{"record":{"id":"e26a4922140e22ac","repo":"JuliusBrussee/caveman","slug":"envelope-ciphertext-too-short","errorCode":null,"errorMessage":"envelope: ciphertext too short","messagePattern":"envelope: ciphertext too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":158,"sourceCode":"\twrapped, err := base64.StdEncoding.DecodeString(meta.WrappedDataKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: decode wrapped key: %w\", err)\n\t}\n\tdataKey, err := secretbox.DecryptPayloadKey(wrapped)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: unwrap data key: %w\", err)\n\t}\n\tblock, err := aes.NewCipher(dataKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: aes: %w\", err)\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: gcm: %w\", err)\n\t}\n\tns := gcm.NonceSize()\n\tif len(ciphertext) < ns {\n\t\treturn nil, fmt.Errorf(\"envelope: ciphertext too short\")\n\t}\n\tnonce, ct := ciphertext[:ns], ciphertext[ns:]\n\tplaintext, err := gcm.Open(nil, nonce, ct, aad)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: open: %w\", err)\n\t}\n\treturn plaintext, nil\n}\n\nfunc scopeAAD(scope Scope) ([]byte, string, error) {\n\tscope.OrganizationID = strings.TrimSpace(scope.OrganizationID)\n\tscope.ProjectID = strings.TrimSpace(scope.ProjectID)\n\tscope.Kind = strings.TrimSpace(scope.Kind)\n\tif scope.OrganizationID == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: organization scope is required\")\n\t}\n\tif scope.Kind == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: object kind is required\")","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L140-L176","documentation":"Fires in open() when the ciphertext blob is shorter than the AES-GCM nonce size, meaning it cannot possibly contain a nonce plus a valid GCM-encrypted payload. This indicates truncation, corruption, or a wrong (non-envelope) value passed as ciphertext.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:158 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the stored ciphertext was not truncated by the persistence layer or by a size-limited column/field","Confirm you are passing the original sealed output, not a decoded/derived representation","Re-seal the data if the stored blob is unrecoverable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}