{"record":{"id":"50ed5eecfb1846e8","repo":"larksuite/cli","slug":"keychain-is-corrupted-50ed5e","errorCode":null,"errorMessage":"keychain is corrupted","messagePattern":"keychain is corrupted","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/keychain/keychain_other.go","lineNumber":64,"sourceCode":"\n// safeFileName sanitizes an account name to be used as a safe file name.\nfunc safeFileName(account string) string {\n\treturn safeFileNameRe.ReplaceAllString(account, \"_\") + \".enc\"\n}\n\n// getMasterKey retrieves the master key from the file system.\n// If allowCreate is true, it generates and stores a new master key if one doesn't exist.\nfunc getMasterKey(service string, allowCreate bool) ([]byte, error) {\n\tdir := StorageDir(service)\n\tkeyPath := filepath.Join(dir, \"master.key\")\n\n\tkey, err := vfs.ReadFile(keyPath)\n\tif err == nil && len(key) == masterKeyBytes {\n\t\treturn key, nil\n\t}\n\tif err == nil && len(key) != masterKeyBytes {\n\t\t// Key file exists but is corrupted\n\t\treturn nil, errors.New(\"keychain is corrupted\")\n\t}\n\tif err != nil && !errors.Is(err, os.ErrNotExist) {\n\t\t// Real I/O error (permission denied, etc.) - propagate it\n\t\treturn nil, err\n\t}\n\n\tif !allowCreate {\n\t\treturn nil, errNotInitialized\n\t}\n\n\tif err := vfs.MkdirAll(dir, 0700); err != nil {\n\t\treturn nil, err\n\t}\n\n\tkey = make([]byte, masterKeyBytes)\n\tif _, err := rand.Read(key); err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/keychain/keychain_other.go#L46-L82","documentation":"getMasterKey read the on-disk master.key file for the file-system keychain backend successfully, but its length is not exactly masterKeyBytes (only a length check applies to raw file storage). Like the Darwin twin it is a corruption sentinel: key material exists but cannot be trusted for encryption.","triggerScenarios":"Thrown at internal/keychain/keychain_other.go:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the stale master.key file under the service storage dir and let the CLI regenerate it on next use (stored encrypted data becomes unreadable and must be re-entered)"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}