OpenNHP/opennhp · error

unexpected status code

Error message

unexpected status code: %d

What it means

Raised by GetEvidenceWithCCUrl in the WASM host functions: the HTTP GET to the confidential-container evidence URL returned a status other than 200 within the 3-second client timeout. The evidence endpoint (CC agent) is unreachable, erroring, or fronted by something returning an error page.

Solutions

1. Log the response body alongside the status code to get the AAA's error detail
2. Check AAA logs to see why it rejected the request (bad parameter vs internal hardware failure)
3. Update the AAA to a version compatible with the /aa/evidence?runtime_data= API and verify the TEE device is exposed to the container

Example fix

// before
if resp.StatusCode != http.StatusOK {
    return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
}
// after
if resp.StatusCode != http.StatusOK {
    b, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
    return nil, fmt.Errorf("unexpected status code: %d, body: %s", resp.StatusCode, b)
}

resp, err := http.Get(confidentialContainerEvidenceUrl)
if err == nil && resp.StatusCode != http.StatusOK { resp.Body.Close(); return fmt.Errorf("AAA returned %d, retry later", resp.StatusCode) }

ev, err := engine.GetEvidenceWithCCUrl()
if err != nil {
    var statusErr interface{ Error() string }
    if strings.Contains(err.Error(), "unexpected status code") {
        // exponential backoff retry; check AAA logs
    }
}

When it happens

Trigger: The AAA on 127.0.0.1:8006 returns 4xx/5xx — e.g. 400 for a bad runtime_data parameter, 404 when the evidence route is missing, 500 when the underlying TEE hardware report cannot be fetched.

Common situations: AAA version that doesn't support the /aa/evidence endpoint shape or the runtime_data query parameter; TEE device (/dev/sev, /dev/tdx, SGX) unavailable so the report generation 500s; AAA misconfigured for the wrong hardware platform.

Related errors

• failed to download HRK
• failed to download hsk_cek
• unexpected status code when download hsk_cek
• http request failed
• unsupported key type, expect RSA

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/3bda0dffff35fa5c. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/wasm/engine/host.go:48

	buf, ok := m.Memory().Read(offset, byteCount)
	if !ok {
		log.Panicf("Memory.Read(%d, %d) out of range", offset, byteCount)
	}
	fmt.Println(string(buf))
}

func GetEvidenceWithCCUrl() ([]byte, error) {
	client := &http.Client{Timeout: 3 * time.Second}

	resp, err := client.Get(confidentialContainerEvidenceUrl)
	if err != nil {
		return nil, fmt.Errorf("http request failed: %w", err)
	}

	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("failed to read response body: %w", err)
	}

	var buf bytes.Buffer
	w := zlib.NewWriter(&buf)
	_, err = w.Write(body)
	w.Close()
	if err != nil {
		return nil, fmt.Errorf("failed to compress response body: %w", err)
	}

	compressedBody := buf.Bytes()

	return compressedBody, nil

View on GitHub (pinned to 6e04ca5ff0)