Errorf("secretbox: %s decrypted to an empty secret", ciphertextEnv)
	}
	return string(decrypted), nil
}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Read the wrapped error: retry KMS transport failures, treat GCM auth failures as key mismatch or tampering
2. Confirm the envelope was sealed with the key/KMS key the service currently uses
3. Re-seal the secret with the correct key and update the ciphertext variable if the key changed
4. For persistent failures, rotate the secret at its source rather than weakening validation

When it happens

Trigger: Thrown at shared/platform/secretbox/secretbox.go:182 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/6ca23ca086bdc11b. Report an issue: GitHub.