googleworkspace/cli · error

Failed to create cipher: {e}

Error message

Failed to create cipher: {e}

What it means

Defensive invariant check in encrypt(): Aes256Gcm::new_from_slice(&key) only fails when the slice is not exactly 32 bytes, and get_or_create_key() returns a [u8; 32]. In practice this branch is unreachable — it exists to convert a hypothetical future invariant violation (wrong key length) into a clear error instead of a panic. Hitting it indicates the key pipeline was bypassed or modified.

Source

Thrown at crates/google-workspace-cli/src/credential_store.rs:386

    let key = resolve_key(backend, &provider, &key_file)?;

    // Cache for subsequent calls within this process.
    if KEY.set(key).is_ok() {
        Ok(key)
    } else {
        Ok(*KEY
            .get()
            .expect("key must be initialized if OnceLock::set() failed"))
    }
}

/// Encrypts plaintext bytes using AES-256-GCM with a machine-derived key.
/// Returns nonce (12 bytes) || ciphertext.
pub fn encrypt(plaintext: &[u8]) -> anyhow::Result<Vec<u8>> {
    let key = get_or_create_key()?;
    let cipher = Aes256Gcm::new_from_slice(&key)
        .map_err(|e| anyhow::anyhow!("Failed to create cipher: {e}"))?;

    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
    let ciphertext = cipher
        .encrypt(&nonce, plaintext)
        .map_err(|e| anyhow::anyhow!("Encryption failed: {e}"))?;

    // Prepend nonce to ciphertext
    let mut result = nonce.to_vec();
    result.extend_from_slice(&ciphertext);
    Ok(result)
}

/// Decrypts data produced by `encrypt()`.
pub fn decrypt(data: &[u8]) -> anyhow::Result<Vec<u8>> {
    if data.len() < 12 {
        anyhow::bail!("Encrypted data too short");
    }

View on GitHub (pinned to a3768d0e82)

Solutions

1. If you are building from source, verify the key is still obtained via get_or_create_key() and is exactly 32 bytes
2. Report a bug with reproduction steps — this indicates an internal invariant break

When it happens

Trigger: Code changes that source the key from somewhere other than get_or_create_key(); a refactor that alters the key type; memory corruption. No normal runtime input reaches it.

Common situations: Contributors forking the credential store and introducing a variable-length key; essentially never seen by end users.

Related errors

• Encryption failed: {e}
• Encrypted data too short
• Decryption failed. Credentials may have been created on a di
• Failed to serialize seed payload for idempotency key: {e}

AI-assisted analysis of googleworkspace/cli@a3768d0e82 (2026-08-16). Data as JSON: /api/errors/ca4a740a9481837d. Report an issue: GitHub.