semaphoreui/semaphore · error

encryption_keys.active.%s_key: no key labelled

Error message

encryption_keys.active.%s_key: no key labelled %q

What it means

resolveActiveKey returns this error when encryption_keys.active.<kind>_key names a label that is not present in the loaded key registry (inline keys map or keys_folder files). The active pointer references a key that was never defined.

Solutions

1. Make the active label match an existing key: add `encryption_keys.keys.<label>` or a file with that name in keys_folder
2. List available labels (inline keys map + filenames in keys_folder) and fix the typo in active.<kind>_key
3. If you meant a file, set active.<kind>_file instead of _key
4. Clear the active pointer to fall back to the legacy flat key fields

Example fix

# before
encryption_keys:
  active:
    secret_key: "prod-1"
  keys:
    production: {value: "k1"}
# after
encryption_keys:
  active:
    secret_key: "production"
  keys:
    production: {value: "k1"}

if cfg.Encryption != nil && cfg.Encryption.Active.SecretKey != "" {
    if _, ok := cfg.Encryption.Keys[cfg.Encryption.Active.SecretKey]; !ok {
        return fmt.Errorf("active.secret_key %q has no matching keys entry",
            cfg.Encryption.Active.SecretKey)
    }
}

func labelLoaded(label string, byLabel map[string]string) bool {
    _, ok := byLabel[label]
    return ok
}

material, err := resolveActiveKey(enc, flat, byLabel, addLabeled, ptr, "access")
if err != nil {
    return nil, fmt.Errorf("encryption setup failed: %w", err)
}

When it happens

Trigger: `encryption_keys.active.secret_key: "prod1"` with no `keys.prod1` entry and no file named prod1 in keys_folder; renaming a key label without updating the active pointer; keys_folder failing to load (so its labels are absent).

Common situations: Renamed key entries in config; K8s mounted folder where files got renamed; typos in the active label; upgrading to the new encryption_keys schema with stale active values.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• : 'value' and 'file' are mutually exclusive
• : read key file
• encryption_keys.active.%s_key_file
• encryption_keys.keys_folder
• value of field ' ' is not valid: (Must match regex: ' ')

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/8ff653e18085c43f. Report an issue: GitHub.

Appendix: source

Thrown at util/config.go:1543

	if enc == nil {
		return [2]string{}
	}
	l, f := pick(enc.Active)
	return [2]string{l, f}
}

// resolveActiveKey resolves the active key material for one purpose: an active
// label wins, then an active filename (in KeysFolder, relative), then the flat
// fallback. A filename not already loaded from the folder is read and registered.
func resolveActiveKey(enc *EncryptionKeysConfig, flat string, byLabel map[string]string,
	addLabeled func(string, string) error, ptr [2]string, kind string) (string, error) {

	label, file := ptr[0], ptr[1]

	if label != "" {
		material, ok := byLabel[label]
		if !ok {
			return "", fmt.Errorf("encryption_keys.active.%s_key: no key labelled %q", kind, label)
		}
		return material, nil
	}

	if file != "" {
		if material, ok := byLabel[file]; ok {
			return material, nil
		}
		path := file
		if !filepath.IsAbs(path) && enc != nil {
			path = filepath.Join(enc.KeysFolder, file)
		}
		data, err := os.ReadFile(path)
		if err != nil {
			return "", fmt.Errorf("encryption_keys.active.%s_key_file: %w", kind, err)
		}
		material := strings.TrimSpace(string(data))
		if err := addLabeled(file, material); err != nil {

View on GitHub (pinned to 1774ccb71a)