{"record":{"id":"959f1249d11d92bb","repo":"zeroclaw-labs/zeroclaw","slug":"zeroclaw-audit-signing-key-must-be-32-bytes-64-he","errorCode":null,"errorMessage":"ZEROCLAW_AUDIT_SIGNING_KEY must be 32 bytes (64 hex chars), got {}","messagePattern":"ZEROCLAW_AUDIT_SIGNING_KEY must be 32 bytes \\(64 hex chars\\), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/security/audit.rs","lineNumber":273,"sourceCode":"                    ),\n                }\n            })?;\n\n            let key_bytes = hex::decode(&key_hex).map_err(|e| {\n                ::zeroclaw_log::record!(\n                    ERROR,\n                    ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Fail)\n                        .with_outcome(::zeroclaw_log::EventOutcome::Failure)\n                        .with_attrs(::serde_json::json!({\"error\": format!(\"{e}\")})),\n                    \"audit log: ZEROCLAW_AUDIT_SIGNING_KEY env var must be hex-encoded\"\n                );\n                anyhow::Error::msg(format!(\n                    \"ZEROCLAW_AUDIT_SIGNING_KEY must be hex-encoded: {e}\"\n                ))\n            })?;\n\n            if key_bytes.len() != 32 {\n                bail!(\n                    \"ZEROCLAW_AUDIT_SIGNING_KEY must be 32 bytes (64 hex chars), got {}\",\n                    key_bytes.len()\n                );\n            }\n\n            Some(key_bytes)\n        } else {\n            None\n        };\n\n        let log_path = zeroclaw_dir.join(&config.log_path);\n        let chain_state = recover_chain_state(&log_path);\n        Ok(Self {\n            log_path,\n            config,\n            chain: Mutex::new(chain_state),\n            signing_key,\n        })","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/audit.rs#L255-L291","documentation":"ZEROCLAW_AUDIT_SIGNING_KEY decoded from hex successfully, but the result is not exactly 32 bytes. The audit chain signs entries with HMAC-SHA256, which here requires a 32-byte key — i.e. exactly 64 hex characters. Construction of the audit log with sign_events=true fails at startup.","triggerScenarios":"Setting the env var to a hex string of the wrong length (e.g. 128 hex chars = 64 bytes, or 32 hex chars = 16 bytes); pasting a passphrase that happens to be valid hex; truncating or re-generating the key incorrectly after rotation.","commonSituations":"Key generated with `openssl rand -hex 16` (32 hex chars) instead of `-hex 32`; copy-paste losing characters; switching from another tool's base64 key without re-encoding; rotation scripts emitting a different length.","solutions":["Generate correctly: export ZEROCLAW_AUDIT_SIGNING_KEY=\"$(openssl rand -hex 32)\".","Verify length before launch: echo -n \"$ZEROCLAW_AUDIT_SIGNING_KEY\" | wc -c must print 64.","If a wrong-length key already signed records, note those records cannot be verified later — keep the original key archived for verification of old logs.","Store the key in a secret manager or unit Environment= with the exact 64-hex-char value."],"exampleFix":"# before\nexport ZEROCLAW_AUDIT_SIGNING_KEY=\"my-secret-key\"          # not hex, wrong length\nexport ZEROCLAW_AUDIT_SIGNING_KEY=\"$(openssl rand -hex 16)\" # 32 hex chars = 16 bytes\n\n# after\nexport ZEROCLAW_AUDIT_SIGNING_KEY=\"$(openssl rand -hex 32)\" # 64 hex chars = 32 bytes","handlingStrategy":"validation","validationCode":"fn signing_key_env_valid() -> bool {\n    std::env::var(\"ZEROCLAW_AUDIT_SIGNING_KEY\")\n        .map(|v| v.len() == 64 && v.bytes().all(|b| b.is_ascii_hexdigit()))\n        .unwrap_or(false)\n}","typeGuard":null,"tryCatchPattern":"if !signing_key_env_valid() && config.sign_events {\n    anyhow::bail!(\"ZEROCLAW_AUDIT_SIGNING_KEY must be 64 hex chars before enabling sign_events\");\n}","preventionTips":["Generate keys only with `openssl rand -hex 32` and store them in a secret manager.","Add a pre-start check that fails deployment when sign_events=true but the key is not 64 hex chars.","Archive old keys on rotation so historical audit logs remain verifiable."],"tags":["audit","hmac","signing-key","environment-variable","config","security"],"backgroundTag":"invalid-signing-key-length","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}