{"record":{"id":"5d2e1dff8e796284","repo":"siyuan-note/siyuan","slug":"encrypt-notebook-metadata-failed-w","errorCode":null,"errorMessage":"encrypt notebook metadata failed: %w","messagePattern":"encrypt notebook metadata failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/crypto.go","lineNumber":2577,"sourceCode":"\tcreatedBoxID := id\n\tdefer func() {\n\t\tif err != nil {\n\t\t\tcleanupFailedEncryptedBox(createdBoxID)\n\t\t\tid = \"\"\n\t\t}\n\t}()\n\n\tenc, dek, err := WrapNewDEK(id, kek)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tbox := &Box{ID: id}\n\tboxConf := box.GetConf()\n\tboxConf.Encrypted = true\n\tboxConf.BoxCrypt = enc\n\tif err = encryptBoxMetadata(id, boxConf, dek); err != nil {\n\t\treturn \"\", fmt.Errorf(\"encrypt notebook metadata failed: %w\", err)\n\t}\n\tif err = box.SaveConf(boxConf); err != nil {\n\t\treturn \"\", fmt.Errorf(\"save encrypted notebook conf failed: %w\", err)\n\t}\n\tif err = writeNotebookCryptBackup(id, enc); err != nil {\n\t\treturn \"\", fmt.Errorf(\"write notebook crypt backup failed: %w\", err)\n\t}\n\t// 回读校验加密配置已落盘，避免写失败后按普通笔记本处理\n\tverifyConf := box.GetConf()\n\tif verifyConf == nil || !verifyConf.Encrypted || verifyConf.BoxCrypt == nil {\n\t\terr = errors.New(\"encrypted notebook metadata verification failed after write\")\n\t\treturn \"\", err\n\t}\n\tmarkRuntimeEncryptedBox(id)\n\tinvalidateEncryptedPublishAccessCache()\n\n\t// 复用刚派生的 DEK 直接开 db + 缓存，省去再次 Argon2id 解锁\n\tcachedDEKsLock.Lock()","sourceCodeStart":2559,"sourceCodeEnd":2595,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/crypto.go#L2559-L2595","documentation":"Returned by CreateEncryptedBox when encryptBoxMetadata fails during notebook creation. encryptBoxMetadata encrypts the notebook's .syconf metadata using the freshly derived DEK; failure indicates a low-level AEAD/key-derivation error rather than a user-input problem. The %w wraps the underlying crypto error for diagnosis.","triggerScenarios":"util.DeriveSubKey or util.EncryptWithAAD fails inside encryptBoxMetadata — typically due to an invalid DEK length, an exhausted or unavailable crypto primitive, or an internal assertion in the encryption utility.","commonSituations":"Extremely rare in production. Could indicate a corrupted Argon2id/DEK derivation pipeline, a Go crypto library version incompatibility, or a hardware/entropy issue on the host.","solutions":["Inspect the wrapped error (the %w chain) to find the root cause — log or print err with fmt.Printf(\"%+v\", err).","Verify the DEK returned by WrapNewDEK is non-nil and has the expected length before passing to encryptBoxMetadata.","Update or rebuild the kernel to ensure util.DeriveSubKey and util.EncryptWithAAD are the current implementations."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"id, err := model.CreateEncryptedBox(name, password)\nif err != nil {\n    if strings.Contains(err.Error(), \"encrypt notebook metadata failed\") {\n        // low-level crypto failure — log full chain and report\n        logging.LogErrorf(\"encryptBoxMetadata failed: %+v\", err)\n    }\n    return err\n}","preventionTips":["Ensure util.DeriveSubKey and util.EncryptWithAAD are the current, tested implementations.","Verify WrapNewDEK returns a valid-length DEK before downstream use.","Keep the Go crypto toolchain up to date."],"tags":["encryption","notebook-creation","crypto","metadata"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}