{"record":{"id":"6ca23ca086bdc11b","repo":"JuliusBrussee/caveman","slug":"secretbox-decrypt-s-w","errorCode":null,"errorMessage":"secretbox: decrypt %s: %w","messagePattern":"secretbox: decrypt (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/secretbox/secretbox.go","lineNumber":182,"sourceCode":"// secretbox/KMS envelope in ciphertextEnv. Local development may continue using\n// plaintextEnv. An entirely absent optional secret returns an empty string.\nfunc ResolveEnvironmentSecret(plaintextEnv, ciphertextEnv string) (string, error) {\n\tplain := strings.TrimSpace(os.Getenv(plaintextEnv))\n\tencoded := strings.TrimSpace(os.Getenv(ciphertextEnv))\n\tproduction := runtimeenv.IsProduction()\n\tif production && plain != \"\" {\n\t\treturn \"\", fmt.Errorf(\"secretbox: production refuses plaintext %s; use %s\", plaintextEnv, ciphertextEnv)\n\t}\n\tif encoded == \"\" {\n\t\treturn plain, nil\n\t}\n\twrapped, err := base64.StdEncoding.DecodeString(encoded)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s is not valid base64\", ciphertextEnv)\n\t}\n\tdecrypted, err := Decrypt(wrapped)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: decrypt %s: %w\", ciphertextEnv, err)\n\t}\n\tif len(decrypted) == 0 {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s decrypted to an empty secret\", ciphertextEnv)\n\t}\n\treturn string(decrypted), nil\n}\n","sourceCodeStart":164,"sourceCodeEnd":189,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/secretbox/secretbox.go#L164-L189","documentation":"ResolveEnvironmentSecret base64-decoded the envelope but the subsequent Decrypt (KMS or local AES-GCM) failed. The wrapped error says which layer failed: KMS availability/permissions, or GCM authentication (wrong key/tampered data). The message names the ciphertext variable for easy tracing.","triggerScenarios":"Thrown at shared/platform/secretbox/secretbox.go:182 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the wrapped error: retry KMS transport failures, treat GCM auth failures as key mismatch or tampering","Confirm the envelope was sealed with the key/KMS key the service currently uses","Re-seal the secret with the correct key and update the ciphertext variable if the key changed","For persistent failures, rotate the secret at its source rather than weakening validation"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}