risingwavelabs/risingwave · error · SecretError

ser/de proto message error: {0}

Error message

ser/de proto message error: {0}

What it means

SecretError::ProtoError wraps bincode::Error (via #[from]) and is raised when serializing or deserializing a proto message with bincode fails in the secret handling path — e.g. converting secret payloads to/from bytes for storage or transport.

Source

Thrown at src/common/secret/src/error.rs:40

#[derive(Error, Debug, Construct)]
pub enum SecretError {
    #[error("secret not found: {0}")]
    ItemNotFound(SecretId),

    #[error("decode utf8 error: {0}")]
    DecodeUtf8Error(#[from] std::string::FromUtf8Error),

    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

    #[error("unspecified secret ref type: {0}")]
    UnspecifiedRefType(SecretId),

    #[error("failed to encrypt or decrypt the secret")]
    AesError,

    #[error("ser/de proto message error: {0}")]
    ProtoError(#[from] bincode::Error),

    #[error(transparent)]
    Internal(#[from] anyhow::Error),
}

View on GitHub (pinned to 6469eb736d)

Solutions

1. Ensure all components run the same RisingWave/proto version so the bincode layout matches.
2. Delete and re-create the corrupted secret entries.
3. Restore from a consistent backup taken with the same schema version.
4. Check the inner bincode::Error message for the exact offset/field that failed.

Example fix

// before
// reading secrets stored by an older RW version into a newer binary
risingwave (v2.5) --meta-store ... // ProtoError: bincode deserialization failed

// after
// run the migration/upgrade path with matching versions
risingwave (v2.5) --meta-store ... --upgrade-from v2.4

match manager.get(id).await {
    Ok(secret) => secret,
    Err(SecretError::ProtoError(e)) => {
        // bincode layout mismatch or corrupted payload; non-retryable.
        return Err(anyhow!("secret {id} payload unreadable ({e}); re-create the secret"));
    }
    Err(e) => return Err(e.into()),
}

When it happens

Trigger: Deserializing stored secret bytes that do not match the current bincode-encoded proto layout; serializing a proto message that bincode cannot encode; corrupted or hand-edited secret payloads in the backing store.

Common situations: RisingWave/proto schema version mismatch between writer and reader of stored secrets; truncated or corrupted secret records after a crash or bad migration; manually editing persisted meta state.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Related errors

• unspecified secret ref type: {0}
• secret not found: {0}
• decode utf8 error: {0}
• I/O error: {0}
• failed to encrypt or decrypt the secret

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/7c41ea111ff10d40. Report an issue: GitHub.