{"record":{"id":"89462ca9c00208bd","repo":"JuliusBrussee/caveman","slug":"secretbox-payload-kms-decrypt-w","errorCode":null,"errorMessage":"secretbox: payload KMS decrypt: %w","messagePattern":"secretbox: payload KMS decrypt: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/secretbox/secretbox.go","lineNumber":151,"sourceCode":"\t}\n\tnonce, ct := envelope[:ns], envelope[ns:]\n\tplain, err := gcm.Open(nil, nonce, ct, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"aes-gcm open: %w\", err)\n\t}\n\treturn plain, nil\n}\n\n// DecryptPayloadKey unwraps an artifact data-encryption key. KMS envelopes are\n// restricted to the configured payload key plus the explicit legacy secrets\n// key used before key separation.\nfunc DecryptPayloadKey(envelope []byte) ([]byte, error) {\n\tif kms.IsEnvelope(envelope) {\n\t\tctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\n\t\tdefer cancel()\n\t\tplaintext, err := kms.DecryptPayload(ctx, envelope)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"secretbox: payload KMS decrypt: %w\", err)\n\t\t}\n\t\treturn plaintext, nil\n\t}\n\treturn Decrypt(envelope)\n}\n\nfunc useKMS() bool {\n\treturn strings.EqualFold(strings.TrimSpace(os.Getenv(\"CAVE_KMS_PROVIDER\")), kms.ProviderScaleway)\n}\n\n// ResolveEnvironmentSecret loads a boot-time secret. In production plaintext\n// environment variables are rejected: operators must provide a base64-encoded\n// secretbox/KMS envelope in ciphertextEnv. Local development may continue using\n// plaintextEnv. An entirely absent optional secret returns an empty string.\nfunc ResolveEnvironmentSecret(plaintextEnv, ciphertextEnv string) (string, error) {\n\tplain := strings.TrimSpace(os.Getenv(plaintextEnv))\n\tencoded := strings.TrimSpace(os.Getenv(ciphertextEnv))\n\tproduction := runtimeenv.IsProduction()","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/secretbox/secretbox.go#L133-L169","documentation":"DecryptPayloadKey's KMS path (kms.DecryptPayload) failed within its 10-second timeout while unwrapping an artifact data-encryption key. The KMS envelope is restricted to the payload KEK and the legacy secrets key; the wrapped error states whether this is a transport failure or a key-permission problem.","triggerScenarios":"Thrown at shared/platform/secretbox/secretbox.go:151 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the unwrap — transient KMS errors are common under load","Verify the envelope was sealed with the payload KEK or the allowed legacy key, not another KMS key","Check credentials and key enablement in Scaleway for the payload key","If the KEK was rotated, ensure decryption access to the prior key version during transition"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}