{"record":{"id":"5aca81954b01c506","repo":"nikivdev/code","slug":"invalid-base58-secret-e","errorCode":null,"errorMessage":"invalid base58 secret: {e}","messagePattern":"invalid base58 secret: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sealer_crypto.rs","lineNumber":85,"sourceCode":"    let sender_public = decode_id(sender_id)?;\n    let recipient_key = StaticSecret::from(recipient_secret);\n    let sender_key = PublicKey::from(sender_public);\n    let shared_secret = recipient_key.diffie_hellman(&sender_key).to_bytes();\n    let nonce = derive_nonce(nonce_material);\n    let cipher = XSalsa20Poly1305::new(&shared_secret.into());\n    let plaintext = cipher\n        .decrypt(&nonce.into(), sealed_message)\n        .map_err(|_| anyhow::anyhow!(\"failed to unseal message\"))?;\n    Ok(plaintext)\n}\n\nfn decode_secret(value: &str) -> Result<[u8; 32]> {\n    let encoded = value\n        .strip_prefix(SECRET_PREFIX)\n        .ok_or_else(|| anyhow::anyhow!(\"invalid sealer secret prefix\"))?;\n    let bytes = bs58::decode(encoded)\n        .into_vec()\n        .map_err(|e| anyhow::anyhow!(\"invalid base58 secret: {e}\"))?;\n    bytes\n        .as_slice()\n        .try_into()\n        .map_err(|_| anyhow::anyhow!(\"invalid secret key length\"))\n}\n\nfn decode_id(value: &str) -> Result<[u8; 32]> {\n    let encoded = value\n        .strip_prefix(ID_PREFIX)\n        .ok_or_else(|| anyhow::anyhow!(\"invalid sealer id prefix\"))?;\n    let bytes = bs58::decode(encoded)\n        .into_vec()\n        .map_err(|e| anyhow::anyhow!(\"invalid base58 id: {e}\"))?;\n    bytes\n        .as_slice()\n        .try_into()\n        .map_err(|_| anyhow::anyhow!(\"invalid public key length\"))\n}","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/sealer_crypto.rs#L67-L103","documentation":"decode_secret base58-decodes the body of a \"sealerSecret_z\"-prefixed secret. This error wraps bs58::decode failures: the body contains characters outside the base58 alphabet or other malformed encoding. Prefix was correct; the key material is not valid base58.","triggerScenarios":"Calling seal or unseal with a secret whose body (after the prefix) contains invalid characters such as 0, O, I, l, whitespace, or punctuation.","commonSituations":"Copy-paste corruption, uppercase transformation by a shell/tool, line-wrapping in config files, or hand-typed secrets.","solutions":["Re-copy the secret from its authoritative source, preserving exact characters.","Strip surrounding whitespace and remove line breaks before use.","Validate the body is base58 before calling (regex + decode check).","Regenerate the sealer identity if the value cannot be restored."],"exampleFix":"// before\nlet s = \"sealerSecret_z l0ng-key\"; // space + '0' invalid\n// after\nlet s = \"sealerSecret_zIl0ngKeyCorrected\"; // clean base58 body re-copied","handlingStrategy":"validation","validationCode":"fn secret_body_is_base58(s: &str) -> bool {\n    s.strip_prefix(\"sealerSecret_z\")\n        .map(|body| !body.is_empty() && body.chars().all(|c| {\n            !\"0OIl \\t\\n\\r\".contains(c)\n        }))\n        .unwrap_or(false)\n}","typeGuard":null,"tryCatchPattern":"match seal(sender_secret, recipient_id, nonce, msg) {\n    Err(e) if e.to_string().starts_with(\"invalid base58 secret\") => {\n        eprintln!(\"secret body contains invalid base58 characters; re-copy the value\");\n        return Err(e);\n    }\n    other => other?,\n}","preventionTips":["Copy secrets verbatim from their source file/manager; avoid retyping.","Sanitize only outer whitespace — never alter interior characters.","Round-trip test: bs58 decode + encode must equal the original body.","Reject suspicious secrets at config load with a base58 charset check."],"tags":["crypto","base58","encoding"],"backgroundTag":"invalid-base58-encoding","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}