What causes "failed to unmarshal evidence: %v" in OpenNHP/opennhp?

Log the first ~200 bytes of evidenceBytes to see what actually decompressed

failed to unmarshal evidence

Error message

failed to unmarshal evidence: %v

What it means

Raised in verifier.NewVerifier after successful decompression: json.Unmarshal of the evidence bytes into map[string]any failed. The decompressed payload is not valid JSON, so the dispatcher cannot inspect keys like 'test_purpose' to choose a verifier backend and the evidence is rejected.

Solutions

Log the first ~200 bytes of evidenceBytes to see what actually decompressed
Verify the producer (GetEvidenceWithCCUrl) got a 200 with a JSON body — check it isn't compressing an HTML error page
Ensure the attestation service at 127.0.0.1:8006/aa/evidence is running and returning JSON

Example fix

// before
return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
// after
if json.Valid(evidenceBytes) {
    err = json.Unmarshal(evidenceBytes, &evidence)
} else {
    return nil, fmt.Errorf("evidence is not JSON, first bytes: %q", evidenceBytes[:min(64, len(evidenceBytes))])
}

Defensive patterns

Strategy: validation

Validate before calling

if !json.Valid(evidenceBytes) {
    return errors.New("decompressed evidence is not valid JSON")
}

Try / catch

if v, err := verifier.NewVerifier(evidenceB64); err != nil {
    if strings.Contains(err.Error(), "failed to unmarshal evidence") {
        // dump first bytes of decompressed payload for diagnosis
    }
}

Prevention

Assert the attestation endpoint returns application/json, not HTML error pages
Log a bounded prefix of decompressed bytes on failure
Test with both CoCo and fallback evidence shapes

When it happens

Trigger: NewVerifier's input decompresses to non-JSON content: an HTML error page from the attestation endpoint, a binary blob, or text with encoding issues.

Common situations: The confidential-computing evidence URL returned an error page (proxy/interstitial) that was compressed as-is; producer serialized with a non-JSON format; character-encoding corruption in transit.

Understand the failure class

Background: "failed to unmarshal" / json.Unmarshal errors: why parsing a response into a Go struct fails and how to fix it — this error's family across 23 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/125ea5c568f182f1. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/verifier.go:76

	if err != nil {
		return nil, fmt.Errorf("failed to decode evidence: %v", err)
	}

	r, err := zlib.NewReader(bytes.NewReader(compressedEvidence))
	if err != nil {
		return nil, fmt.Errorf("failed to create zlib reader: %v", err)
	}
	defer r.Close()
	evidenceBytes, err := io.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("failed to read evidence: %v", err)
	}

	var evidence map[string]any

	err = json.Unmarshal(evidenceBytes, &evidence)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal evidence: %v", err)
	}

	var verifier Verifier

	if _, ok := evidence["test_purpose"]; ok {
		verifier, err = NewFallbackVerifier(evidenceBytes)
	} else {
		verifier, err = csv.NewAttestation(string(evidenceBytes))
	}

	if err != nil {
		return nil, fmt.Errorf("failed to create csv verifier: %v", err)
	} else {
		return verifier, nil
	}
}

View on GitHub (pinned to 6e04ca5ff0)