[Bug]: Error setting encryption metadata

[tigernero79]

⚠️ Before submitting, please verify the following: ⚠️

• This is a bug, not a question or a configuration issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server and Desktop Client are up to date. See Server Maintenance and Release Schedule and Desktop Releases for supported versions.
• I agree to follow Nextcloud's Code of Conduct

Bug description

I tried everything but after resetting e2e, after deleting every e2e folder every local cache and config file and reinstalling nextcloud when I try to sync an e2e folder with nextcloud desktop 4.0.6 I get an error Error setting encryption metadata

how do I fix it I'm going crazy

with iOS and Android mobile apps no problem

I attach a screenshot of the error

#9502 (comment)

Steps to reproduce

After regenerating the 12 words for end-to-end encryption, only the desktop application generates this metadata error. I tried deleting any cache or configuration files, but nothing. Only on Windows, a deep clean solved the problem, but not on Mac and Linux. Where does it save the old application metadata? I'm going crazy.

Expected behavior

I expect the app to read the new good metadata

Which files are affected by this bug

All file e2e

Operating system

Linux

Which version of the operating system you are running.

Linux Mint 23

Package

Official Linux AppImage

Nextcloud Server version

33.0.0

Nextcloud Desktop Client version

4.0.6

Is this bug present after an update or on a fresh install?

Fresh desktop client install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

Are you using an external user-backend?

• Default internal user-backend
• LDAP/ Active Directory
• SSO - SAML
• Other

Nextcloud Server logs

Additional info

No response

[tigernero79]

From what I understand after several tests, the problem is only in the desktop app. If I try to upload a file to the end-to-end encrypted folder from the iOS and Android app, the file is uploaded and read correctly by mobile devices, decrypting everything correctly. However, the desktop app generates a metadata error, even if I create a new encrypted folder. Is there a fix?

[tigernero79]

Unfortunately, the desktop application for Windows also generates the same problem.

[IamTheDenis]

I have a similar issue as well in Linux (Android works fine and apparently Windows does as well), but for me I get errors when syncing that the files stored in my e3e folder cannot be found. It started after upgrading to NC 33.0.0. Strangely enough, before I was running desktop version 3.12 (because I didn't have qt6 until today), and I still have the issue after upgrading to 4.0.6. I had to build it from source because the AppImage errors out on start, but I did satisfy all required packages, minus 4 optional packages, so I doubt that is the problem.

[IamTheDenis]

I wanted to update this with some more information. I was able to build from source using the latest commit on master (bc54b23) and I setup a new encrypted folder after resetting end-to-end encryption on the NC server. After doing so creating a new encrypted folder worked fine. However once I tried to add a single file (even an empty file) I got an error in my client stating that "filename: failed to upload encrypted file." I did not get any errors on the server side, which is really weird, but I did get a lot of output in the desktop client logs.

