juicedata/juicefs · error

Decrypt: %s

Error message

Decrypt: %s

What it means

EncryptedObjectStorage.Get downloads the whole object and hands it to the underlying encryptor's Decrypt. Any decryption failure — bad header, corrupted bytes, wrong key — is wrapped as 'Decrypt: %s' before returning to the VFS layer.

Source

Thrown at pkg/object/encrypt.go:338

}

func (e *encrypted) String() string {
	return fmt.Sprintf("%s(encrypted)", e.ObjectStorage)
}

func (e *encrypted) Get(ctx context.Context, key string, off, limit int64, getters ...AttrGetter) (io.ReadCloser, error) {
	r, err := e.ObjectStorage.Get(ctx, key, 0, -1, getters...)
	if err != nil {
		return nil, err
	}
	defer r.Close()
	ciphertext, err := io.ReadAll(r)
	if err != nil {
		return nil, err
	}
	plain, err := e.enc.Decrypt(ciphertext)
	if err != nil {
		return nil, fmt.Errorf("Decrypt: %s", err)
	}
	l := int64(len(plain))
	if off > l {
		off = l
	}
	if limit == -1 || off+limit > l {
		limit = l - off
	}
	data := plain[off : off+limit]
	return io.NopCloser(bytes.NewBuffer(data)), nil
}

func (e *encrypted) Put(ctx context.Context, key string, in io.Reader, getters ...AttrGetter) error {
	plain, err := io.ReadAll(in)
	if err != nil {
		return err
	}
	ciphertext, err := e.enc.Encrypt(plain)

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Mount with the original RSA private key used when the volume was formatted (encrypt-keys option)
2. Inspect the wrapped error text: 'less than 3' or 'malformed ciphertext' indicate corrupt objects — restore from backup/sync source
3. Re-sync data from a healthy source with juicefs sync using identical encryption settings
4. If the volume was formatted without encryption but read with one (or vice versa), align mount config with format config

Example fix

// before
juicefs mount --encrypt-key /keys/newkey.pem redis://host db /mnt
// after: use the original format-time key
juicefs mount --encrypt-key /keys/original-priv.pem redis://host db /mnt

// compare format metadata vs mount config
// juicefs config META-URL | grep encrypt  — ensure key/algo match before Get

data, err := encStore.Get(ctx, key, off, size)
if err != nil && strings.HasPrefix(err.Error(), "Decrypt:") {
	// wrong key or corrupt object: remount with original key / restore object
}

When it happens

Trigger: Calling Get on an encrypted object when the ciphertext fails dataEncryptor.Decrypt: wrong RSA private key configured, corrupted/truncated object, or object written without encryption.

Common situations: Volume re-mounted with a different encrypt key than the one used at format time; object store contents restored partially from backup; mixing encrypted and unencrypted data in one bucket.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• received encrypted text length is less than 3, the object is
• Decrypt: truncated chunk header
• Decrypt: chunk data truncated: need %d, have %d
• Decrypt: %s
• first key should be test, but got %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/3d92cd1b44ae47b2. Report an issue: GitHub.