{"record":{"id":"e268f65461eb7e10","repo":"pulumi/pulumi","slug":"credential-store-backend-q-is-not-usable-here-w","errorCode":null,"errorMessage":"credential store backend %q is not usable here: %w","messagePattern":"credential store backend %q is not usable here: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/go/common/util/securestore/securestore.go","lineNumber":191,"sourceCode":"\t\t\tErrUnavailable, firstErr)\n\t}\n\treturn &Store{b: backendImpl{id: BackendPlaintext}, fallbackReason: firstErr}, nil\n}\n\n// ForBackend returns a store for the backend that produced an existing\n// envelope, regardless of mode — reading data back must always be attempted.\nfunc ForBackend(id Backend) (*Store, error) {\n\tif id == BackendPlaintext {\n\t\treturn &Store{b: backendImpl{id: BackendPlaintext}}, nil\n\t}\n\tfor _, cand := range candidates() {\n\t\tif cand.id == id {\n\t\t\toutcome, err := cand.available()\n\t\t\tif outcome == Declined {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"credential store backend %q is not usable here: %w\", id, err)\n\t\t\t}\n\t\t\treturn &Store{b: cand}, nil\n\t\t}\n\t}\n\treturn nil, fmt.Errorf(\"credential store backend %q is not available on this platform: %w\",\n\t\tid, ErrBackendUnsupported)\n}\n\n// GetKey never creates a key.\nfunc (s *Store) GetKey() ([]byte, error) {\n\tif s.b.id == BackendPlaintext {\n\t\treturn nil, ErrUnavailable\n\t}\n\tvalue, err := s.b.store.get()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tkind, blob, err := parseItem(value)","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/go/common/util/securestore/securestore.go#L173-L209","documentation":"ForBackend(id) found the requested backend on this platform, but its availability check failed with a non-declined error, so the store cannot be used here. The error wraps the underlying cause, e.g. the Secret Service is unreachable or TPM wrapping is unavailable. This differs from 'not available on this platform': the backend exists but is currently unusable.","triggerScenarios":"Calling securestore.ForBackend(id) with a backend identifier read from an on-disk envelope (e.g. \"linux-secretservice\") whose available() returns an error — secret service not running/dbus down, TPM present but wrapper initialization failed, Windows Credential Manager API error.","commonSituations":"Reading encrypted data created on a machine where the service was since disabled; SSH session without a running keyring/secret-service; container images missing dbus even though the backend code is compiled in.","solutions":["Fix the underlying cause reported by the wrapped error: start the secret service (systemctl --user start gnome-keyring-daemon / dbus), or enable Credential Manager.","If the data cannot be read here, access it from an environment where the backend works.","If the environment permanently lacks the backend, decrypt/migrate the data using the original backend before changing setups."],"exampleFix":"// before\nstore, err := securestore.ForBackend(env.Backend) // fails: backend not usable here\n// after\nstore, err := securestore.ForBackend(env.Backend)\nif err != nil {\n    return fmt.Errorf(\"cannot read data (was it written on this machine with this store?): %w\", err)\n}","handlingStrategy":"try-catch","validationCode":"// probe availability before attempting the read\nif _, err := securestore.Resolve(securestore.ModeAuto); err != nil {\n    // no usable backend here\n}","typeGuard":null,"tryCatchPattern":"store, err := securestore.ForBackend(env.Backend)\nif err != nil {\n    return fmt.Errorf(\"backend %q unusable here (was the data written on this machine?): %w\", env.Backend, err)\n}","preventionTips":["Keep the OS credential service (secret-service, keychain, Credential Manager) running in environments that read encrypted data","Probe backend availability at startup before queuing work that needs decryption","Match the reading environment to the one that wrote the envelope"],"tags":["go","credential-store","platform"],"backgroundTag":"credential-store-unavailable","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}