2026-02-25 14:20:14:169 [ info nextcloud.sync.discovery /usr/src/libsync/discovery.cpp:79 ]:        STARTING "Classified" OCC::ProcessDirectoryJob::ParentNotChanged "Classified" OCC::ProcessDirectoryJob::NormalQuery
2026-02-25 14:20:14:169 [ info nextcloud.sync.discovery /usr/src/libsync/discovery.cpp:1891 ]:      Processing "Classified/emptyfile" | (db/local/remote) | valid: false/true/db | mtime: 0/1772049906/0 | size: 0/2/0 | etag: ""//"" | checksum: ""//"" | perm: ""//"" | fileid: ""//"" | inode: 0/111941140/ | type: CSyncEnums::ItemTypeSkip/CSyncEnums::ItemTypeFile/CSyncEnums::ItemTypeFile | e2ee: false/false | e2eeMangledName: ""/"" | file lock: not locked// | file lock type: ""//"" | live photo: false//false | metadata missing: /false/
2026-02-25 14:20:14:169 [ info nextcloud.sync.discovery /usr/src/libsync/discovery.cpp:1892 ]:      discovered "Classified/emptyfile" CSyncEnums::CSYNC_INSTRUCTION_NEW OCC::SyncFileItem::Up CSyncEnums::ItemTypeFile
2026-02-25 14:20:14:466 [ info nextcloud.sync.networkjob /usr/src/libsync/abstractnetworkjob.cpp:382 ]:     OCC::LsColJob created for "https://nextcloud.mydomain.org" + "Classified" ""
2026-02-25 14:20:14:516 [ info nextcloud.sync.credentials.webflow /usr/src/gui/creds/webflowcredentials.cpp:411 ]:  request finished QUrl("https://nextcloud.mydomain.org/remote.php/dav/files/john/Classified") with request id "4279b053-be91-4878-a7cb-a14a8098ad42"
2026-02-25 14:20:14:516 [ info nextcloud.sync.networkjob.lscol /usr/src/libsync/networkjobs.cpp:537 ]:      LSCOL of QUrl("https://nextcloud.mydomain.org/remote.php/dav/files/john/Classified") FINISHED WITH STATUS "OK"
2026-02-25 14:20:14:516 [ info nextcloud.sync.accessmanager /usr/src/libsync/accessmanager.cpp:72 ]:        2 "" "https://nextcloud.mydomain.org/ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090752?format=json" has X-Request-ID "98f07853-3cee-4957-8f27-380d47fdcd4a"
2026-02-25 14:20:14:516 [ info nextcloud.sync.networkjob /usr/src/libsync/abstractnetworkjob.cpp:382 ]:     OCC::GetMetadataApiJob created for "https://nextcloud.mydomain.org" + "ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090752" ""
2026-02-25 14:20:14:567 [ info nextcloud.sync.credentials.webflow /usr/src/gui/creds/webflowcredentials.cpp:411 ]:  request finished QUrl("https://nextcloud.mydomain.org/ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090752?format=json") with request id "98f07853-3cee-4957-8f27-380d47fdcd4a"
2026-02-25 14:20:14:567 [ warning nextcloud.sync.clientsideencryption.metadata /usr/src/libsync/foldermetadata.cpp:118 ]:   Could not setup metadata. Incorrect version -1
2026-02-25 14:20:14:568 [ warning nextcloud.sync.clientsideencryption.metadata /usr/src/libsync/foldermetadata.cpp:107 ]:   Failed to setup FolderMetadata. Could not parse/create metadataKey!
2026-02-25 14:20:14:568 [ warning nextcloud.sync.propagator.encryptedfoldermetadatahandler /usr/src/libsync/encryptedfoldermetadatahandler.cpp:189 ]:       Error parsing or decrypting metadata for folder "Classified"
2026-02-25 14:20:14:568 [ warning nextcloud.sync.propagator.upload /usr/src/libsync/propagateupload.cpp:243 ]:      Error setting up encryption.
2026-02-25 14:20:14:568 [ warning nextcloud.sync.propagator /usr/src/libsync/owncloudpropagator.cpp:280 ]:  Could not complete propagation of "Classified/emptyfile" by OCC::PropagateUploadFileV1(0x55f9e29ee6c0) with status OCC::SyncFileItem::FatalError and error: "Failed to upload encrypted file."
2026-02-25 14:20:14:569 [ warning nextcloud.gui.activity /usr/src/gui/tray/usermodel.cpp:1155 ]:    Item  "Classified/emptyfile"  retrieved resulted in  "Failed to upload encrypted file."
2026-02-25 14:20:14:569 [ info nextcloud.gui.activity /usr/src/gui/tray/usermodel.cpp:1101 ]:       Item  "Classified/emptyfile"  retrieved resulted in error  "Failed to upload encrypted file."
2026-02-25 14:20:14:569 [ warning nextcloud.gui.activity /usr/src/gui/tray/activitylistmodel.cpp:611 ]:     Error successfully added to the notification list:  OCC::ActivityListModel::ErrorType::SyncError "Classified/emptyfile" "Failed to upload encrypted file." OCC::SyncResult::Undefined OCC::SyncFileItem::FatalError
2026-02-25 14:20:14:569 [ warning sync.localdiscoverytracker /usr/src/libsync/localdiscoverytracker.cpp:70 ]:       inserted error item "Classified/emptyfile"
2026-02-25 14:20:14:571 [ info nextcloud.sync.engine /usr/src/libsync/syncengine.cpp:938 ]: Sync run took  499 ms

