OpenNHP/opennhp · error

failed to create zlib reader

Error message

failed to create zlib reader: %v

What it means

Raised in verifier.NewVerifier after base64-decoding the compressed evidence: zlib.NewReader over the decoded bytes failed, meaning the payload is not a valid zlib stream (wrong compression, truncated data, or plain JSON passed without compression). The evidence cannot be decompressed for appraisal.

Solutions

1. Ensure the producer compresses with zlib.NewWriter (like engine.GetEvidenceWithCCUrl does) before base64-encoding
2. If the payload is gzip, switch the consumer to gzip.NewReader or change the producer to zlib
3. Decode the base64 first and hex-dump the first 2 bytes: a zlib stream starts with 0x78 (or similar CMF/FLG pair); 0x1f8b means gzip, '{' means raw JSON

Example fix

// before
r, err := zlib.NewReader(bytes.NewReader(compressedEvidence)) // fails on gzip input
// after
if br, _ := bytes.NewReader(compressedEvidence), 0; compressedEvidence[0]==0x1f {
    r, err = gzip.NewReader(bytes.NewReader(compressedEvidence))
} else {
    r, err = zlib.NewReader(bytes.NewReader(compressedEvidence))
}

raw, err := base64.StdEncoding.DecodeString(s)
if err == nil && len(raw) > 1 && raw[0] != 0x78 {
    return fmt.Errorf("payload is not zlib (first byte 0x%02x)", raw[0])
}

if v, err := verifier.NewVerifier(evidenceB64); err != nil {
    if strings.Contains(err.Error(), "failed to create zlib reader") {
        // producer used wrong compression; request zlib-wrapped evidence
    }
}

When it happens

Trigger: NewVerifier receives base64 of data that is raw JSON, gzip-compressed, or otherwise not zlib-wrapped.

Common situations: Producer switched compression (e.g. gzip or none) but consumer still expects zlib; hand-crafted test evidence that was base64-encoded without zlib compression; version mismatch between agent (producer) and server (consumer).

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• unsupported key type, expect RSA
• JWT signing key is not initialized
• TEE public key is not found for specified token
• invalid n
• invalid e

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/b844965cb9225254. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/verifier.go:64

	fallbackVerifier := &FallbackVerifier{}

	err := json.Unmarshal(evidence, fallbackVerifier)
	if err != nil {
		return nil, err
	}

	return fallbackVerifier, nil
}

func NewVerifier(compressedEvienceBase64 string) (Verifier, error) {
	compressedEvidence, err := base64.StdEncoding.DecodeString(compressedEvienceBase64)
	if err != nil {
		return nil, fmt.Errorf("failed to decode evidence: %v", err)
	}

	r, err := zlib.NewReader(bytes.NewReader(compressedEvidence))
	if err != nil {
		return nil, fmt.Errorf("failed to create zlib reader: %v", err)
	}
	defer r.Close()
	evidenceBytes, err := io.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("failed to read evidence: %v", err)
	}

	var evidence map[string]any

	err = json.Unmarshal(evidenceBytes, &evidence)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
	}

	var verifier Verifier

	if _, ok := evidence["test_purpose"]; ok {
		verifier, err = NewFallbackVerifier(evidenceBytes)

View on GitHub (pinned to 6e04ca5ff0)