siyuan-note/siyuan · error

invalid encrypted notebook metadata envelope: %w

Error message

invalid encrypted notebook metadata envelope: %w

What it means

Thrown by validateBoxEncryption when util.EncryptionNonce(enc.Metadata) fails. This validates the Metadata ciphertext (which stores the box's icon/sort/sortMode encrypted under a DEK-derived sub-key) against the SENC binary envelope format. It runs after validateWrappedDEKEnvelope passes, so the key envelope is valid but the metadata envelope is not.

Source

Thrown at kernel/model/crypto.go:1632

	if enc.CreatedAt <= 0 {
		return errors.New("encrypted notebook key envelope creation time is missing")
	}
	nonce, err := util.EncryptionNonce(enc.WrappedDEK)
	if err != nil {
		return fmt.Errorf("invalid encrypted notebook key envelope: %w", err)
	}
	if !bytes.Equal(nonce, enc.WrapNonce) {
		return errors.New("encrypted notebook key envelope nonce mismatch")
	}
	return nil
}

func validateBoxEncryption(enc *conf.BoxEncryption) error {
	if err := validateWrappedDEKEnvelope(enc); err != nil {
		return err
	}
	if _, err := util.EncryptionNonce(enc.Metadata); err != nil {
		return fmt.Errorf("invalid encrypted notebook metadata envelope: %w", err)
	}
	return nil
}

// mustEncryptionNonce 从刚刚成功生成的密文中提取 nonce。生成密文格式错误属于内部不变量被破坏，直接终止执行。
func mustEncryptionNonce(ciphertext []byte) []byte {
	nonce, err := util.EncryptionNonce(ciphertext)
	if err != nil {
		panic("extract encryption nonce failed: " + err.Error())
	}
	return nonce
}

// GetDEK 取已缓存的 DEK。返回副本，避免外部零化影响缓存。
// filesys/assets/db 加解密时调用。
func GetDEK(boxID string) ([]byte, error) {
	if !ast.IsNodeIDPattern(boxID) {
		return nil, errors.New("invalid notebook ID")

View on GitHub (pinned to 251596fc0d)

Solutions

1. Restore conf.json from a backup with a valid Metadata envelope.
2. Restore the per-notebook crypt backup if its Metadata is valid.
3. Inspect the %w error to pinpoint the defect: 'invalid magic' means wrong format entirely; 'too short' means truncation.
4. If only Metadata is corrupt and the WrappedDEK is fine, the document data is still recoverable — the metadata (icon, sort, sortMode) can be regenerated after restoring a known-good conf.

// Pre-validate the Metadata envelope format:
if _, err := util.EncryptionNonce(boxCrypt.Metadata); err != nil {
    // Metadata is not a valid SENC envelope — restore from backup
}

When it happens

Trigger: Reached from validateBoxEncryption, which is called during box encryption setup/validation paths. Fires when the Metadata field is empty-but-not-nil, truncated, missing the SENC magic header, or has an invalid envelope structure. The wrapped %w carries the specific parse error.

Common situations: Metadata field was corrupted during a partial conf.json write. A sync conflict overwrote Metadata with a non-envelope value. An older version of the encryption code wrote Metadata in a different format. Manual editing of conf.json corrupted the Metadata bytes.

Related errors

• invalid encrypted notebook key envelope: %w
• path belongs to encrypted notebook [%s]: %s
• unsupported encrypted notebook key envelope
• encrypted notebook key envelope creation time is missing
• encrypted notebook key envelope nonce mismatch

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/cb9a1c255b1f2ec8. Report an issue: GitHub.