JuliusBrussee/caveman · error

secretbox: %s is not valid base64

Error message

secretbox: %s is not valid base64

What it means

ResolveEnvironmentSecret found the ciphertext variable set, but its content is not valid base64, so the envelope bytes cannot even be obtained. The message names the offending variable; failure happens before any KMS or AES-GCM decryption is attempted.

Source

Thrown at shared/platform/secretbox/secretbox.go:178

}

// ResolveEnvironmentSecret loads a boot-time secret. In production plaintext
// environment variables are rejected: operators must provide a base64-encoded
// secretbox/KMS envelope in ciphertextEnv. Local development may continue using
// plaintextEnv. An entirely absent optional secret returns an empty string.
func ResolveEnvironmentSecret(plaintextEnv, ciphertextEnv string) (string, error) {
	plain := strings.TrimSpace(os.Getenv(plaintextEnv))
	encoded := strings.TrimSpace(os.Getenv(ciphertextEnv))
	production := runtimeenv.IsProduction()
	if production && plain != "" {
		return "", fmt.Errorf("secretbox: production refuses plaintext %s; use %s", plaintextEnv, ciphertextEnv)
	}
	if encoded == "" {
		return plain, nil
	}
	wrapped, err := base64.StdEncoding.DecodeString(encoded)
	if err != nil {
		return "", fmt.Errorf("secretbox: %s is not valid base64", ciphertextEnv)
	}
	decrypted, err := Decrypt(wrapped)
	if err != nil {
		return "", fmt.Errorf("secretbox: decrypt %s: %w", ciphertextEnv, err)
	}
	if len(decrypted) == 0 {
		return "", fmt.Errorf("secretbox: %s decrypted to an empty secret", ciphertextEnv)
	}
	return string(decrypted), nil
}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Re-encode the envelope with standard padded base64 and update the variable
2. Check for shell/manifest mangling: stripped padding, line breaks, or URL-safe alphabet used by mistake
3. Copy the base64 exactly from the sealing step — retyping introduces errors
4. Restart the service after fixing the variable

When it happens

Trigger: Thrown at shared/platform/secretbox/secretbox.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/be7901d14c8ab666. Report an issue: GitHub.