{"record":{"id":"076d46a87e74ce8d","repo":"argoproj/argo-workflows","slug":"failed-to-marshal-kms-encryption-context-w","errorCode":null,"errorMessage":"failed to marshal KMS encryption context: %w","messagePattern":"failed to marshal KMS encryption context: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/s3/s3.go","lineNumber":953,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\treturn kms, nil\n\t}\n\n\treturn encrypt.NewSSE(), nil\n}\n\n// parseKMSEncCntx validates if kmsEncCntx is a valid JSON\nfunc parseKMSEncCntx(kmsEncCntx string) (*string, error) {\n\tif kmsEncCntx == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tjsonKMSEncryptionContext, err := json.Marshal(json.RawMessage(kmsEncCntx))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to marshal KMS encryption context: %w\", err)\n\t}\n\n\tparsedKMSEncryptionContext := base64.StdEncoding.EncodeToString(jsonKMSEncryptionContext)\n\n\treturn &parsedKMSEncryptionContext, nil\n}\n","sourceCodeStart":935,"sourceCodeEnd":960,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/s3/s3.go#L935-L960","documentation":"parseKMSEncCntx marshals the kmsEncryptionContext through json.RawMessage to validate and normalize it; if the raw string isn't valid JSON, json.Marshal fails and this wrapped error is returned (nil, nil semantics rely on valid JSON). It is the upstream source of error 536's wrapper.","triggerScenarios":"kmsEncryptionContext is a non-empty string that json.Marshal(json.RawMessage(...)) rejects — malformed JSON such as missing quotes, invalid escape, or trailing characters.","commonSituations":"Templated values producing '{{...}}' leftovers; secrets injected with stray whitespace/newlines; hand-written context with unescaped quotes.","solutions":["Fix the kmsEncryptionContext string to be valid JSON, e.g. '{\"k\":\"v\"}'","Run it through jq/JSON linter to verify before applying config","Check for template placeholders that were not substituted","Omit the field if no encryption context is required"],"exampleFix":"// before\nkmsEncryptionContext: '{k:\"v\"}'\n// after\nkmsEncryptionContext: '{\"k\":\"v\"}'","handlingStrategy":"validation","validationCode":"if ctxStr := e.KmsEncryptionContext; ctxStr != \"\" {\n  if json.Valid([]byte(ctxStr)) == false { return errors.New(\"kmsEncryptionContext must be valid JSON\") }\n}","typeGuard":"func kmsContextValid(s string) bool { return s == \"\" || json.Valid([]byte(s)) }","tryCatchPattern":null,"preventionTips":["Lint kmsEncryptionContext with json.Valid in CI","Avoid templating JSON fragments; pass whole JSON strings","Check for unresolved '{{ }}' placeholders before deploy"],"tags":["s3","encryption","kms","json"],"backgroundTag":"invalid-kms-encryption-context","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}