{"record":{"id":"0ac317af53b39f47","repo":"anomalyco/sst","slug":"errpassphraseinvalid","errorCode":"ErrPassphraseInvalid","errorMessage":"passphrase invalid","messagePattern":"passphrase invalid","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/stack.go","lineNumber":119,"sourceCode":"}\n\ntype StackCommandEvent struct {\n\tApp     string\n\tStage   string\n\tConfig  string\n\tCommand string\n\tVersion string\n}\n\ntype Error struct {\n\tMessage string   `json:\"message\"`\n\tURN     string   `json:\"urn\"`\n\tHelp    []string `json:\"help\"`\n}\n\nvar ErrStackRunFailed = fmt.Errorf(\"stack run had errors\")\nvar ErrStageNotFound = fmt.Errorf(\"stage not found\")\nvar ErrPassphraseInvalid = fmt.Errorf(\"passphrase invalid\")\nvar ErrProtectedStage = fmt.Errorf(\"cannot remove protected stage\")\nvar ErrProtectedDevStage = fmt.Errorf(\"cannot run sst dev on protected stage\")\nvar ErrPolicyViolation = fmt.Errorf(\"policy violations detected\")\nvar ErrPolicyConfigError = fmt.Errorf(\"policy configuration error\")\n\nfunc (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {\n\tvar resolvedPath string\n\tif filepath.IsAbs(policyPath) {\n\t\tresolvedPath = policyPath\n\t} else {\n\t\tresolvedPath = filepath.Join(p.PathRoot(), policyPath)\n\t}\n\n\tif _, err := os.Stat(resolvedPath); err != nil {\n\t\treturn \"\", fmt.Errorf(\"Policy pack not found in path: %v\", resolvedPath)\n\t}\n\n\treturn resolvedPath, nil","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/stack.go#L101-L137","documentation":"ErrPassphraseInvalid is returned by Project.Run when the Pulumi secrets passphrase fails to decrypt existing state secrets. Run converts the underlying Pulumi decryption failure into this sentinel (pkg/project/run.go:231,239) so callers can detect a wrong or missing PULUMI_CONFIG_PASSPHRASE.","triggerScenarios":"Running any command that must decrypt secrets in existing state (e.g. Run at pkg/project/run.go:124 getCompletedEvent or secret setup) with a PULUMI_CONFIG_PASSPHRASE that differs from the one used when the stack's secrets were encrypted.","commonSituations":"Missing or different PULUMI_CONFIG_PASSPHRASE env var in CI vs. local; a teammate each set their own passphrase; passphrase set after the stack was first deployed with a different one; secrets manager/passphrase provider misconfigured between environments.","solutions":["Set PULUMI_CONFIG_PASSPHRASE to the exact passphrase used when the stack was first deployed (check CI secrets config vs local env).","Ensure the env var is actually exported in the environment running sst (a missing var can surface as decryption failure).","If the original passphrase is lost, the encrypted secrets cannot be recovered — recreate the stack or replace encrypted secret values with a new passphrase.","Standardize passphrase delivery (e.g. shared secret manager) so all environments use the same value."],"exampleFix":"// before\ncmd.Env = os.Environ() // PULUMI_CONFIG_PASSPHRASE missing\n\n// after\nif os.Getenv(\"PULUMI_CONFIG_PASSPHRASE\") == \"\" {\n\tos.Setenv(\"PULUMI_CONFIG_PASSPHRASE\", os.Getenv(\"SST_PASSPHRASE_FROM_SECRET_MANAGER\"))\n}","handlingStrategy":"validation","validationCode":"if os.Getenv(\"PULUMI_CONFIG_PASSPHRASE\") == \"\" {\n\treturn fmt.Errorf(\"PULUMI_CONFIG_PASSPHRASE must be set to decrypt stack secrets\")\n}","typeGuard":null,"tryCatchPattern":"err := project.Run(ctx, input)\nif errors.Is(err, stack.ErrPassphraseInvalid) {\n\tlog.Error(\"secrets passphrase does not match the one used at first deploy; check PULUMI_CONFIG_PASSPHRASE\")\n\treturn err\n}","preventionTips":["Store the stack passphrase in a shared secret manager and inject it identically in all environments.","Verify PULUMI_CONFIG_PASSPHRASE is exported in CI before invoking sst.","Never set a new passphrase for an existing stack without re-encrypting its secrets.","Document which passphrase was used at first deploy per app/stage."],"tags":["secrets","passphrase","encryption","sentinel-error"],"backgroundTag":"passphrase-invalid","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}