decrypt: encrypted: decryption failed

The prefix depends on the command, e.g. "signing artifact.txt: reading key: decrypt: …" for `sign-blob`. An empty `COSIGN_PASSWORD` is used as the password, not as "ask me".

What it means

cosign private keys (`cosign.key`, label `ENCRYPTED SIGSTORE PRIVATE KEY`) are encrypted with a password via scrypt and secretbox. cosign read the password from `COSIGN_PASSWORD` or the prompt, and decryption failed — the password is not the one used when the key was generated. The key file itself is intact; nothing was signed.

Why it happens

• COSIGN_PASSWORD holds another secret

  common

  Several signing keys with different passwords, or a secret renamed in CI while the key secret stayed the same.

• COSIGN_PASSWORD is set but empty

  common

  CI systems expand missing secrets to an empty string (for example on pull requests from forks). cosign then tries the empty password instead of prompting.

• The key was regenerated with a new password

  occasional

  `cosign generate-key-pair` run again overwrote the key while the stored password belongs to the previous one.

How to fix it

1. 1.

   Supply key and password from the same source

   Store both as secrets of the same environment and pass the key via `env://` so they cannot drift apart.

   # GitHub Actions: key and its password from the same secret store
   - name: Sign
     env:
       COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
       COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
     run: cosign sign-blob --yes --key env://COSIGN_KEY --bundle dist/app.sigstore.json dist/app.tar.gz

2. 2.

   Consider keyless signing in CI

   With an OIDC identity (GitHub Actions `id-token: write`) there is no long-lived key or password to manage; verifiers pin the workflow identity instead.

   # Or drop the long-lived key: keyless signing with the workflow's OIDC identity
   permissions:
     id-token: write
   steps:
     - run: cosign sign-blob --yes --bundle dist/app.sigstore.json dist/app.tar.gz

← Browse the full signature error database