{"record":{"id":"1bff7bc693d4c2da","repo":"juicedata/juicefs","slug":"decode-key-s","errorCode":null,"errorMessage":"decode key: %s","messagePattern":"decode key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":282,"sourceCode":"\tif !f.KeyEncrypted {\n\t\treturn nil\n\t}\n\n\tci, err := newCipher(f.EncryptAlgo, f.UUID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdecrypt := func(k *string) {\n\t\tif *k == \"\" {\n\t\t\treturn\n\t\t}\n\t\tif *k == \"removed\" {\n\t\t\terr = fmt.Errorf(\"secret was removed; please correct it with `config` command\")\n\t\t\treturn\n\t\t}\n\t\tbuf, e := base64.StdEncoding.DecodeString(*k)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"decode key: %s\", e)\n\t\t\treturn\n\t\t}\n\t\tplaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"open cipher: %s\", e)\n\t\t\treturn\n\t\t}\n\t\t*k = string(plaintext)\n\t}\n\n\tdecrypt(&f.EncryptKey)\n\tdecrypt(&f.SecretKey)\n\tdecrypt(&f.SessionToken)\n\tf.KeyEncrypted = false\n\treturn err\n}\n","sourceCodeStart":264,"sourceCodeEnd":299,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L264-L299","documentation":"Returned by Format.Decrypt() when base64.StdEncoding.DecodeString fails on an encrypted secret field. The stored value is expected to be base64(nonce || ciphertext); a value that is not valid base64 (or has been mangled) triggers this error.","triggerScenarios":"Decrypting a format whose EncryptKey/secret field contains characters outside the base64 alphabet, whitespace, quotes, or has been truncated by manual editing or copy/paste.","commonSituations":"Hand-editing a metadata dump, copying the key with extra characters, restoring backups through a tool that escapes the value, or storing the secret in a JSON/YAML layer that altered it.","solutions":["Re-encrypt and store the secret correctly with `juicefs config <META-URL> --encrypt-key <key>`","Check the stored value is pure base64 (no whitespace, newlines, or quoting artifacts) and restore it","If the value came from a dump/backup, reload it with the official `juicefs load` command instead of manual edits"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := base64.StdEncoding.DecodeString(format.EncryptKey); err != nil && format.EncryptKey != \"\" { return fmt.Errorf(\"encrypt key is not valid base64: %w\", err) }","typeGuard":"func isBase64(s string) bool { _, err := base64.StdEncoding.DecodeString(s); return err == nil }","tryCatchPattern":"if err := format.Decrypt(); err != nil { if strings.Contains(err.Error(), \"decode key\") { /* re-store the secret via juicefs config */ } }","preventionTips":["Copy secrets without shell quoting/newline mangling","Use `juicefs config` rather than editing metadata by hand","Trim whitespace before storing keys"],"tags":["base64","decoding","config","encryption"],"backgroundTag":"invalid-argument-format","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}