pulumi/pulumi · error

encryptedlog: chunk payload too small (%d bytes, need at lea

Error message

encryptedlog: chunk payload too small (%d bytes, need at least %d)

What it means

A chunk payload was read but is smaller than the minimum valid frame: a 12-byte GCM nonce plus the 16-byte GCM authentication tag overhead. Such a payload cannot contain both a nonce and authenticated ciphertext, so it is rejected as corrupt.

Source

Thrown at pkg/engine/encryptedlog/reader.go:142

		if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
			cd.done = true
			return 0, io.EOF
		}
		return 0, fmt.Errorf("encryptedlog: reading chunk length: %w", err)
	}
	payloadLen := binary.BigEndian.Uint32(lenBuf[:])
	if payloadLen > uint32(maxPayloadLen) {
		return 0, fmt.Errorf(
			"encryptedlog: chunk payload too large (%d bytes)", payloadLen)
	}

	payload := make([]byte, payloadLen)
	if _, err := io.ReadFull(cd.r, payload); err != nil {
		return 0, fmt.Errorf("encryptedlog: reading chunk data: %w", err)
	}
	minPayload := nonceSize + cd.aesgcm.Overhead()
	if len(payload) < minPayload {
		return 0, fmt.Errorf("encryptedlog: chunk payload too small (%d bytes, need at least %d)", len(payload), minPayload)
	}

	nonce := payload[:nonceSize]
	ciphertext := payload[nonceSize:]

	// Verify the nonce matches the expected counter.
	cd.counter++
	expected := makeNonce(cd.counter)
	if !bytes.Equal(nonce, expected[:]) {
		return 0, errors.New("encryptedlog: nonce counter mismatch")
	}

	compressed, err := cd.aesgcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return 0, fmt.Errorf("encryptedlog: chunk decryption failed: %w", err)
	}

	gz, err := gzip.NewReader(bytes.NewReader(compressed))

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Confirm the file is a genuine PLOG file produced by this writer version (magic/version already validated, so desync implies corruption)
2. Recover the log from a backup or regenerate it; a corrupted chunk stream cannot be re-synced
3. Check for tools or scripts that modified the log file in place
4. File a bug with the producer if you consistently see malformed chunks from a specific writer

// Reject obviously corrupt files up front
fi, err := os.Stat(plogPath)
if err != nil {
	return err
}
if fi.Size() == 0 {
	return errors.New("empty plog file")
}

n, err := reader.Read(buf)
if err != nil && strings.Contains(err.Error(), "chunk payload too small") {
	// stop reading: stream is corrupt from this chunk onward
}

When it happens

Trigger: Reader.Read encounters a chunk whose length prefix declares a payload smaller than nonceSize+aesgcm.Overhead() (28 bytes for AES-256-GCM) — i.e. a malformed or hand-edited PLOG stream.

Common situations: Corrupted or truncated log files where the length prefix was read from wrong bytes after a previous desync; manually constructed or tampered PLOG files; reading a file produced by an incompatible writer version.

Related errors

• shell extra root %q is not a directory
• decoding shell_execute args: %w
• shell_execute requires a non-empty command
• shell_execute timeout must be non-negative, got %g
• validating spec: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/f8779f1875596782. Report an issue: GitHub.