{"record":{"id":"47473479d00a5c12","repo":"juicedata/juicefs","slug":"w-please-set-the-jfs-rsa-passphrase-environmen-474734","errorCode":null,"errorMessage":"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable","messagePattern":"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/load.go","lineNumber":115,"sourceCode":"func (r *reader) Close() error {\n\tif err := r.compressR.Close(); err != nil {\n\t\treturn err\n\t}\n\tif r.encryptR != r.compressR {\n\t\treturn r.encryptR.Close()\n\t}\n\treturn nil\n}\n\nfunc open(src string, key string, algo string) (io.ReadCloser, error) {\n\tvar r io.ReadCloser\n\tvar ioErr error\n\tvar fp io.ReadCloser\n\tif key != \"\" {\n\t\tprivKey, err := object.ParsePrivateKeyFromPem([]byte(loadEncrypt(key)), []byte(os.Getenv(\"JFS_RSA_PASSPHRASE\")))\n\t\tif err != nil {\n\t\t\tif errors.Is(err, object.ErrKeyNeedPasswd) {\n\t\t\t\treturn nil, fmt.Errorf(\"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable\", err)\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"parse private key: %s\", err)\n\t\t}\n\t\tencryptor, err := object.NewDataEncryptor(object.NewKeyEncryptor(privKey), algo)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif _, err := os.Stat(src); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to stat %s: %s\", src, err)\n\t\t}\n\t\tvar srcAbsPath string\n\t\tsrcAbsPath, err = filepath.Abs(src)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get absolute path of %s: %s\", src, err)\n\t\t}\n\t\tfileBlob, err := object.CreateStorage(\"file\", strings.TrimSuffix(src, filepath.Base(srcAbsPath)), \"\", \"\", \"\")\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/load.go#L97-L133","documentation":"When loading a config/cred file that was stored encrypted, the embedded RSA private key needs a passphrase; JFS_RSA_PASSPHRASE was not set, so ParsePrivateKeyFromPem returned ErrKeyNeedPasswd and `load` aborts with the same wrapped guidance as format.","triggerScenarios":"`juicefs load` (or convert) on a config file that was dumped from a volume using --encrypt-algo/--encrypt-key, executed in an environment without JFS_RSA_PASSPHRASE exported.","commonSituations":"Loading backups on a different host where the env var isn't set; CI pipelines and container images lacking the secret; shell without sourcing the env file.","solutions":["Export JFS_RSA_PASSPHRASE with the key's passphrase before running load","Use a secrets manager / env file: `set -a; . ./env; set +a; juicefs load ...`","Regenerate the dump from an unencrypted source if the passphrase is lost is not possible — the key is required","For systemd, add Environment=JFS_RSA_PASSPHRASE=... to the unit"],"exampleFix":"// before\njuicefs load -i dump.json meta-url\n// error: ... JFS_RSA_PASSPHRASE ...\n// after\nJFS_RSA_PASSPHRASE='secret' juicefs load -i dump.json meta-url","handlingStrategy":"validation","validationCode":"if os.Getenv(\"JFS_RSA_PASSPHRASE\") == \"\" {\n    return fmt.Errorf(\"config is encrypted; set JFS_RSA_PASSPHRASE before load\")\n}","typeGuard":"func needsPassphrase(keyPem []byte) bool {\n    return strings.Contains(string(keyPem), \"ENCRYPTED\")\n}","tryCatchPattern":"_, err := load(cmd, args)\nif err != nil && errors.Is(err, object.ErrKeyNeedPassphrase) {\n    // re-run with JFS_RSA_PASSPHRASE set\n}","preventionTips":["Document the passphrase env var wherever encrypted dumps are restored","Inject JFS_RSA_PASSPHRASE via CI secrets or an env file","Keep the encryption key and passphrase available on any host performing load"],"tags":["encryption","environment","config"],"backgroundTag":"missing-env-var","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}