{"record":{"id":"2127446716f9fc9f","repo":"benbjohnson/litestream","slug":"cannot-read-sse-customer-key-path-q-w","errorCode":null,"errorMessage":"cannot read sse-customer-key-path %q: %w","messagePattern":"cannot read sse-customer-key-path %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/litestream/main.go","lineNumber":1702,"sourceCode":"\t\tclient.SSECustomerAlgorithm = c.SSECustomerAlgorithm\n\t\tif client.SSECustomerAlgorithm == \"\" {\n\t\t\tclient.SSECustomerAlgorithm = \"AES256\"\n\t\t}\n\n\t\t// Read key from file if path is specified, otherwise use direct value.\n\t\tif c.SSECustomerKeyPath != \"\" {\n\t\t\tkeyPath := c.SSECustomerKeyPath\n\t\t\t// Expand ~ to home directory\n\t\t\tif strings.HasPrefix(keyPath, \"~\") {\n\t\t\t\thome, err := os.UserHomeDir()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"cannot expand home directory for sse-customer-key-path: %w\", err)\n\t\t\t\t}\n\t\t\t\tkeyPath = home + keyPath[1:]\n\t\t\t}\n\t\t\tkeyData, err := os.ReadFile(keyPath)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot read sse-customer-key-path %q: %w\", c.SSECustomerKeyPath, err)\n\t\t\t}\n\t\t\tclient.SSECustomerKey = strings.TrimSpace(string(keyData))\n\t\t} else {\n\t\t\tclient.SSECustomerKey = c.SSECustomerKey\n\t\t}\n\t}\n\n\t// Apply SSE-KMS configuration if specified.\n\tif c.SSEKMSKeyID != \"\" {\n\t\tclient.SSEKMSKeyID = c.SSEKMSKeyID\n\t}\n\n\treturn client, nil\n}\n\n// newGSReplicaClientFromConfig returns a new instance of gs.ReplicaClient built from config.\nfunc newGSReplicaClientFromConfig(c *ReplicaConfig, _ *litestream.Replica) (_ *gs.ReplicaClient, err error) {\n\t// Ensure URL & constituent parts are not both specified.","sourceCodeStart":1684,"sourceCodeEnd":1720,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/cmd/litestream/main.go#L1684-L1720","documentation":"Wraps os.ReadFile failure while loading the SSE-C customer key from the file named by s3 sse-customer-key-path. Fires when the file is missing, unreadable, or permission-denied; the key material cannot be applied to the S3 client.","triggerScenarios":"Thrown at cmd/litestream/main.go:1702 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the path exists and is readable by the litestream process","Check for typos or wrong working directory; use an absolute path","Alternatively pass the base64 key directly via sse-customer-key"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}