kopia/kopia · error

unable to decrypt local index

Error message

unable to decrypt local index

What it means

Wrapper in attemptReadPackFileLocalIndex: decrypting the extracted local-index section failed (wrong key, corrupt ciphertext, or tampered pack), so the optimized local-index read cannot produce usable index data.

Solutions

1. Verify the repository password is correct for this repository.
2. Check storage integrity; restore affected blobs from backup if corrupt.

When it happens

Trigger: Thrown at repo/content/committed_read_manager.go:205 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/bbe7d94b907dd348. Report an issue: GitHub.

Appendix: source

Thrown at repo/content/committed_read_manager.go:205

	}

	postamble.localIndexOffset -= uint32(offset) //nolint:gosec

	//nolint:gosec
	if uint64(postamble.localIndexOffset+postamble.localIndexLength) > uint64(payload.Length()) {
		// invalid offset/length
		return errors.Errorf("unable to find valid local index in file %v - invalid offset/length", packFile)
	}

	var encryptedLocalIndexBytes gather.WriteBuffer
	defer encryptedLocalIndexBytes.Close()

	if err := payload.AppendSectionTo(&encryptedLocalIndexBytes, int(postamble.localIndexOffset), int(postamble.localIndexLength)); err != nil {
		// should never happen
		return errors.Wrap(err, "error appending to local index bytes")
	}

	return errors.Wrap(
		sm.decryptAndVerify(encryptedLocalIndexBytes.Bytes(), postamble.localIndexIV, output),
		"unable to decrypt local index")
}

// +checklocks:sm.indexesLock
func (sm *SharedManager) loadPackIndexesLocked(ctx context.Context) error {
	ctx0 := contentlog.WithParams(ctx,
		logparam.String("span:loadindex", contentlog.RandomSpanID()))

	nextSleepTime := 100 * time.Millisecond //nolint:mnd

	for i := range indexLoadAttempts {
		ctx := contentlog.WithParams(ctx0,
			logparam.Int("loadAttempt", i))

		ibm, err0 := sm.indexBlobManager(ctx)
		if err0 != nil {
			return err0

View on GitHub (pinned to 82495e54b5)