I deployed an initial version of a Ruby on Rails app to Heroku. That version used credentials.yml.enc and master.key and only contained development secrets. Then I created production.yml.enc and production.key containing production secrets.
But when I try to deploy that commit, the build fails with ActiveSupport::MessageEncryptor::InvalidMessage. I suppose it’s because the RAILS_MASTER_KEY in Heroku config vars needs to be updated with the value of production.key.
But when I set RAILS_MASTER_KEY it doesn’t persist, it just goes back to the old value, because the release command also fails with ActiveSupport::MessageEncryptor::InvalidMessage, because the new value doesn’t decrypt the old credentials.yml.enc.
How can I update the RAILS_MASTER_KEY in Heroku given this egg-or-chicken situation?
The way I worked around this was: I deleted all the credential files, created a commit and deployed it. This way the app doesn’t require RAILS_MASTER_KEY to be set. You have to make sure your app can boot without the credentials, at least in this commit. Then I updated RAILS_MASTER_KEY with the production key, reverted the commit to restore the credential files and deployed again. It worked.
Alternatively, I think it would also have worked if I deleted the release: step from the Procfile, commited that, updated RAILS_MASTER_KEY with the production key, reverted the commit to restore the release: step and deployed again.