dutchcoders/transfer.sh · error

secret-key not set.

Error message

secret-key not set.

What it means

Thrown by the transfer.sh CLI when --provider s3 is chosen and --aws-access-key is present but --aws-secret-key is empty. The secret key pairs with the access key to sign S3 requests, so the startup code rejects a credential set with only half the key pair. Validation runs before any S3 connection is attempted.

Source

Thrown at cmd/cmd.go:490

			ipFilterOptions.AllowedIPs = strings.Split(ipWhitelist, ",")
			ipFilterOptions.BlockByDefault = true
		}

		if ipBlacklist := c.String("ip-blacklist"); ipBlacklist != "" {
			applyIPFilter = true
			ipFilterOptions.BlockedIPs = strings.Split(ipBlacklist, ",")
		}

		if applyIPFilter {
			options = append(options, server.FilterOptions(ipFilterOptions))
		}

		switch provider := c.String("provider"); provider {
		case "s3":
			if accessKey := c.String("aws-access-key"); accessKey == "" {
				return errors.New("access-key not set.")
			} else if secretKey := c.String("aws-secret-key"); secretKey == "" {
				return errors.New("secret-key not set.")
			} else if bucket := c.String("bucket"); bucket == "" {
				return errors.New("bucket not set.")
			} else if store, err := storage.NewS3Storage(c.Context, accessKey, secretKey, bucket, purgeDays, c.String("s3-region"), c.String("s3-endpoint"), c.Bool("s3-no-multipart"), c.Bool("s3-path-style"), logger); err != nil {
				return err
			} else {
				options = append(options, server.UseStorage(store))
			}
		case "gdrive":
			chunkSize := c.Int("gdrive-chunk-size") * 1024 * 1024

			if clientJSONFilepath := c.String("gdrive-client-json-filepath"); clientJSONFilepath == "" {
				return errors.New("gdrive-client-json-filepath not set.")
			} else if localConfigPath := c.String("gdrive-local-config-path"); localConfigPath == "" {
				return errors.New("gdrive-local-config-path not set.")
			} else if basedir := c.String("basedir"); basedir == "" {
				return errors.New("basedir not set.")
			} else if store, err := storage.NewGDriveStorage(c.Context, clientJSONFilepath, localConfigPath, basedir, chunkSize, logger); err != nil {
				return err

View on GitHub (pinned to c37bfd9579)

Solutions

1. Add --aws-secret-key <secret> to the command line
2. If the secret lives in a file or env var, interpolate it, e.g. --aws-secret-key "$(cat /run/secrets/aws_secret)"
3. Ensure --bucket is also set, as it is validated next
4. Double-check shell quoting of the secret (leading/trailing special characters can break naive interpolation)

Example fix

// before
transfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --bucket uploads
// after
transfer.sh --provider s3 --aws-access-key AKIAXXXXXXXX --aws-secret-key "$AWS_SECRET_ACCESS_KEY" --bucket uploads

# ensure the secret is non-empty before interpolation
: "${AWS_SECRET_ACCESS_KEY:?aws secret key required}"
args+=(--aws-secret-key "$AWS_SECRET_ACCESS_KEY")

if err := cmd.Root.Execute(); err != nil {
  if strings.Contains(err.Error(), "secret-key not set") {
    log.Fatalf("S3 provider selected but --aws-secret-key is missing")
  }
  os.Exit(1)
}

When it happens

Trigger: Running with --provider s3 --aws-access-key X but without --aws-secret-key — e.g. the secret was stored in a secret manager and never injected into the flag, or a config template dropped it.

Common situations: Secrets kept out of repo configs (correctly) but the injection step into the CLI arguments is missing; Kubernetes/Docker secret mounted as a file but not passed to the flag; access key updated while the secret line was accidentally deleted.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

• access-key not set.
• bucket not set.
• storj-access not set.
• clamav-host not set
• gdrive-client-json-filepath not set.

AI-assisted analysis of dutchcoders/transfer.sh@c37bfd9579 (2026-09-05). Data as JSON: /api/errors/39c8ceadc5d4d255. Report an issue: GitHub.