{"record":{"id":"863597168632abc6","repo":"hashicorp/nomad","slug":"invalid-key-s","errorCode":null,"errorMessage":"Invalid key: %s","messagePattern":"Invalid key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/agent/keyring.go","lineNumber":27,"sourceCode":"\t\"fmt\"\n\t\"os\"\n\t\"path/filepath\"\n\n\tlog \"github.com/hashicorp/go-hclog\"\n\t\"github.com/hashicorp/memberlist\"\n\t\"github.com/hashicorp/serf/serf\"\n)\n\nconst (\n\tserfKeyring = \"server/serf.keyring\"\n)\n\n// initKeyring will create a keyring file at a given path.\nfunc initKeyring(path, key string, l log.Logger) error {\n\tvar keys []string\n\n\tif keyBytes, err := base64.StdEncoding.DecodeString(key); err != nil {\n\t\treturn fmt.Errorf(\"Invalid key: %s\", err)\n\t} else if err := memberlist.ValidateKey(keyBytes); err != nil {\n\t\treturn fmt.Errorf(\"Invalid key: %s\", err)\n\t}\n\n\t// Check for AES-256 key size (32-bytes)\n\tif len(key) < 32 {\n\t\tvar encMethod string\n\t\tswitch len(key) {\n\t\tcase 16:\n\t\t\tencMethod = \"AES-128\"\n\t\tcase 24:\n\t\t\tencMethod = \"AES-192\"\n\t\t}\n\t\tmsg := fmt.Sprintf(\"given %d-byte gossip key enables %s encryption, generate a 32-byte key to enable AES-256\", len(key), encMethod)\n\t\tl.Info(msg)\n\t}\n\n\t// Just exit if the file already exists.","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/agent/keyring.go#L9-L45","documentation":"initKeyring (command/agent/keyring.go:27) wraps the error from base64.StdEncoding.DecodeString when the --keyring-generate/--keyring or keyring key material supplied on the CLI is not valid standard base64. The agent aborts keyring-file creation with 'Invalid key: ...'. This is a startup/config failure: the key was provided but is malformed before any key-size validation happens.","triggerScenarios":"Running 'nomad agent ... -keyring-generate' or initKeyring with a key string containing characters outside the standard base64 alphabet (spaces, '!=', URL-safe '-_'), wrong padding, or a value that was quoted/escaped incorrectly in config.","commonSituations":"Copy-pasting a key with trailing whitespace or newline; using a URL-safe base64 key (with - and _) where standard encoding is required; forgetting to base64-encode a raw key at all; secrets managers stripping padding '='.","solutions":["Base64-encode your key material with standard encoding (e.g. openssl rand -base64 32) before passing it.","Trim whitespace/newlines and shell-escaping artifacts from the key string.","Regenerate a fresh 32-byte key if the original cannot be recovered: openssl rand -base64 32.","If the key came from a URL-safe base64 source, re-encode it: base64.RawURLEncoding decode then base64.StdEncoding encode."],"exampleFix":"// before\nnomad agent -server -keyring-generate -keyring ./keyring -key 'my secret key with spaces'\n// after\nKEY=$(openssl rand -base64 32)\nnomad agent -server -keyring-generate -keyring ./keyring -key \"$KEY\"","handlingStrategy":"validation","validationCode":"// Validate the keyring key before invoking nomad agent\nkeyBytes, err := base64.StdEncoding.DecodeString(key)\nif err != nil {\n    return fmt.Errorf(\"key must be standard base64: %w\", err)\n}\nif err := memberlist.ValidateKey(keyBytes); err != nil {\n    return fmt.Errorf(\"key invalid for memberlist: %w\", err)\n}","typeGuard":"func isValidKeyringKey(key string) bool {\n    b, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key))\n    return err == nil && memberlist.ValidateKey(b) == nil\n}","tryCatchPattern":"if err := initKeyring(path, key, logger); err != nil {\n    if strings.HasPrefix(err.Error(), \"Invalid key:\") {\n        // regenerate a fresh base64 key and retry once\n        key = generateKey()\n        return initKeyring(path, key, logger)\n    }\n    return err\n}","preventionTips":["Generate keys with: openssl rand -base64 32.","Trim whitespace/newlines from pasted key values.","Never use URL-safe base64 (-/_) where standard encoding is expected.","Verify round-trip: echo \"$KEY\" | base64 -d >/dev/null must succeed."],"tags":["keyring","base64","configuration","security","nomad"],"backgroundTag":"invalid-key-encoding","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}