{"record":{"id":"9600638a0a00027c","repo":"JuliusBrussee/caveman","slug":"aes-gcm-open-w","errorCode":null,"errorMessage":"aes-gcm open: %w","messagePattern":"aes-gcm open: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/secretbox/secretbox.go","lineNumber":137,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\tblock, err := aes.NewCipher(keyBytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"aes cipher: %w\", err)\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"aes-gcm: %w\", err)\n\t}\n\tns := gcm.NonceSize()\n\tif len(envelope) < ns {\n\t\treturn nil, fmt.Errorf(\"ciphertext too short\")\n\t}\n\tnonce, ct := envelope[:ns], envelope[ns:]\n\tplain, err := gcm.Open(nil, nonce, ct, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"aes-gcm open: %w\", err)\n\t}\n\treturn plain, nil\n}\n\n// DecryptPayloadKey unwraps an artifact data-encryption key. KMS envelopes are\n// restricted to the configured payload key plus the explicit legacy secrets\n// key used before key separation.\nfunc DecryptPayloadKey(envelope []byte) ([]byte, error) {\n\tif kms.IsEnvelope(envelope) {\n\t\tctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\n\t\tdefer cancel()\n\t\tplaintext, err := kms.DecryptPayload(ctx, envelope)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"secretbox: payload KMS decrypt: %w\", err)\n\t\t}\n\t\treturn plaintext, nil\n\t}\n\treturn Decrypt(envelope)","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/secretbox/secretbox.go#L119-L155","documentation":"gcm.Open rejected the envelope: AES-GCM authentication failed. The nonce/ciphertext/tag do not verify under the current key — the data was tampered with, corrupted, or sealed with a different (e.g. rotated) local key. GCM gives no partial results; the plaintext is unrecoverable.","triggerScenarios":"Thrown at shared/platform/secretbox/secretbox.go:137 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the local key matches the one used to seal the data (key rotation without re-encryption is the classic cause)","Check for byte-level corruption in storage or transport (encoding, escaping, truncation)","Treat authentication failure as potential tampering: audit access and do not retry blindly","Recover from the source of truth: re-seal the secret from its origin rather than repairing ciphertext"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}