juicedata/juicefs · error

create %sor: %w

Error message

create %sor: %w

What it means

After loading the RSA private key, wrapSyncEncryptedStore builds the encryptor with object.NewDataEncryptor(object.NewKeyEncryptor(privKey), algo), where algo comes from the --encrypt-algo flag. This error wraps failure to construct that encryptor — almost always an unsupported/misspelled algorithm name (e.g. 'chacha20' instead of 'aes256').

Source

Thrown at cmd/sync.go:510

	return regexp.MustCompile(pattern).MatchString(endpoint)
}

func wrapSyncEncryptedStore(store object.ObjectStorage, keyPath, passphraseEnv, mode, algo string) (object.ObjectStorage, error) {
	if keyPath == "" {
		return store, nil
	}

	privKey, err := object.ParseRsaPrivateKeyFromPath(keyPath, os.Getenv(passphraseEnv))
	if err != nil {
		if errors.Is(err, object.ErrKeyNeedPasswd) {
			logger.Fatalf("%s key is password protected, please set %s environment variable", mode, passphraseEnv)
		}
		return nil, fmt.Errorf("load %s key: %w", mode, err)
	}

	encryptor, err := object.NewDataEncryptor(object.NewKeyEncryptor(privKey), algo)
	if err != nil {
		return nil, fmt.Errorf("create %sor: %w", mode, err)
	}

	return object.NewChunkedEncrypted(store, encryptor), nil
}

func loadClusterWorkerConfig(r io.Reader) (string, string, error) {
	src, dst, env, err := sync.ReadClusterWorkerConfig(r)
	if err != nil {
		return "", "", err
	}
	for key, value := range env {
		if err := os.Setenv(key, value); err != nil {
			return "", "", fmt.Errorf("set worker environment %q: %s", key, err)
		}
	}
	return src, dst, nil
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Use a supported --encrypt-algo value (check `juicefs sync --help`; e.g. aes256)
2. Fix the spelling/case of the algorithm name
3. Ensure all sync nodes run a JuiceFS version supporting the chosen algorithm; upgrade if needed
4. Omit --encrypt-algo to use the default algorithm

Example fix

// before
juicefs sync --encrypt-rsa-key key.pem --encrypt-algo des3 src dst
// create encryptor: ... invalid algorithm
// after
juicefs sync --encrypt-rsa-key key.pem --encrypt-algo aes256 src dst

allowed := map[string]bool{"aes256": true, "chacha20": true}
algo := ctx.String("encrypt-algo")
if algo != "" && !allowed[strings.ToLower(algo)] {
	return fmt.Errorf("unsupported --encrypt-algo %q", algo)
}

null

if err != nil {
	if strings.Contains(err.Error(), "create ") && strings.Contains(err.Error(), "or:") {
		// encryptor construction failed; check --encrypt-algo value
	}
	return err
}

When it happens

Trigger: doSync invoked with --encrypt-rsa-key plus an --encrypt-algo value that object.NewDataEncryptor does not recognize (currently only aes256/chacha20-style registered algorithms); the wrapped inner error from NewDataEncryptor names the invalid algorithm.

Common situations: Typo in --encrypt-algo; copying an algorithm name from another tool; older client version that predates a newer algorithm (version mismatch between sync nodes); case sensitivity issues ('AES256' vs 'aes256').

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• load %s key: %w
• format decrypt: %s
• %w: please set the 'JFS_RSA_PASSPHRASE' environment variable
• skip special file %s for jfs: %w
• unescape %s: %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/aebbff2da7a24689. Report an issue: GitHub.