OpenNHP/opennhp · error

failed to create csv verifier

Error message

failed to create csv verifier: %v

What it means

After sniffing for "test_purpose", NewVerifier builds either a FallbackVerifier or a CoCo (csv) attestation verifier; this wraps any construction failure from either path. Note the fallback path's error is also mislabeled as "csv verifier" here.

Solutions

1. Read the wrapped inner error (%v chain) to see which constructor actually failed
2. If using test evidence, confirm the JSON has string-typed "test_purpose", "measure", and "serial_number" fields
3. For CoCo evidence, validate the attestation report structure against the current csv.NewAttestation expectations and check the attestation-agent version

Example fix

// before
if err != nil {
    return nil, fmt.Errorf("failed to create csv verifier: %v", err)
}
// after
if err != nil {
    return nil, fmt.Errorf("failed to create verifier (csv=%v, not test evidence): %w", evidence["test_purpose"] == nil, err)
}

var probe map[string]any
if err := json.Unmarshal(evidenceBytes, &probe); err != nil { return err }
isTest := probe["test_purpose"] != nil
if isTest {
    for _, k := range []string{"measure","serial_number"} {
        if _, ok := probe[k].(string); !ok { return fmt.Errorf("field %q must be a string", k) }
    }
}

v, err := verifier.NewVerifier(evidenceB64)
if err != nil {
    var ve *verifier.Error // or inspect wrapped chain with errors.As/Unwrap
    if errors.As(err, &ve) { /* route by inner constructor error */ }
    return fmt.Errorf("verifier construction failed: %w", err)
}

When it happens

Trigger: FallbackVerifier path: decompressed evidence contains "test_purpose" key but fails FallbackVerifier json.Unmarshal (e.g. "measure" or "serial_number" present but non-string, or JSON is an array). CSV path: csv.NewAttestation rejects the CoCo attestation structure (missing/invalid fields, signature verification prep failure).

Common situations: Test evidence produced by GetEvidenceWithAgentUuid with a non-string agent unique id; malformed CoCo attestation JSON from a misconfigured attestation agent; upgrading the CoCo evidence format so older parsers fail.

Related errors

• unsupported key type, expect RSA
• JWT signing key is not initialized
• TEE public key is not found for specified token
• invalid n
• invalid e

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/5a953b6a77d846ec. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/verifier.go:88

	}

	var evidence map[string]any

	err = json.Unmarshal(evidenceBytes, &evidence)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
	}

	var verifier Verifier

	if _, ok := evidence["test_purpose"]; ok {
		verifier, err = NewFallbackVerifier(evidenceBytes)
	} else {
		verifier, err = csv.NewAttestation(string(evidenceBytes))
	}

	if err != nil {
		return nil, fmt.Errorf("failed to create csv verifier: %v", err)
	} else {
		return verifier, nil
	}
}

View on GitHub (pinned to 6e04ca5ff0)