{"record":{"id":"9b4b22cac6cfa285","repo":"phacility/phabricator","slug":"keyring-specifies-an-invalid-key-s-key-mater","errorCode":null,"errorMessage":"Keyring specifies an invalid key (\"%s\"): key material should be base64 encoded.","messagePattern":"Keyring specifies an invalid key \\(\"(.+?)\"\\): key material should be base64 encoded\\.","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php","lineNumber":76,"sourceCode":"        $defaults[] = $name;\n      }\n\n      $type = $spec['type'];\n      switch ($type) {\n        case 'aes-256-cbc':\n          if (!function_exists('openssl_encrypt')) {\n            throw new Exception(\n              pht(\n                'Keyring is configured with a \"%s\" key, but the PHP OpenSSL '.\n                'extension is not installed. Install the OpenSSL extension '.\n                'to enable encryption.',\n                $type));\n          }\n\n          $material = $spec['material.base64'];\n          $material = base64_decode($material, true);\n          if ($material === false) {\n            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be base64 encoded.',\n                $name));\n          }\n\n          if (strlen($material) != 32) {\n            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be 32 bytes (256 bits) but has length %s.',\n                $name,\n                new PhutilNumber(strlen($material))));\n          }\n          break;\n        default:\n          throw new Exception(\n            pht(","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php#L58-L94","documentation":"Key material must be supplied base64-encoded: the validator runs base64_decode($material, true) in strict mode and rejects the entry when it returns false. Strict mode fails on any character outside the base64 alphabet or wrong padding, so raw binary, hex strings, or whitespace inside the value all trigger it. The key name is included in the message.","triggerScenarios":"Pasting hex (e.g. from openssl rand -hex 32) instead of base64; raw binary in the JSON; base64 with stripped padding or embedded newlines/spaces; a value produced by a generator that URL-encodes first.","commonSituations":"Generating key material with the wrong tool (hex vs base64 output flags); copy-paste introducing line breaks; values stored in a secret manager that re-encodes them.","solutions":["Generate correct material: php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;' or head -c 32 /dev/urandom | base64","Ensure the stored string is pure base64: no quotes inside quotes, no whitespace, standard +/ alphabet, padding kept","Re-set the keyring config with the corrected value"],"exampleFix":"// before\n{\"name\": \"prod\", \"type\": \"aes-256-cbc\", \"material.base64\": \"a3f1c0ffee...hex...\"}\n\n// after\n{\"name\": \"prod\", \"type\": \"aes-256-cbc\", \"material.base64\": \"oPHAD/7m2Xy0Zl+Bq1c8Yk0PM4YfNpLrS4jEwVnN0F0=\"}","handlingStrategy":"validation","validationCode":"if (base64_decode($material, true) === false) {\n  // Material for key \"{$name}\" is not valid base64; regenerate with\n  // base64_encode(random_bytes(32)) before saving the keyring.\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate material only with base64_encode(random_bytes(32)) or equivalent","Never hand-type or hex-encode key material","Secret-manager pipelines must pass the value through unchanged (no re-encoding)"],"tags":["config","keyring","base64","validation","phabricator"],"backgroundTag":"config-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}