glanceapp/glance · error

computing username hash for user %s: %v

Error message

computing username hash for user %s: %v

What it means

Returned when computeUsernameHash() fails for a configured user during startup. That function builds an HMAC-SHA256 over the username using the second half of the secret key; the only realistic failure is a hashing primitive failure (e.g. hmac.Write error), which is practically unreachable with sha256. Seeing it usually indicates memory/hardware corruption or a non-standard build.

Source

Thrown at internal/glance/glance.go:79

	if len(config.Auth.Users) > 0 {
		secretBytes, err := base64.StdEncoding.DecodeString(config.Auth.SecretKey)
		if err != nil {
			return nil, fmt.Errorf("decoding secret-key: %v", err)
		}

		if len(secretBytes) != AUTH_SECRET_KEY_LENGTH {
			return nil, fmt.Errorf("secret-key must be exactly %d bytes", AUTH_SECRET_KEY_LENGTH)
		}

		app.usernameHashToUsername = make(map[string]string)
		app.failedAuthAttempts = make(map[string]*failedAuthAttempt)
		app.RequiresAuth = true

		for username := range config.Auth.Users {
			user := config.Auth.Users[username]
			usernameHash, err := computeUsernameHash(username, secretBytes)
			if err != nil {
				return nil, fmt.Errorf("computing username hash for user %s: %v", username, err)
			}
			app.usernameHashToUsername[string(usernameHash)] = username

			if user.PasswordHashString != "" {
				user.PasswordHash = []byte(user.PasswordHashString)
				user.PasswordHashString = ""
			} else {
				hashedPassword, err := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
				if err != nil {
					return nil, fmt.Errorf("hashing password for user %s: %v", username, err)
				}

				user.Password = ""
				user.PasswordHash = hashedPassword
			}
		}

		app.authSecretKey = secretBytes

View on GitHub (pinned to 91324e8de7)

Solutions

1. Rebuild/reinstall glance from a clean source tree to rule out a patched crypto stack
2. Re-run startup; a transient occurrence points to memory/hardware diagnostics rather than config
3. Report upstream with full environment details if it reproduces on an unmodified build

Wrap newApplication(); if the chained error names computeUsernameHash, treat as environment/build corruption: log environment details and exit rather than retry — retrying identical input is noise.

When it happens

Trigger: computeUsernameHash returning a non-nil error while iterating config.Auth.Users during newApplication(). Standard library sha256/HMAC essentially never errors here.

Common situations: Essentially never seen in practice; would surface only under extreme conditions (corrupted runtime, patched crypto stack). If it appears, suspect a modified glance build or failing hardware.

Related errors

• decoding secret-key: %v
• secret-key must be exactly %d bytes
• hashing password for user %s: %v
• secret-key must be set when users are configured
• user has no name

AI-assisted analysis of glanceapp/glance@91324e8de7 (2026-08-15). Data as JSON: /api/errors/3b9281501e02a994. Report an issue: GitHub.