{"record":{"id":"93f90e5d4d359cb8","repo":"JuliusBrussee/caveman","slug":"kms-envelope-ciphertext-is-empty","errorCode":null,"errorMessage":"kms: envelope ciphertext is empty","messagePattern":"kms: envelope ciphertext is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":246,"sourceCode":"\t}\n\tvar envelope Envelope\n\tif err := json.Unmarshal(blob[len(prefix):], &envelope); err != nil {\n\t\treturn nil, fmt.Errorf(\"kms: decode envelope: %w\", err)\n\t}\n\tif envelope.Provider != c.provider {\n\t\treturn nil, errors.New(\"kms: envelope provider does not match configured provider\")\n\t}\n\tif err := validateLocation(envelope.Region, envelope.KeyID); err != nil {\n\t\treturn nil, err\n\t}\n\tif envelope.Region != c.region {\n\t\treturn nil, errors.New(\"kms: envelope region is not approved\")\n\t}\n\tif _, ok := c.decryptKeyIDs[envelope.KeyID]; !ok {\n\t\treturn nil, errors.New(\"kms: envelope key ID is not approved\")\n\t}\n\tif strings.TrimSpace(envelope.Ciphertext) == \"\" {\n\t\treturn nil, errors.New(\"kms: envelope ciphertext is empty\")\n\t}\n\tvar response struct {\n\t\tKeyID     string `json:\"key_id\"`\n\t\tPlaintext string `json:\"plaintext\"`\n\t}\n\tif err := c.call(ctx, envelope.Region, envelope.KeyID, \"decrypt\", map[string]string{\n\t\t\"ciphertext\": envelope.Ciphertext,\n\t}, &response); err != nil {\n\t\treturn nil, err\n\t}\n\tif response.KeyID != envelope.KeyID || response.Plaintext == \"\" {\n\t\treturn nil, errors.New(\"kms: invalid decrypt response\")\n\t}\n\tplaintext, err := base64.StdEncoding.DecodeString(response.Plaintext)\n\tif err != nil {\n\t\treturn nil, errors.New(\"kms: decrypt response plaintext is not valid base64\")\n\t}\n\tif len(plaintext) == 0 || len(plaintext) > maxPlaintextBytes {","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/kms/kms.go#L228-L264","documentation":"Error \"kms: envelope ciphertext is empty\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/kms/kms.go:246 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The envelope ciphertext is empty; provide a valid envelope."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}