{"record":{"id":"6510855f70d9a82f","repo":"JuliusBrussee/caveman","slug":"envelope-wrap-data-key-w","errorCode":null,"errorMessage":"envelope: wrap data key: %w","messagePattern":"envelope: wrap data key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":90,"sourceCode":"\t\treturn nil, nil, fmt.Errorf(\"envelope: data key entropy: %w\", err)\n\t}\n\tblock, err := aes.NewCipher(dataKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: aes: %w\", err)\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: gcm: %w\", err)\n\t}\n\tnonce := make([]byte, gcm.NonceSize())\n\tif _, err := rand.Read(nonce); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: nonce entropy: %w\", err)\n\t}\n\tciphertext = gcm.Seal(nonce, nonce, plaintext, aad)\n\n\twrapped, err := secretbox.EncryptPayloadKey(dataKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: wrap data key: %w\", err)\n\t}\n\tmeta := Metadata{Scheme: scheme, WrappedDataKey: base64.StdEncoding.EncodeToString(wrapped), ScopeHash: scopeHash}\n\tmetaJSON, err = json.Marshal(meta)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: marshal metadata: %w\", err)\n\t}\n\treturn ciphertext, metaJSON, nil\n}\n\n// Open reverses Seal: it unwraps the data key from metadata and decrypts the\n// ciphertext. An unknown scheme fails closed.\nfunc Open(ciphertext []byte, metaJSON []byte) ([]byte, error) {\n\tvar meta Metadata\n\tif err := json.Unmarshal(metaJSON, &meta); err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: parse metadata: %w\", err)\n\t}\n\tif meta.Scheme == schemeV2 {\n\t\treturn nil, fmt.Errorf(\"envelope: tenant scope required for scheme %q\", meta.Scheme)","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L72-L108","documentation":"seal successfully encrypted the plaintext under a fresh data key, but secretbox.EncryptPayloadKey failed to wrap that data key with the KMS. The ciphertext is discarded — envelope encryption requires the key to be recoverable via the wrapped copy, so an unwrappable result must not be persisted.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:90 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check KMS availability, credentials, and key URI","Retry the seal once the KMS is healthy"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}