What causes "failed to read evidence: %v" in OpenNHP/opennhp?

Re-fetch or re-request the evidence from the agent; verify the base64 length matches the producer's output

failed to read evidence

Error message

failed to read evidence: %v

What it means

Raised in verifier.NewVerifier when io.ReadAll on the zlib stream errors: the zlib header parsed but the stream is truncated or corrupt, so the decompressed evidence could not be read to completion (network truncation of the base64 blob or partial encoding on the producer side).

Solutions

Re-fetch or re-request the evidence from the agent; verify the base64 length matches the producer's output
Have the producer call zlib Writer.Close() before encoding (unclosed streams are truncated)
Add integrity protection (hash/checksum) over the compressed payload and verify before decompression

Defensive patterns

Strategy: retry

Validate before calling

raw, _ := base64.StdEncoding.DecodeString(s)
if _, err := zlib.NewReader(bytes.NewReader(raw)); err != nil { return err }
// optionally verify an upstream checksum here

Try / catch

var v verifier.Verifier
for i := 0; i < 3; i++ {
    v, err = verifier.NewVerifier(fetchEvidence())
    if err == nil || !strings.Contains(err.Error(), "failed to read evidence") { break }
    time.Sleep(200*time.Millisecond)
}

Prevention

Have producers call w.Close() before base64-encoding
Include a checksum over the compressed payload
Avoid truncation by not embedding evidence in size-limited fields (e.g. UDP packets, log lines)

When it happens

Trigger: NewVerifier gets a truncated zlib stream (partial file/network cut), or bytes were altered after compression causing a deflate checksum/structure error.

Common situations: Evidence written to disk incompletely before the agent crashed; message size limits truncating the base64 payload in transit; storage layer corrupting binary blobs; concurrent writes to the evidence buffer.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/e76ef1286e35c0a0. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/verifier.go:69

	}

	return fallbackVerifier, nil
}

func NewVerifier(compressedEvienceBase64 string) (Verifier, error) {
	compressedEvidence, err := base64.StdEncoding.DecodeString(compressedEvienceBase64)
	if err != nil {
		return nil, fmt.Errorf("failed to decode evidence: %v", err)
	}

	r, err := zlib.NewReader(bytes.NewReader(compressedEvidence))
	if err != nil {
		return nil, fmt.Errorf("failed to create zlib reader: %v", err)
	}
	defer r.Close()
	evidenceBytes, err := io.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("failed to read evidence: %v", err)
	}

	var evidence map[string]any

	err = json.Unmarshal(evidenceBytes, &evidence)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
	}

	var verifier Verifier

	if _, ok := evidence["test_purpose"]; ok {
		verifier, err = NewFallbackVerifier(evidenceBytes)
	} else {
		verifier, err = csv.NewAttestation(string(evidenceBytes))
	}

	if err != nil {

View on GitHub (pinned to 6e04ca5ff0)