{"record":{"id":"1a3ba0272d8f5a24","repo":"nikivdev/code","slug":"invalid-sealer-secret-prefix","errorCode":null,"errorMessage":"invalid sealer secret prefix","messagePattern":"invalid sealer secret prefix","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sealer_crypto.rs","lineNumber":24,"sourceCode":"};\nuse rand::{TryRng, rngs::SysRng};\nuse x25519_dalek::{PublicKey, StaticSecret};\n\nconst SECRET_PREFIX: &str = \"sealerSecret_z\";\nconst ID_PREFIX: &str = \"sealer_z\";\n\npub fn new_x25519_private_key() -> Vec<u8> {\n    let mut bytes = [0u8; 32];\n    SysRng\n        .try_fill_bytes(&mut bytes)\n        .expect(\"system RNG should provide x25519 key material\");\n    bytes.to_vec()\n}\n\npub fn get_sealer_id(secret: &str) -> Result<String> {\n    let secret_raw = secret\n        .strip_prefix(SECRET_PREFIX)\n        .ok_or_else(|| anyhow::anyhow!(\"invalid sealer secret prefix\"))?;\n    let private_bytes = bs58::decode(secret_raw)\n        .into_vec()\n        .map_err(|e| anyhow::anyhow!(\"invalid base58 sealer secret: {e}\"))?;\n    let bytes: [u8; 32] = private_bytes\n        .as_slice()\n        .try_into()\n        .map_err(|_| anyhow::anyhow!(\"invalid sealer secret length\"))?;\n\n    let public = PublicKey::from(&StaticSecret::from(bytes)).to_bytes();\n    Ok(format!(\n        \"{}{}\",\n        ID_PREFIX,\n        bs58::encode(public).into_string()\n    ))\n}\n\npub fn seal(\n    message: &[u8],","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/sealer_crypto.rs#L6-L42","documentation":"get_sealer_id parses a sealer secret string that must begin with the literal prefix \"sealerSecret_z\" before base58-decoding the key material. If the input lacks that prefix the strip_prefix fails and this error is thrown. It almost always means the wrong kind of string (an ID, a raw key, or a truncated value) was passed instead of a sealer secret.","triggerScenarios":"Calling get_sealer_id (directly or via load_env_sealer_identity, create_env_sealer_identity, load_sealer_identity, create_sealer_identity) with a string not starting with \"sealerSecret_z\" — e.g. a sealer id (\"sealer_z...\"), a raw base58 key, or an empty value.","commonSituations":"Setting the env var to a sealer ID instead of the secret, hand-copying the value and dropping the prefix, or an unset/empty env var defaulting to a placeholder string.","solutions":["Pass the full secret string including the \"sealerSecret_z\" prefix.","If you have the raw 32-byte key material, re-encode it as \"sealerSecret_z\" + base58(bytes) before use.","Check the env var / config source: make sure SEALER-style secret vars are not confused with id vars.","Regenerate the identity with create_sealer_identity if the original secret was lost or malformed."],"exampleFix":"// before\nlet id = get_sealer_id(\"5Kd3NBoAd2...\")?; // raw base58, no prefix\n// after\nlet id = get_sealer_id(\"sealerSecret_z5Kd3NBoAd2...\")?;","handlingStrategy":"validation","validationCode":"fn is_valid_sealer_secret_format(s: &str) -> bool {\n    s.starts_with(\"sealerSecret_z\") && s.len() > \"sealerSecret_z\".len()\n}","typeGuard":"fn is_sealer_secret(s: &str) -> bool {\n    s.starts_with(\"sealerSecret_z\")\n}\nfn is_sealer_id(s: &str) -> bool {\n    s.starts_with(\"sealer_z\")\n}","tryCatchPattern":"match get_sealer_id(secret) {\n    Ok(id) => id,\n    Err(e) if e.to_string().contains(\"invalid sealer secret prefix\") => {\n        eprintln!(\"SEALER secret must start with 'sealerSecret_z'; got a different value\");\n        std::process::exit(2);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Store secrets with their prefix intact; never strip \"sealerSecret_z\" manually.","Keep id and secret in clearly named, separate env vars (SEALER_ID vs SEALER_SECRET).","Add a startup format check before any crypto call.","Generate identities only via create_sealer_identity so the format is always correct."],"tags":["crypto","parsing","prefix","base58"],"backgroundTag":"invalid-key-prefix","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}