{"record":{"id":"b0b294f36d6aee2f","repo":"JuliusBrussee/caveman","slug":"envelope-unknown-scheme-q","errorCode":null,"errorMessage":"envelope: unknown scheme %q","messagePattern":"envelope: unknown scheme %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":111,"sourceCode":"\tmetaJSON, err = json.Marshal(meta)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: marshal metadata: %w\", err)\n\t}\n\treturn ciphertext, metaJSON, nil\n}\n\n// Open reverses Seal: it unwraps the data key from metadata and decrypts the\n// ciphertext. An unknown scheme fails closed.\nfunc Open(ciphertext []byte, metaJSON []byte) ([]byte, error) {\n\tvar meta Metadata\n\tif err := json.Unmarshal(metaJSON, &meta); err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: parse metadata: %w\", err)\n\t}\n\tif meta.Scheme == schemeV2 {\n\t\treturn nil, fmt.Errorf(\"envelope: tenant scope required for scheme %q\", meta.Scheme)\n\t}\n\tif meta.Scheme != schemeV1 {\n\t\treturn nil, fmt.Errorf(\"envelope: unknown scheme %q\", meta.Scheme)\n\t}\n\treturn open(ciphertext, meta, nil)\n}\n\n// OpenForScope opens v2 ciphertext only for its authenticated scope. It also\n// reads v1 ciphertext during migration; all new tenant-object writes use v2.\nfunc OpenForScope(ciphertext []byte, metaJSON []byte, scope Scope) ([]byte, error) {\n\tvar meta Metadata\n\tif err := json.Unmarshal(metaJSON, &meta); err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: parse metadata: %w\", err)\n\t}\n\tif meta.Scheme == schemeV1 {\n\t\treturn open(ciphertext, meta, nil)\n\t}\n\tif meta.Scheme != schemeV2 {\n\t\treturn nil, fmt.Errorf(\"envelope: unknown scheme %q\", meta.Scheme)\n\t}\n\taad, scopeHash, err := scopeAAD(scope)","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L93-L129","documentation":"The envelope metadata declares a scheme that is neither v1 nor v2, so no decryption path exists for it. This is the fail-closed branch for unknown/forward-versioned schemes: ciphertext from a newer or unrecognized format is refused rather than guessed at.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Upgrade this binary to a version that understands the envelope scheme in the metadata","Investigate how ciphertext with an unrecognized scheme entered storage"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}