{"record":{"id":"be7901d14c8ab666","repo":"JuliusBrussee/caveman","slug":"secretbox-s-is-not-valid-base64","errorCode":null,"errorMessage":"secretbox: %s is not valid base64","messagePattern":"secretbox: (.+?) is not valid base64","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/secretbox/secretbox.go","lineNumber":178,"sourceCode":"}\n\n// ResolveEnvironmentSecret loads a boot-time secret. In production plaintext\n// environment variables are rejected: operators must provide a base64-encoded\n// secretbox/KMS envelope in ciphertextEnv. Local development may continue using\n// plaintextEnv. An entirely absent optional secret returns an empty string.\nfunc ResolveEnvironmentSecret(plaintextEnv, ciphertextEnv string) (string, error) {\n\tplain := strings.TrimSpace(os.Getenv(plaintextEnv))\n\tencoded := strings.TrimSpace(os.Getenv(ciphertextEnv))\n\tproduction := runtimeenv.IsProduction()\n\tif production && plain != \"\" {\n\t\treturn \"\", fmt.Errorf(\"secretbox: production refuses plaintext %s; use %s\", plaintextEnv, ciphertextEnv)\n\t}\n\tif encoded == \"\" {\n\t\treturn plain, nil\n\t}\n\twrapped, err := base64.StdEncoding.DecodeString(encoded)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s is not valid base64\", ciphertextEnv)\n\t}\n\tdecrypted, err := Decrypt(wrapped)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"secretbox: decrypt %s: %w\", ciphertextEnv, err)\n\t}\n\tif len(decrypted) == 0 {\n\t\treturn \"\", fmt.Errorf(\"secretbox: %s decrypted to an empty secret\", ciphertextEnv)\n\t}\n\treturn string(decrypted), nil\n}\n","sourceCodeStart":160,"sourceCodeEnd":189,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/secretbox/secretbox.go#L160-L189","documentation":"ResolveEnvironmentSecret found the ciphertext variable set, but its content is not valid base64, so the envelope bytes cannot even be obtained. The message names the offending variable; failure happens before any KMS or AES-GCM decryption is attempted.","triggerScenarios":"Thrown at shared/platform/secretbox/secretbox.go:178 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-encode the envelope with standard padded base64 and update the variable","Check for shell/manifest mangling: stripped padding, line breaks, or URL-safe alphabet used by mistake","Copy the base64 exactly from the sealing step — retyping introduces errors","Restart the service after fixing the variable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}