{"record":{"id":"815d395ee5cbabb5","repo":"gastownhall/beads","slug":"failed-to-initialize-credential-key-w","errorCode":null,"errorMessage":"failed to initialize credential key: %w","messagePattern":"failed to initialize credential key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/storage/dolt/credentials.go","lineNumber":283,"sourceCode":"// This stores credentials in the database and also adds the Dolt remote.\nfunc (s *DoltStore) AddFederationPeer(ctx context.Context, peer *storage.FederationPeer) error {\n\treturn s.withCircuitWrite(ctx, func(ctx context.Context) error {\n\t\treturn s.addFederationPeer(ctx, peer)\n\t})\n}\n\nfunc (s *DoltStore) addFederationPeer(ctx context.Context, peer *storage.FederationPeer) error {\n\t// Validate peer name\n\tif err := validatePeerName(peer.Name); err != nil {\n\t\treturn fmt.Errorf(\"invalid peer name: %w\", err)\n\t}\n\n\t// Encrypt password before storing\n\tvar encryptedPwd []byte\n\tvar err error\n\tif peer.Password != \"\" {\n\t\tif err := s.ensureCredentialKey(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to initialize credential key: %w\", err)\n\t\t}\n\t\tencryptedPwd, err = s.encryptPassword(peer.Password)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to encrypt password: %w\", err)\n\t\t}\n\t}\n\n\t// Upsert the peer credentials\n\t_, err = s.execContext(ctx, `\n\t\tINSERT INTO federation_peers (name, remote_url, username, password_encrypted, sovereignty)\n\t\tVALUES (?, ?, ?, ?, ?)\n\t\tON DUPLICATE KEY UPDATE\n\t\t\tremote_url = VALUES(remote_url),\n\t\t\tusername = VALUES(username),\n\t\t\tpassword_encrypted = VALUES(password_encrypted),\n\t\t\tsovereignty = VALUES(sovereignty),\n\t\t\tupdated_at = CURRENT_TIMESTAMP\n\t`, peer.Name, peer.RemoteURL, peer.Username, encryptedPwd, peer.Sovereignty)","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/storage/dolt/credentials.go#L265-L301","documentation":"addFederationPeer calls ensureCredentialKey before encrypting the peer's password; this wraps any failure from loading or generating the AES key. ensureCredentialKey reads .beads/.beads-credential-key (falling back to the legacy .beads/dolt/ location), and otherwise generates, migrates, and writes a new 32-byte key. Failures include key generation, migration, directory creation, and file write errors.","triggerScenarios":"Calling AddFederationPeer with a non-empty peer.Password when the key file is unreadable/corrupt (wrong length), the .beads directory cannot be created or written (permissions, read-only filesystem), crypto/rand fails, or the legacy-credential migration fails.","commonSituations":"Running bd as a different user than the one who created .beads (permission denied on key file); read-only or full disk; corrupt/truncated .beads-credential-key file; containerized deployments with a non-writable mounted volume.","solutions":["Check filesystem permissions on .beads/ and .beads/.beads-credential-key (should be 0700 dir / 0600 file, owned by the running user).","If the key file is corrupt (not exactly 32 bytes), back it up and delete it, then re-add peer credentials — existing ciphertexts will be unrecoverable and peers must be re-registered with passwords.","Ensure the volume holding .beads is writable; for containers, mount it read-write.","Run `bd init` in the workspace first so .beads/ exists with correct permissions (GH#2641 scenario)."],"exampleFix":"// before (container)\nVOLUME [\"/workspace/.beads:ro\"]\n// after\nVOLUME [\"/workspace/.beads:rw\"]","handlingStrategy":"validation","validationCode":"keyPath := filepath.Join(\".beads\", \".beads-credential-key\")\ninfo, err := os.Stat(keyPath)\nif err == nil && info.Size() != 32 {\n    return fmt.Errorf(\"corrupt credential key file %s\", keyPath)\n}","typeGuard":null,"tryCatchPattern":"if err := store.AddFederationPeer(ctx, peer); err != nil && strings.Contains(err.Error(), \"failed to initialize credential key\") {\n    return fmt.Errorf(\"check .beads/ permissions and key file: %w\", err)\n}","preventionTips":["Run bd as the workspace-owning user; keep .beads at 0700","Mount workspace volumes read-write in containers","Run `bd init` before federation operations"],"tags":["go","encryption","filesystem","credentials"],"backgroundTag":"credential-key-init-failed","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}