OpenNHP/opennhp · error

failed to decode evidence

Error message

failed to decode evidence: %v

What it means

NewVerifier wraps any base64 decoding failure of its input into "failed to decode evidence: %v". The evidence string must be standard (StdEncoding) base64 of zlib-compressed JSON evidence; anything malformed, empty, or URL-safe encoded fails here.

Solutions

1. Regenerate the evidence at the source with base64.StdEncoding.EncodeToString(zlibCompressed) and re-transmit it
2. Check for and strip whitespace/newlines introduced by config files or logs before decoding
3. If the producer uses URL-safe encoding, either switch it to StdEncoding or try base64.RawURLEncoding.DecodeString as a fallback

Example fix

// before
verifier, err := NewVerifier(cfg.Evidence) // config value contains '\n'
// after
cleaned := strings.Map(func(r rune) rune { if r=='\n'||r=='\r'||r==' ' {return -1}; return r }, cfg.Evidence)
verifier, err := NewVerifier(cleaned)

if s == "" { return errors.New("evidence is empty") }
if _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s)); err != nil {
    return fmt.Errorf("evidence is not valid std base64: %w", err)
}

if v, err := verifier.NewVerifier(evidenceB64); err != nil {
    if strings.Contains(err.Error(), "failed to decode evidence") {
        // re-encode or re-request evidence from the agent
    }
}

When it happens

Trigger: Calling verifier.NewVerifier with a string that is empty, contains non-base64 characters, uses URL-safe base64 padding, or was truncated in transit/storage.

Common situations: Evidence passed through JSON/YAML configs with line-wrapping corruption; a js-agent or HTTP client sending URL-safe base64; storing evidence in a DB column that trims '=' padding; passing the raw (unencoded) evidence bytes as a string.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• invalid n
• invalid e
• unsupported key type, expect RSA
• JWT signing key is not initialized
• TEE public key is not found for specified token

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/7db6b7183f28eb33. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/verifier.go:59

func (f *FallbackVerifier) GetMeasure() string {
	return f.SerialNumber
}

func NewFallbackVerifier(evidence []byte) (*FallbackVerifier, error) {
	fallbackVerifier := &FallbackVerifier{}

	err := json.Unmarshal(evidence, fallbackVerifier)
	if err != nil {
		return nil, err
	}

	return fallbackVerifier, nil
}

func NewVerifier(compressedEvienceBase64 string) (Verifier, error) {
	compressedEvidence, err := base64.StdEncoding.DecodeString(compressedEvienceBase64)
	if err != nil {
		return nil, fmt.Errorf("failed to decode evidence: %v", err)
	}

	r, err := zlib.NewReader(bytes.NewReader(compressedEvidence))
	if err != nil {
		return nil, fmt.Errorf("failed to create zlib reader: %v", err)
	}
	defer r.Close()
	evidenceBytes, err := io.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("failed to read evidence: %v", err)
	}

	var evidence map[string]any

	err = json.Unmarshal(evidenceBytes, &evidence)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
	}

View on GitHub (pinned to 6e04ca5ff0)