{"record":{"id":"6607bf8feb1e2e8e","repo":"semaphoreui/semaphore","slug":"decode-encryption-key-w","errorCode":null,"errorMessage":"decode encryption key: %w","messagePattern":"decode encryption key: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/encryption.go","lineNumber":65,"sourceCode":"\n\tgcm, err := newGCM(encodedKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tnonceSize := gcm.NonceSize()\n\tif len(ciphertext) < nonceSize {\n\t\treturn nil, errors.New(\"ciphertext too short\")\n\t}\n\n\tnonce, payload := ciphertext[:nonceSize], ciphertext[nonceSize:]\n\treturn gcm.Open(nil, nonce, payload, nil)\n}\n\nfunc newGCM(encodedKey string) (cipher.AEAD, error) {\n\tkeyBytes, err := base64.StdEncoding.DecodeString(encodedKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode encryption key: %w\", err)\n\t}\n\tblock, err := aes.NewCipher(keyBytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn cipher.NewGCM(block)\n}\n\nfunc GeneratePrivateKey(privateKeyFile io.Writer) (publicKey string, err error) {\n\t// 1. Generate RSA Private Key (2048 bits)\n\tprivateKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\tif err != nil {\n\t\treturn\n\t}\n\n\t// 2. Encode the private key to PKCS#1 ASN.1 PEM\n\tprivateKeyBytes := x509.MarshalPKCS1PrivateKey(privateKey)\n\tprivateKeyPem := &pem.Block{","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/encryption.go#L47-L83","documentation":"Returned by newGCM in util/encryption.go when the configured encryption key string cannot be base64-decoded. The keyring expects AES keys as base64-encoded raw bytes (32 bytes for AES-256); a decode failure means the key in config/storage was written as literal text, mangled, or encoded with a non-standard alphabet. The %w wraps base64.CorruptInputError with the offset of the first bad character.","triggerScenarios":"Thrown at util/encryption.go:65 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the key as 32 random bytes and store it base64-encoded (e.g. openssl rand -base64 32)","Check the wrapped CorruptInputError offset to find invalid characters in the current key string","Ensure the key was not passed through a layer that altered it (whitespace trimming, URL-encoding, quote stripping)","If secrets were encrypted under the malformed key they are unreadable — re-encrypt them after fixing the key"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}