pulumi/pulumi · error

encryptedlog: decompressing chunk: %w

Error message

encryptedlog: decompressing chunk: %w

What it means

A chunk decrypted successfully but its plaintext is not a valid gzip stream. The writer gzip-compresses each chunk before encrypting, so any decrypted payload must start with a gzip header; failure here indicates the payload came from an incompatible producer or is corrupt.

Source

Thrown at pkg/engine/encryptedlog/reader.go:162

	nonce := payload[:nonceSize]
	ciphertext := payload[nonceSize:]

	// Verify the nonce matches the expected counter.
	cd.counter++
	expected := makeNonce(cd.counter)
	if !bytes.Equal(nonce, expected[:]) {
		return 0, errors.New("encryptedlog: nonce counter mismatch")
	}

	compressed, err := cd.aesgcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return 0, fmt.Errorf("encryptedlog: chunk decryption failed: %w", err)
	}

	gz, err := gzip.NewReader(bytes.NewReader(compressed))
	if err != nil {
		return 0, fmt.Errorf("encryptedlog: decompressing chunk: %w", err)
	}
	plaintext, err := io.ReadAll(gz)
	if err != nil {
		return 0, fmt.Errorf("encryptedlog: decompressing chunk: %w", err)
	}
	if err := gz.Close(); err != nil {
		return 0, fmt.Errorf("encryptedlog: decompressing chunk: %w", err)
	}

	n := copy(p, plaintext)
	cd.buf = plaintext[n:]
	return n, nil
}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Confirm the producer of the file uses the same PLOG format version (check Version byte and writer implementation)
2. Regenerate or re-acquire the log file from the source process
3. Compare against a known-good log produced by the same CLI version
4. File a bug with the file's producer if the format differs

n, err := reader.Read(buf)
if err != nil {
	if strings.Contains(err.Error(), "decompressing chunk") {
		// format/producer mismatch: stop and verify producer version
	}
}

When it happens

Trigger: Reader.Read calls gzip.NewReader on the decrypted bytes of a chunk and the gzip header is invalid — wrong writer version/producer, or corrupted-but-authenticated data.

Common situations: Reading a PLOG-like file written by a tool that skips gzip compression; a future/other version changing chunk framing; corruption that coincidentally passes GCM (effectively impossible without the key).

Related errors

• failed to create gzip reader: %w
• encryptedlog: reading chunk data: %w
• encryptedlog: chunk payload too small (%d bytes, need at lea
• encryptedlog: nonce counter mismatch
• encryptedlog: chunk decryption failed: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/f7a969572f3b23cc. Report an issue: GitHub.