semaphoreui/semaphore · error

unsupported secret storage type

Error message

unsupported secret storage type '%s'

What it means

getDeserializer only supports env, file, and vault as access key secret source storage types. Any other SourceStorageType value hits the default branch and yields this error, refusing to build a deserializer for an unknown storage backend.

Solutions

1. Fix the access key's SourceStorageType to a supported value (env, file, or vault).
2. Align Semaphore versions so the key's storage type is known to this build (upgrade or re-create the key from a compatible version).
3. Audit keys created via API/imports to ensure only valid storage type constants are written.

Example fix

// before
key.SourceStorageType = &weirdType // "database"
// after
vaultType := db.AccessKeySourceStorageVault
key.SourceStorageType = &vaultType

switch *key.SourceStorageType {
case db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile, db.AccessKeySourceStorageVault:
    // ok
default:
    return fmt.Errorf("storage type %q not supported", *key.SourceStorageType)
}

func knownStorageType(t *db.AccessKeySourceStorageType) bool {
    if t == nil { return true }
    switch *t {
    case db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile, db.AccessKeySourceStorageVault:
        return true
    }
    return false
}

if err := svc.DeserializeSecret(&key); err != nil {
    if strings.Contains(err.Error(), "unsupported secret storage type") {
        return fmt.Errorf("key %q uses a storage type unknown to this build; recreate it", key.Name)
    }
    return err
}

When it happens

Trigger: SerializeSecret/DeserializeSecret/DeleteSecret on an access key whose *key.SourceStorageType is not one of db.AccessKeySourceStorageEnv, AccessKeySourceStorageFile, or AccessKeySourceStorageVault.

Common situations: Corrupted or hand-edited database rows; keys created by a newer Semaphore version with a storage type this build doesn't know; API clients posting invalid SourceStorageType values.

Related errors

• cannot modify secret in read-only storage
• access key expired
• vault storage id is required
• secret does not belong to this environment
• name can not be empty

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/4ef79cbe987618ca. Report an issue: GitHub.

Appendix: source

Thrown at services/server/access_key_encryption_svc.go:93

	secretStorageRepo db.SecretStorageRepository
	projectRepo       db.ProjectStore
}

func (s *accessKeyEncryptionServiceImpl) getDeserializer(key *db.AccessKey) (AccessKeyDeserializer, bool, error) {

	if key.SourceStorageType == nil {
		return &LocalAccessKeyDeserializer{}, false, nil
	}

	switch *key.SourceStorageType {
	case db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile:
		return &LocalAccessKeyDeserializer{}, true, nil
	case db.AccessKeySourceStorageVault:
		if key.SourceStorageID == nil {
			return &LocalAccessKeyDeserializer{}, false, errors.New("vault storage id is required")
		}
	default:
		return nil, false, fmt.Errorf("unsupported secret storage type '%s'", *key.SourceStorageType)
	}

	storage, err := s.secretStorageRepo.GetSecretStorage(*key.ProjectID, *key.SourceStorageID)
	if err != nil {
		return nil, false, err
	}

	switch storage.Type {
	case db.SecretStorageTypeVault, db.SecretStorageTypeOpenBao:
		return pro.NewVaultAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil
	case db.SecretStorageTypeDvls:
		return pro.NewDvlsAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil
	case db.SecretStorageTypeAwsSm:
		return pro.NewAwsSmAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil
	case db.SecretStorageTypeAzureKv:
		return pro.NewAzureKvAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil
	}

View on GitHub (pinned to 1774ccb71a)