{"record":{"id":"b5d1a619a66ba520","repo":"juicedata/juicefs","slug":"passphrase-is-required-to-private-key","errorCode":null,"errorMessage":"passphrase is required to private key","messagePattern":"passphrase is required to private key","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/encrypt.go","lineNumber":65,"sourceCode":"func ExportRsaPrivateKeyToPem(key *rsa.PrivateKey, passphrase string) string {\n\tbuf := x509.MarshalPKCS1PrivateKey(key)\n\tblock := &pem.Block{\n\t\tType:  \"RSA PRIVATE KEY\",\n\t\tBytes: buf,\n\t}\n\tif passphrase != \"\" {\n\t\tvar err error\n\t\t// nolint:staticcheck\n\t\tblock, _ = x509.EncryptPEMBlock(rand.Reader, block.Type, buf, []byte(passphrase), x509.PEMCipherAES256)\n\t\tif err != nil {\n\t\t\tpanic(err)\n\t\t}\n\t}\n\tprivPEM := pem.EncodeToMemory(block)\n\treturn string(privPEM)\n}\n\nvar ErrKeyNeedPasswd = errors.New(\"passphrase is required to private key\")\n\nfunc ParsePrivateKeyFromPem(enc []byte, passphrase []byte) (any, error) {\n\tblock, _ := pem.Decode(enc)\n\tif block == nil {\n\t\treturn nil, errors.New(\"failed to parse PEM block containing the key\")\n\t}\n\n\tbuf := block.Bytes\n\tif len(passphrase) == 0 {\n\t\t// nolint:staticcheck\n\t\tif strings.Contains(block.Headers[\"Proc-Type\"], \"ENCRYPTED\") && x509.IsEncryptedPEMBlock(block) {\n\t\t\treturn nil, ErrKeyNeedPasswd\n\t\t}\n\t\tif strings.Contains(block.Type, \"ENCRYPTED\") {\n\t\t\treturn nil, ErrKeyNeedPasswd\n\t\t}\n\t} else {\n\t\tvar err error","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/encrypt.go#L47-L83","documentation":"ErrKeyNeedPasswd is returned by ParsePrivateKeyFromPem when the supplied RSA private key is encrypted (PEM) but no passphrase was given (empty JFS_RSA_PASSPHRASE). The key cannot be decrypted, so format/load abort with a hint to set the env var.","triggerScenarios":"juicefs format --encrypt-algo with an encrypted private key while JFS_RSA_PASSPHRASE is unset; juicefs load on an encrypted backup without the env var; createStorage/open wrapping a sync-encrypted store without a passphrase.","commonSituations":"Running format/load in cron/CI where the env var isn't exported; key generated with openssl with a password but the operator forgot the env var; service accounts lacking the secret.","solutions":["Set the JFS_RSA_PASSPHRASE environment variable to the key's passphrase before running the command.","Verify with errors.Is(err, object.ErrKeyNeedPasswd) to distinguish from other key parse errors and print the hint.","If no passphrase should be needed, supply an unencrypted RSA private key PEM instead.","Ensure the env var is passed through sudo/systemd/cron (sudo -E, Environment=, or export in the job)."],"exampleFix":"// before\njuicefs format sqlite3://test.db myjfs --encrypt-algo rsa-keygen --encrypt-key key.pem\n// after\nexport JFS_RSA_PASSPHRASE='my-secret'\njuicefs format sqlite3://test.db myjfs --encrypt-algo rsa-keygen --encrypt-key key.pem","handlingStrategy":"try-catch","validationCode":"if len(os.Getenv(\"JFS_RSA_PASSPHRASE\")) == 0 && keyIsEncrypted(keyPEM) {\n    return fmt.Errorf(\"set JFS_RSA_PASSPHRASE before using encrypted key\")\n}","typeGuard":null,"tryCatchPattern":"privKey, err := object.ParsePrivateKeyFromPem(key, []byte(os.Getenv(\"JFS_RSA_PASSPHRASE\")))\nif errors.Is(err, object.ErrKeyNeedPasswd) {\n    return nil, fmt.Errorf(\"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable\", err)\n}","preventionTips":["Export JFS_RSA_PASSPHRASE wherever encrypted keys are used (CI secrets, systemd Environment, sudo -E).","Check errors.Is(err, object.ErrKeyNeedPasswd) to give actionable messages.","Prefer unencrypted keys protected by filesystem permissions if managing env vars is hard."],"tags":["encryption","rsa","passphrase","env-var"],"backgroundTag":"missing-env-var","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}