direnv/direnv · error

unmarshal() base64 decoding: %w

Error message

unmarshal() base64 decoding: %w

What it means

Unmarshal first base64url-decodes the gzenv string before zlib decompression; this error wraps any base64 decoding failure, meaning the input is not valid gzenv data (corrupt, truncated, or the wrong format entirely).

Source

Thrown at gzenv/gzenv.go:43

	w := zlib.NewWriter(zlibData)
	// we assume the zlib writer would never fail
	_, _ = w.Write(jsonData)
	if err := w.Close(); err != nil {
		log.Printf("Warning: failed to close zlib writer: %v", err)
	}

	base64Data := base64.URLEncoding.EncodeToString(zlibData.Bytes())

	return base64Data
}

// Unmarshal restores the gzenv format back into a Go object
func Unmarshal(gzenv string, obj interface{}) error {
	gzenv = strings.TrimSpace(gzenv)

	data, err := base64.URLEncoding.DecodeString(gzenv)
	if err != nil {
		return fmt.Errorf("unmarshal() base64 decoding: %w", err)
	}

	zlibReader := bytes.NewReader(data)
	w, err := zlib.NewReader(zlibReader)
	if err != nil {
		return fmt.Errorf("unmarshal() zlib opening: %w", err)
	}

	envData := bytes.NewBuffer([]byte{})
	// G110: Potential DoS vulnerability via decompression bomb (gosec)
	// #nosec
	_, err = io.Copy(envData, w)
	if err != nil {
		return fmt.Errorf("unmarshal() zlib decoding: %w", err)
	}
	if err := w.Close(); err != nil {
		log.Printf("Warning: failed to close zlib reader: %v", err)
	}

View on GitHub (pinned to b00e451f54)

Solutions

1. Regenerate the gzenv data (`direnv dump` / re-enter the directory to refresh DIRENV_DUMP) instead of repairing it
2. Verify the string is intact, unquoted and has no injected whitespace/newlines before decoding
3. Check the data source: ensure you are reading a gzenv blob, not plain JSON or another format

Example fix

// before
dump := os.Getenv("DIRENV_DUMP")
err := gzenv.Unmarshal(dump, &env) // corrupt value
// after
if dump == "" {
    return fmt.Errorf("no dump to load")
}
err := gzenv.Unmarshal(dump, &env)
if err != nil {
    return fmt.Errorf"invalid dump, regenerating: %w", err)
}

if gzenv == "" { return errors.New("empty gzenv input") }
if _, err := base64.URLEncoding.DecodeString(strings.TrimSpace(gzenv)); err != nil {
    return fmt.Errorf("not valid gzenv: %w", err)
}

env, err := gzenv.Unmarshal(raw, &out)
if err != nil {
    if strings.Contains(err.Error(), "base64 decoding") {
        // corrupt/non-gzenv input: regenerate dump and retry
        regenerateDump()
    }
    return err
}

When it happens

Trigger: Unmarshal (and callers cmdShowDumpAction, LoadEnv, LoadEnvDiff) receives a string that is not valid base64url: empty garbage, plain text, a gzenv value mangled by shell quoting, or a value with invalid characters/padding.

Common situations: Restoring a DIRENV_DUMP file that was hand-edited or truncated; passing a gzenv blob through a transport that altered +// characters or newlines; pointing direnv at a dump produced by another tool or format version.

Related errors

• unmarshal() zlib opening: %w
• marshal(): %w
• unmarshal() zlib decoding: %w

AI-assisted analysis of direnv/direnv@b00e451f54 (2026-09-05). Data as JSON: /api/errors/e0757ce13ec402e1. Report an issue: GitHub.