What causes "invalid encrypted notebook metadata envelope: %w" in siyuan-note/siyuan?

Check the wrapped %w cause for specifics (empty vs malformed payload)

invalid encrypted notebook metadata envelope

Error message

invalid encrypted notebook metadata envelope: %w

What it means

The notebook's metadata ciphertext (conf.BoxEncryption.Metadata) could not be parsed as a valid encrypted envelope by util.EncryptionNonce, so its nonce could not be extracted. The DEK envelope itself validated, but the encrypted notebook metadata blob is malformed.

Solutions

Check the wrapped %w cause for specifics (empty vs malformed payload)
Restore the notebook conf (or the Metadata field) from a backup taken while the notebook worked
Re-sync the workspace from a replica that has an intact conf
Do not bypass authentication or fall back to plaintext; derived indexes may only be rebuilt after the source ciphertext authenticates

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := util.EncryptionNonce(enc.Metadata); err != nil { return errors.New("metadata envelope malformed; restore conf backup") }

Try / catch

if err := openBox(boxID); err != nil { if strings.Contains(err.Error(), "invalid encrypted notebook metadata envelope") { /* restore Metadata/conf from backup; never fall back to plaintext */ } }

Prevention

Treat the box conf as a single atomic artifact when copying/restoring
Resolve sync conflicts in favor of the kernel-written conf
Validate envelope integrity after any third-party migration tooling

When it happens

Trigger: validateBoxEncryption calls util.EncryptionNonce(enc.Metadata) after the wrapped-DEK checks pass; Metadata is empty, truncated, or in an unknown format.

Common situations: Partial/corrupted write of the box conf; a third-party tool rewrote the conf and mangled the metadata field; copying fields between notebooks incorrectly.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of siyuan-note/siyuan@9f775e8a12 (2026-09-19). Data as JSON: /api/errors/cb9a1c255b1f2ec8. Report an issue: GitHub.

Appendix: source

Thrown at kernel/model/crypto.go:1657

	if enc.CreatedAt <= 0 {
		return errors.New("encrypted notebook key envelope creation time is missing")
	}
	nonce, err := util.EncryptionNonce(enc.WrappedDEK)
	if err != nil {
		return fmt.Errorf("invalid encrypted notebook key envelope: %w", err)
	}
	if !bytes.Equal(nonce, enc.WrapNonce) {
		return errors.New("encrypted notebook key envelope nonce mismatch")
	}
	return nil
}

func validateBoxEncryption(enc *conf.BoxEncryption) error {
	if err := validateWrappedDEKEnvelope(enc); err != nil {
		return err
	}
	if _, err := util.EncryptionNonce(enc.Metadata); err != nil {
		return fmt.Errorf("invalid encrypted notebook metadata envelope: %w", err)
	}
	return nil
}

// mustEncryptionNonce 从刚刚成功生成的密文中提取 nonce。生成密文格式错误属于内部不变量被破坏，直接终止执行。
func mustEncryptionNonce(ciphertext []byte) []byte {
	nonce, err := util.EncryptionNonce(ciphertext)
	if err != nil {
		panic("extract encryption nonce failed: " + err.Error())
	}
	return nonce
}

// GetDEK 取已缓存的 DEK。返回副本，避免外部零化影响缓存。
// filesys/assets/db 加解密时调用。
func GetDEK(boxID string) ([]byte, error) {
	if !ast.IsNodeIDPattern(boxID) {
		return nil, errors.New("invalid notebook ID")

View on GitHub (pinned to 9f775e8a12)