{"record":{"id":"26b54e8fba0f86c2","repo":"juicedata/juicefs","slug":"new-gcm-s","errorCode":null,"errorMessage":"new GCM: %s","messagePattern":"new GCM: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":227,"sourceCode":"\tcase object.SM4GCM:\n\t\tblock, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\tdefault:\n\t\thashKey := md5.Sum([]byte(key))\n\t\tblock, err := aes.NewCipher(hashKey[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\t}\n}\n\nfunc (f *Format) Encrypt() error {\n\tif f.KeyEncrypted || f.SecretKey == \"\" && f.EncryptKey == \"\" && f.SessionToken == \"\" {\n\t\treturn nil\n\t}\n\tci, err := newCipher(f.EncryptAlgo, f.UUID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tencrypt := func(k *string) {\n\t\tif *k == \"\" {\n\t\t\treturn\n\t\t}\n\t\tnonce := make([]byte, ci.NonceSize())","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L209-L245","documentation":"Returned by newCipher in pkg/meta/config.go when cipher.NewGCM fails on the AES block built from the MD5-hashed key. As with the other newCipher errors, this is expected to be unreachable with a valid AES block and indicates an unexpected crypto-layer failure. Raised through Format.Encrypt/Decrypt.","triggerScenarios":"Format.Encrypt()/Format.Decrypt() on the default path where cipher.NewGCM(aesBlock) returns an error.","commonSituations":"Only with broken or modified Go crypto runtimes; not a user-fixable configuration issue.","solutions":["Rebuild JuiceFS with a standard Go toolchain","Check the wrapped error message for the concrete GCM failure","Use `juicefs config` to change EncryptAlgorithm and isolate the failing code path"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := format.Encrypt(); err != nil { if strings.Contains(err.Error(), \"new GCM\") { /* treat as environment/crypto-stack problem, not config */ } }","preventionTips":["Avoid patched crypto packages","Add encryption round-trip tests to your deployment checks"],"tags":["crypto","gcm","aes","config"],"backgroundTag":"module-init-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}