{"record":{"id":"f7a969572f3b23cc","repo":"pulumi/pulumi","slug":"encryptedlog-decompressing-chunk-w","errorCode":null,"errorMessage":"encryptedlog: decompressing chunk: %w","messagePattern":"encryptedlog: decompressing chunk: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/engine/encryptedlog/reader.go","lineNumber":162,"sourceCode":"\n\tnonce := payload[:nonceSize]\n\tciphertext := payload[nonceSize:]\n\n\t// Verify the nonce matches the expected counter.\n\tcd.counter++\n\texpected := makeNonce(cd.counter)\n\tif !bytes.Equal(nonce, expected[:]) {\n\t\treturn 0, errors.New(\"encryptedlog: nonce counter mismatch\")\n\t}\n\n\tcompressed, err := cd.aesgcm.Open(nil, nonce, ciphertext, nil)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"encryptedlog: chunk decryption failed: %w\", err)\n\t}\n\n\tgz, err := gzip.NewReader(bytes.NewReader(compressed))\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"encryptedlog: decompressing chunk: %w\", err)\n\t}\n\tplaintext, err := io.ReadAll(gz)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"encryptedlog: decompressing chunk: %w\", err)\n\t}\n\tif err := gz.Close(); err != nil {\n\t\treturn 0, fmt.Errorf(\"encryptedlog: decompressing chunk: %w\", err)\n\t}\n\n\tn := copy(p, plaintext)\n\tcd.buf = plaintext[n:]\n\treturn n, nil\n}\n","sourceCodeStart":144,"sourceCodeEnd":176,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/engine/encryptedlog/reader.go#L144-L176","documentation":"A chunk decrypted successfully but its plaintext is not a valid gzip stream. The writer gzip-compresses each chunk before encrypting, so any decrypted payload must start with a gzip header; failure here indicates the payload came from an incompatible producer or is corrupt.","triggerScenarios":"Reader.Read calls gzip.NewReader on the decrypted bytes of a chunk and the gzip header is invalid — wrong writer version/producer, or corrupted-but-authenticated data.","commonSituations":"Reading a PLOG-like file written by a tool that skips gzip compression; a future/other version changing chunk framing; corruption that coincidentally passes GCM (effectively impossible without the key).","solutions":["Confirm the producer of the file uses the same PLOG format version (check Version byte and writer implementation)","Regenerate or re-acquire the log file from the source process","Compare against a known-good log produced by the same CLI version","File a bug with the file's producer if the format differs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"n, err := reader.Read(buf)\nif err != nil {\n\tif strings.Contains(err.Error(), \"decompressing chunk\") {\n\t\t// format/producer mismatch: stop and verify producer version\n\t}\n}","preventionTips":["Only read PLOG files produced by a matching pulumi CLI version","Do not post-process or re-encrypt chunk contents with other tools","Pin CLI versions across writers and readers of shared logs","Verify file provenance (checksum) before reading"],"tags":["go","gzip","encrypted-log","format-mismatch"],"backgroundTag":"invalid-gzip-stream","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}