{"record":{"id":"9fa5cc2e320ec7c2","repo":"juicedata/juicefs","slug":"load-s-key-w","errorCode":null,"errorMessage":"load %s key: %w","messagePattern":"load (.+?) key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/sync.go","lineNumber":505,"sourceCode":"}\n\nfunc isS3PathType(endpoint string) bool {\n\t//localhost[:8080] 127.0.0.1[:8080]  s3.ap-southeast-1.amazonaws.com[:8080] s3-ap-southeast-1.amazonaws.com[:8080]\n\tpattern := `^((localhost)|(s3[.-].*\\.amazonaws\\.com)|((1\\d{2}|2[0-4]\\d|25[0-5]|[1-9]\\d|[1-9])\\.((1\\d{2}|2[0-4]\\d|25[0-5]|[1-9]\\d|\\d)\\.){2}(1\\d{2}|2[0-4]\\d|25[0-5]|[1-9]\\d|\\d)))?(:\\d*)?$`\n\treturn regexp.MustCompile(pattern).MatchString(endpoint)\n}\n\nfunc wrapSyncEncryptedStore(store object.ObjectStorage, keyPath, passphraseEnv, mode, algo string) (object.ObjectStorage, error) {\n\tif keyPath == \"\" {\n\t\treturn store, nil\n\t}\n\n\tprivKey, err := object.ParseRsaPrivateKeyFromPath(keyPath, os.Getenv(passphraseEnv))\n\tif err != nil {\n\t\tif errors.Is(err, object.ErrKeyNeedPasswd) {\n\t\t\tlogger.Fatalf(\"%s key is password protected, please set %s environment variable\", mode, passphraseEnv)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"load %s key: %w\", mode, err)\n\t}\n\n\tencryptor, err := object.NewDataEncryptor(object.NewKeyEncryptor(privKey), algo)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create %sor: %w\", mode, err)\n\t}\n\n\treturn object.NewChunkedEncrypted(store, encryptor), nil\n}\n\nfunc loadClusterWorkerConfig(r io.Reader) (string, string, error) {\n\tsrc, dst, env, err := sync.ReadClusterWorkerConfig(r)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\tfor key, value := range env {\n\t\tif err := os.Setenv(key, value); err != nil {\n\t\t\treturn \"\", \"\", fmt.Errorf(\"set worker environment %q: %s\", key, err)","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/sync.go#L487-L523","documentation":"wrapSyncEncryptedStore loads the RSA private key used for client-side encryption during `juicefs sync` (for --encrypt-rsa-key / --enc-key) via object.ParseRsaPrivateKeyFromPath. This error wraps any parse failure other than the 'key needs a passphrase' case — unreadable file, wrong format (not PEM/PKCS), or corrupted key data.","triggerScenarios":"doSync invoked with an encryption key path (--encrypt-rsa-key) pointing to a file that does not exist, is not readable, or contains a key in an unsupported format (e.g. raw DER, ssh-ed25519 key, or a public key instead of a private RSA key). The passphrase case is handled separately with logger.Fatalf, so it does not produce this error.","commonSituations":"Typo in the key file path; key generated with a tool producing non-PKCS1/PKCS8 output; passing an SSH public key (.pub); file permissions blocking the sync user; key file truncated by a failed transfer.","solutions":["Verify the key file exists and is readable: `ls -l <key>` / `openssl rsa -in <key> -check -noout`","Regenerate the key in PEM PKCS form if the format is unsupported: `openssl genrsa -out mykey.pem 2048`","If the key is actually passphrase-protected, set the passphrase environment variable (e.g. JFS_RSA_PASSPHRASE) — that produces a clearer fatal message instead","Point --encrypt-rsa-key at a private key, not a public key or certificate"],"exampleFix":"// before\njuicefs sync --encrypt-rsa-key id_rsa.pub src dst\n// load encrypt-algo key: ... (public key, not parseable)\n// after\njuicefs sync --encrypt-rsa-key id_rsa src dst  # private PEM key","handlingStrategy":"validation","validationCode":"key, err := os.ReadFile(keyPath)\nif err != nil {\n\treturn fmt.Errorf(\"cannot read encryption key %s: %w\", keyPath, err)\n}\nif !strings.Contains(string(key), \"PRIVATE KEY\") {\n\treturn fmt.Errorf(\"%s does not look like a PEM private key\", keyPath)\n}","typeGuard":"null","tryCatchPattern":"if err != nil {\n\tif strings.HasPrefix(err.Error(), \"load \") && strings.Contains(err.Error(), \"key:\") {\n\t\t// key file unreadable or wrong format; prompt user to regenerate\n\t}\n\treturn err\n}","preventionTips":["Validate the key with `openssl rsa -in key.pem -check -noout` before deploying","Set the passphrase env var when keys are encrypted","Restrict key file permissions (0600) and ensure the sync user can read it","Never pass public keys or certificates as --encrypt-rsa-key"],"tags":["encryption","rsa","sync","juicefs","key-format"],"backgroundTag":"file-read-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}