{"record":{"id":"0ad7f2d7995c7193","repo":"semaphoreui/semaphore","slug":"err-0ad7f2","errorCode":null,"errorMessage":"err","messagePattern":"err","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/cmd/vault_rekey.go","lineNumber":54,"sourceCode":"\tLong: \"Re-encrypt all locally stored secrets (access keys and the JWT signing key)\\n\" +\n\t\t\"under the active key, stamping its key id into each value.\\n\\n\" +\n\t\t\"Zero-downtime rotation:\\n\" +\n\t\t\"  1. Add a new key to the keyset (a file in keys_folder, or a keys: entry) and\\n\" +\n\t\t\"     point active.access_key (or access_key_file) at it; reload applies it\\n\" +\n\t\t\"     within keys_poll_interval, or send `kill -HUP <pid>`.\\n\" +\n\t\t\"  2. Run `vault rekey` to re-encrypt existing data to the new key.\\n\" +\n\t\t\"  3. Run `vault check`; once the old key shows 0 rows it is safe to remove.\\n\\n\" +\n\t\t\"Legacy: `vault rekey --old-key <old-key>` decrypts un-prefixed data with an\\n\" +\n\t\t\"explicit old key.\",\n\tRun: func(cmd *cobra.Command, args []string) {\n\t\tstore := createStore(\"\")\n\t\tdefer store.Close()\n\n\t\tencryptionService := server.NewAccessKeyEncryptionService(store, store, store, store)\n\n\t\tif targetVaultArgs.rollbackFile != \"\" {\n\t\t\tif err := rollbackAccessKeys(store, encryptionService, targetVaultArgs.rollbackFile); err != nil {\n\t\t\t\tpanic(err)\n\t\t\t}\n\t\t\tfmt.Println(\"Rollback complete.\")\n\t\t\treturn\n\t\t}\n\n\t\tif targetVaultArgs.backupFile != \"\" {\n\t\t\tif err := backupAccessKeys(store, targetVaultArgs.backupFile); err != nil {\n\t\t\t\tpanic(err)\n\t\t\t}\n\t\t\tfmt.Printf(\"Backup written to %s\\n\", targetVaultArgs.backupFile)\n\t\t}\n\n\t\tif err := encryptionService.RekeyAccessKeys(targetVaultArgs.oldKey); err != nil {\n\t\t\tpanic(err)\n\t\t}\n\n\t\tif err := util.RekeyJWTSigningKey(store, targetVaultArgs.oldKey); err != nil {\n\t\t\tpanic(err)","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/cli/cmd/vault_rekey.go#L36-L72","documentation":"In `vault rekey --rollback <file>`, the panic fires when `rollbackAccessKeys` fails. Rollback opens the backup file, parses each JSON line, decrypts the current secret to populate validation fields, and writes the backed-up ciphertext back via `store.UpdateAccessKey`. Any of open/parse/decrypt/update failures abort with a panic.","triggerScenarios":"Running `semaphore vault rekey --rollback backup.jsonl` when the backup file does not exist or is unreadable, a line is not valid JSON, a stored key cannot be decrypted with the current keyset, or the UPDATE fails in the database.","commonSituations":"Path typo or backup written to another host; partially truncated/corrupted backup file; keyset changed after rekey so current ciphertext cannot be deserialized; DB write permission issues.","solutions":["Verify the --rollback path exists and is the complete backup file produced by --backup.","Fix the keyset so the current (rekeyed) ciphertexts can be decrypted — rollback must decrypt them before writing back old values.","Inspect the wrapped error: json unmarshal errors point at a specific corrupt line; DB errors point at store issues.","If rollback is impossible, re-run rekey with the correct keys instead of rolling back."],"exampleFix":"// before\nif err := rollbackAccessKeys(store, encryptionService, targetVaultArgs.rollbackFile); err != nil {\n    panic(err)\n}\n// after\nif err := rollbackAccessKeys(store, encryptionService, targetVaultArgs.rollbackFile); err != nil {\n    fmt.Fprintf(os.Stderr, \"rollback failed: %v\\n\", err)\n    os.Exit(1)\n}","handlingStrategy":"validation","validationCode":"if fi, err := os.Stat(rollbackFile); err != nil || fi.IsDir() {\n    fmt.Fprintf(os.Stderr, \"rollback file %s not readable\\n\", rollbackFile)\n    os.Exit(1)\n}","typeGuard":null,"tryCatchPattern":"if err := rollbackAccessKeys(store, svc, path); err != nil {\n    fmt.Fprintf(os.Stderr, \"rollback failed: %v\\n\", err)\n    os.Exit(1)\n}","preventionTips":["Always create rollback backups with --backup and verify the file is complete (valid JSON lines) before rekeying.","Keep the backup file on the same host and a persistent path.","Do not change the keyset between rekey and rollback."],"tags":["cli","vault","rekey","rollback","panic"],"backgroundTag":"file-not-found","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}