googleworkspace/cli · error

Encryption failed: {e}

Error message

Encryption failed: {e}

What it means

cipher.encrypt() in encrypt() fails only when the AES-GCM AEAD cannot process the input — in practice only when the plaintext exceeds the AEAD's maximum message size (roughly 64 GiB for GCM). Credential JSON is a few KiB, so this is a defensive branch that guards against absurd inputs rather than an expected failure mode.

Source

Thrown at crates/google-workspace-cli/src/credential_store.rs:391

        Ok(key)
    } else {
        Ok(*KEY
            .get()
            .expect("key must be initialized if OnceLock::set() failed"))
    }
}

/// Encrypts plaintext bytes using AES-256-GCM with a machine-derived key.
/// Returns nonce (12 bytes) || ciphertext.
pub fn encrypt(plaintext: &[u8]) -> anyhow::Result<Vec<u8>> {
    let key = get_or_create_key()?;
    let cipher = Aes256Gcm::new_from_slice(&key)
        .map_err(|e| anyhow::anyhow!("Failed to create cipher: {e}"))?;

    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
    let ciphertext = cipher
        .encrypt(&nonce, plaintext)
        .map_err(|e| anyhow::anyhow!("Encryption failed: {e}"))?;

    // Prepend nonce to ciphertext
    let mut result = nonce.to_vec();
    result.extend_from_slice(&ciphertext);
    Ok(result)
}

/// Decrypts data produced by `encrypt()`.
pub fn decrypt(data: &[u8]) -> anyhow::Result<Vec<u8>> {
    if data.len() < 12 {
        anyhow::bail!("Encrypted data too short");
    }

    let key = get_or_create_key()?;
    let cipher = Aes256Gcm::new_from_slice(&key)
        .map_err(|e| anyhow::anyhow!("Failed to create cipher: {e}"))?;

    let nonce = Nonce::from_slice(&data[..12]);

View on GitHub (pinned to a3768d0e82)

Solutions

1. Verify the plaintext being stored is a real credentials JSON of sane size
2. Report a bug if the payload is a normal credential file

When it happens

Trigger: Passing a multi-gigabyte 'credential' payload into the credential store; memory exhaustion. Ordinary credential files never trigger it.

Common situations: Accidentally pointing the credential store at a huge file during custom tooling; otherwise not observed in the wild.

Related errors

• Failed to create cipher: {e}
• Encrypted data too short
• Decryption failed. Credentials may have been created on a di
• Failed to serialize seed payload for idempotency key: {e}

AI-assisted analysis of googleworkspace/cli@a3768d0e82 (2026-08-16). Data as JSON: /api/errors/83a51ad140128c3c. Report an issue: GitHub.