As for the server side, while I didn't get any errors, I did find a lot going on in debug mode. I cleaned it up the best I could. I don't think anyone wants the entire debug file.

{"reqId":"qetF8aKWN1BeBUAzKkgO","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"--","app":"serverDI","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":{"app":"serverDI"}}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"serverDI","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":{"app":"serverDI"}}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"serverDI","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":{"app":"serverDI"}}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":1,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The app config key dav/enableCalendarFederation is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":[]}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":1,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The app config key files/watermark_enabled is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":[]}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"serverDI","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":{"app":"serverDI"}}
{"reqId":"qetF8aKWN1BeBUAzKkgO","level":1,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/john/Classified%202","scriptName":"/remote.php","message":"The app config key dav/sendInvitations is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"139c6dbc-ba82-422f-bb41-8fa3c531cff9","data":[]}
{"reqId":"Fpo7nWQu0c7cwmXaCXKg","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"1","user":"--","app":"serverDI","method":"GET","url":"/ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090762?format=json","scriptName":"/ocs/v2.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"0f7427a5-ce09-4917-8ea9-0a9b56849425","data":{"app":"serverDI"}}
{"reqId":"Fpo7nWQu0c7cwmXaCXKg","level":0,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"1","user":"john","app":"serverDI","method":"GET","url":"/ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090762?format=json","scriptName":"/ocs/v2.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"0f7427a5-ce09-4917-8ea9-0a9b56849425","data":{"app":"serverDI"}}
{"reqId":"Fpo7nWQu0c7cwmXaCXKg","level":1,"time":"2026-02-25T23:56:50+00:00","remoteAddr":"1","user":"john","app":"no app in context","method":"GET","url":"/ocs/v2.php/apps/end_to_end_encryption/api/v2/meta-data/4090762?format=json","scriptName":"/ocs/v2.php","message":"The app config key files/watermark_enabled is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"0f7427a5-ce09-4917-8ea9-0a9b56849425","data":[]}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":0,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"--","app":"serverDI","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":{"app":"serverDI"}}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":0,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"serverDI","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":{"app":"serverDI"}}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":0,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"serverDI","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The requested alias \"OCP\\IServerContainer\" is deprecated. Please request \"Psr\\Container\\ContainerInterface\" directly. This alias will be removed in a future Nextcloud version.","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":{"app":"serverDI"}}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":1,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":[]}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":1,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The app config key files/default_quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":[]}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":1,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The app config key files/allow_unlimited_quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":[]}
{"reqId":"ZCYWywKh0deKm8BBZl3D","level":1,"time":"2026-02-25T23:56:58+00:00","remoteAddr":"10.0.0.0","user":"john","app":"no app in context","method":"GET","url":"/ocs/v1.php/cloud/user?format=json","scriptName":"/ocs/v1.php","message":"The app config key files/watermark_enabled is not defined in the config lexicon","userAgent":"Mozilla/5.0 (Linux) mirall/33.0.50daily (Nextcloud, slackware-5.15.193 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"33.0.0.16","clientReqId":"a1081426-8fc8-41d5-8b6a-b138fbed2183","data":[]}

[litetex]

Same problem here after updating Nextcloud server to v33. A similar metadata error also occurs in the Android app, so I suspect that something was changed in the metadata API when using E2EE that now breaks clients except for the WebUI.