{"record":{"id":"3b8759627f4e7aae","repo":"juicedata/juicefs","slug":"format-decrypt-s","errorCode":null,"errorMessage":"format decrypt: %s","messagePattern":"format decrypt: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/format.go","lineNumber":238,"sourceCode":"\tvar bits uint\n\tfor s > 1 {\n\t\tbits++\n\t\ts >>= 1\n\t}\n\ts = s << bits\n\tif s < min {\n\t\tlogger.Warnf(\"block size is too small: %s, use %s instead\", humanize.IBytes(s), humanize.IBytes(min))\n\t\ts = min\n\t} else if s > max {\n\t\tlogger.Warnf(\"block size is too large: %s, use %s instead\", humanize.IBytes(s), humanize.IBytes(max))\n\t\ts = max\n\t}\n\treturn s\n}\n\nfunc createStorage(format meta.Format) (object.ObjectStorage, error) {\n\tif err := format.Decrypt(); err != nil {\n\t\treturn nil, fmt.Errorf(\"format decrypt: %s\", err)\n\t}\n\tobject.UserAgent = \"JuiceFS-\" + version.Version()\n\tvar blob object.ObjectStorage\n\tvar err error\n\tif u, err := url.Parse(format.Bucket); err == nil {\n\t\tvalues := u.Query()\n\t\tif values.Get(\"tls-insecure-skip-verify\") != \"\" {\n\t\t\tvar tlsSkipVerify bool\n\t\t\tif tlsSkipVerify, err = strconv.ParseBool(values.Get(\"tls-insecure-skip-verify\")); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = tlsSkipVerify\n\t\t\tvalues.Del(\"tls-insecure-skip-verify\")\n\t\t\tu.RawQuery = values.Encode()\n\t\t\tformat.Bucket = u.String()\n\t\t}\n\n\t\t// Configure client TLS when params are provided","sourceCodeStart":220,"sourceCodeEnd":256,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L220-L256","documentation":"createStorage requires the formatted volume's encrypted fields (e.g. object-storage keys) to be decrypted using the `--encrypt-key`/JFS_RSA_PASSPHRASE-derived key. Format.Decrypt() failed — typically RSA private-key parsing or decryption of stored secrets failed — so object storage cannot be initialized.","triggerScenarios":"Running format/gc/fsck/config/destroy against a metadata URL whose stored format contains encrypted fields, when the encryption key is missing, wrong, or corrupted; metadata was created with a different RSA key pair.","commonSituations":"JFS_RSA_PASSPHRASE wrong for the encrypted private key; ENCRYPT_KEY env var not set or points to wrong file; volume migrated between environments with different keys; corrupted meta format record.","solutions":["Set the correct encryption key env (JFS_RSA_PASSPHRASE for passphrase-protected keys, or the key file path) and retry.","Confirm the RSA private key matches the one used at `juicefs format` time (compare public key fingerprint).","Re-run `juicefs format` only if this is a new volume and stored secrets are not needed.","Check metadata contents (`juicefs config <meta-url>`) to see which field fails to decrypt."],"exampleFix":"// before\njuicefs gc sqlite3://myjfs.db            # missing key -> format decrypt: ...\n// after\nexport JFS_RSA_PASSPHRASE='my-passphrase'\njuicefs gc --encrypt-key /path/to/private.key sqlite3://myjfs.db","handlingStrategy":"try-catch","validationCode":"// Check key material is present before creating storage\nif os.Getenv(\"JFS_RSA_PASSPHRASE\") == \"\" {\n\tif _, err := os.Stat(keyPath); err != nil {\n\t\treturn fmt.Errorf(\"encryption key unavailable: set JFS_RSA_PASSPHRASE or provide key file\")\n\t}\n}","typeGuard":"func hasEncryptionKey() bool {\n\treturn os.Getenv(\"JFS_RSA_PASSPHRASE\") != \"\"\n}","tryCatchPattern":"if err := format.Decrypt(); err != nil {\n\tif strings.Contains(err.Error(), \"format decrypt\") {\n\t\t// prompt user for passphrase / reload key and retry once\n\t}\n\treturn fmt.Errorf(\"format decrypt: %s\", err)\n}","preventionTips":["Persist JFS_RSA_PASSPHRASE in the environment of every client accessing the volume.","Back up the RSA key pair used at format time; store its fingerprint with volume docs.","Use the same encrypted-key file across all mount/gc/fsck hosts.","Test decryption with `juicefs config <meta-url>` before running maintenance commands."],"tags":["encryption","rsa","object-storage","config"],"backgroundTag":"missing-credentials","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}