larksuite/cli · error

keychain is corrupted

Error message

keychain is corrupted

What it means

getMasterKey read the on-disk master.key file for the file-system keychain backend successfully, but its length is not exactly masterKeyBytes (only a length check applies to raw file storage). Like the Darwin twin it is a corruption sentinel: key material exists but cannot be trusted for encryption.

Source

Thrown at internal/keychain/keychain_other.go:64

// safeFileName sanitizes an account name to be used as a safe file name.
func safeFileName(account string) string {
	return safeFileNameRe.ReplaceAllString(account, "_") + ".enc"
}

// getMasterKey retrieves the master key from the file system.
// If allowCreate is true, it generates and stores a new master key if one doesn't exist.
func getMasterKey(service string, allowCreate bool) ([]byte, error) {
	dir := StorageDir(service)
	keyPath := filepath.Join(dir, "master.key")

	key, err := vfs.ReadFile(keyPath)
	if err == nil && len(key) == masterKeyBytes {
		return key, nil
	}
	if err == nil && len(key) != masterKeyBytes {
		// Key file exists but is corrupted
		return nil, errors.New("keychain is corrupted")
	}
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		// Real I/O error (permission denied, etc.) - propagate it
		return nil, err
	}

	if !allowCreate {
		return nil, errNotInitialized
	}

	if err := vfs.MkdirAll(dir, 0700); err != nil {
		return nil, err
	}

	key = make([]byte, masterKeyBytes)
	if _, err := rand.Read(key); err != nil {
		return nil, err
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Remove the stale master.key file under the service storage dir and let the CLI regenerate it on next use (stored encrypted data becomes unreadable and must be re-entered)

When it happens

Trigger: Thrown at internal/keychain/keychain_other.go:64 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/50ed5eecfb1846e8. Report an issue: GitHub.