{"record":{"id":"fd3ccb1696d466e5","repo":"juicedata/juicefs","slug":"new-sm4-gcm-s","errorCode":null,"errorMessage":"new sm4 GCM: %s","messagePattern":"new sm4 GCM: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":216,"sourceCode":"\t\t\terr = fmt.Errorf(\"allowed maximum version: %s; please use an older client\", f.MaxClientVersion)\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc newCipher(algo string, key string) (cipher.AEAD, error) {\n\tswitch algo {\n\tcase object.SM4GCM:\n\t\tblock, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\tdefault:\n\t\thashKey := md5.Sum([]byte(key))\n\t\tblock, err := aes.NewCipher(hashKey[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\t}\n}\n\nfunc (f *Format) Encrypt() error {\n\tif f.KeyEncrypted || f.SecretKey == \"\" && f.EncryptKey == \"\" && f.SessionToken == \"\" {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L198-L234","documentation":"Returned by newCipher in pkg/meta/config.go when cipher.NewGCM fails for an SM4 block cipher while initializing the volume encryption AEAD. In practice NewGCM on a valid SM4 block never fails, so this is effectively an internal invariant error wrapping the underlying crypto error. It surfaces through Format.Encrypt/Decrypt when loading or saving an encrypted volume format.","triggerScenarios":"Calling Format.Encrypt() or Format.Decrypt() with EncryptAlgorithm set to 'sm4' and cipher.NewGCM(block) returning a non-nil error (e.g. crypto build without SM4 support in a forked/sha3 provider).","commonSituations":"Using the sm4 encryption algorithm on a build/toolchain where the SM4 implementation is unavailable or broken; practically never seen with stock Go toolchains.","solutions":["Verify the build includes a working SM4 provider (github.com/emmansun/gsm) and the binary was rebuilt, not a stale artifact","Switch EncryptAlgorithm to aes256 in the format via `juicefs config` if SM4 support is not required","Check the wrapped error message (%s) for the underlying crypto failure and fix accordingly"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"if f.EncryptAlgorithm == \"sm4\" { /* ensure build supports SM4; otherwise switch to aes256 */ }","typeGuard":null,"tryCatchPattern":"if err := format.Encrypt(); err != nil { if strings.Contains(err.Error(), \"new sm4 GCM\") { /* rebuild with SM4 support or switch algorithm */ } }","preventionTips":["Pin a build environment with SM4 crypto support when using EncryptAlgorithm sm4","Test format.Encrypt/Decrypt round-trip in CI for each algorithm you use","Prefer aes256 unless SM4 is a hard requirement"],"tags":["crypto","encryption","sm4","config"],"backgroundTag":"module-init-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}