siyuan-note/siyuan · error

encrypt notebook metadata failed: %w

Error message

encrypt notebook metadata failed: %w

What it means

Returned by CreateEncryptedBox when encryptBoxMetadata fails during notebook creation. encryptBoxMetadata encrypts the notebook's .syconf metadata using the freshly derived DEK; failure indicates a low-level AEAD/key-derivation error rather than a user-input problem. The %w wraps the underlying crypto error for diagnosis.

Source

Thrown at kernel/model/crypto.go:2577

	createdBoxID := id
	defer func() {
		if err != nil {
			cleanupFailedEncryptedBox(createdBoxID)
			id = ""
		}
	}()

	enc, dek, err := WrapNewDEK(id, kek)
	if err != nil {
		return "", err
	}

	box := &Box{ID: id}
	boxConf := box.GetConf()
	boxConf.Encrypted = true
	boxConf.BoxCrypt = enc
	if err = encryptBoxMetadata(id, boxConf, dek); err != nil {
		return "", fmt.Errorf("encrypt notebook metadata failed: %w", err)
	}
	if err = box.SaveConf(boxConf); err != nil {
		return "", fmt.Errorf("save encrypted notebook conf failed: %w", err)
	}
	if err = writeNotebookCryptBackup(id, enc); err != nil {
		return "", fmt.Errorf("write notebook crypt backup failed: %w", err)
	}
	// 回读校验加密配置已落盘，避免写失败后按普通笔记本处理
	verifyConf := box.GetConf()
	if verifyConf == nil || !verifyConf.Encrypted || verifyConf.BoxCrypt == nil {
		err = errors.New("encrypted notebook metadata verification failed after write")
		return "", err
	}
	markRuntimeEncryptedBox(id)
	invalidateEncryptedPublishAccessCache()

	// 复用刚派生的 DEK 直接开 db + 缓存，省去再次 Argon2id 解锁
	cachedDEKsLock.Lock()

View on GitHub (pinned to 251596fc0d)

Solutions

1. Inspect the wrapped error (the %w chain) to find the root cause — log or print err with fmt.Printf("%+v", err).
2. Verify the DEK returned by WrapNewDEK is non-nil and has the expected length before passing to encryptBoxMetadata.
3. Update or rebuild the kernel to ensure util.DeriveSubKey and util.EncryptWithAAD are the current implementations.

id, err := model.CreateEncryptedBox(name, password)
if err != nil {
    if strings.Contains(err.Error(), "encrypt notebook metadata failed") {
        // low-level crypto failure — log full chain and report
        logging.LogErrorf("encryptBoxMetadata failed: %+v", err)
    }
    return err
}

When it happens

Trigger: util.DeriveSubKey or util.EncryptWithAAD fails inside encryptBoxMetadata — typically due to an invalid DEK length, an exhausted or unavailable crypto primitive, or an internal assertion in the encryption utility.

Common situations: Extremely rare in production. Could indicate a corrupted Argon2id/DEK derivation pipeline, a Go crypto library version incompatibility, or a hardware/entropy issue on the host.

Related errors

• Encrypted notebook feature is not enabled
• save encrypted notebook conf failed: %w
• write notebook crypt backup failed: %w
• encrypted notebook metadata verification failed after write
• initialize encrypted notebook document failed: %w

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/5d2e1dff8e796284. Report an issue: GitHub.