OpenNHP/opennhp · error

ztdo id mismatch, please check with data provider

Error message

ztdo id mismatch, please check with data provider

What it means

After parsing the header, the agent compares the requested ztdoId with the object id embedded in the downloaded ztdo header (ztdo.GetObjectID()). A mismatch means the provider returned data for a different object than requested, or the stored header was rewritten. Treated as an integrity check failure and surfaced as 'check with data provider'.

Solutions

1. Confirm the exact ztdo-id requested matches the id the provider intends to serve.
2. Ask the provider to re-encrypt/re-publish so the header object id matches the registered ztdo id.
3. Clear any stale DB record/URL mapping pointing to the wrong object.
4. Re-run the request after the provider fixes the record; verify the header id with a local parse.

Example fix

// before: mismatch surfaces only at the agent
if ztdoId != ztdo.GetObjectID() {
    return "", fmt.Errorf("ztdo id mismatch, please check with data provider")
}

// after: provider side sets the header id before upload
if err := ztdo.SetObjectID(requestedZtdoId); err != nil {
    return fmt.Errorf("cannot align header id with registered id: %w", err)
}

if got := ztdo.GetObjectID(); got != ztdoId {
    return fmt.Errorf("expected ztdo %s, provider returned %s", ztdoId, got)
}

func matchesRequestedId(z *ztdo.Ztdo, id string) bool { return z != nil && z.GetObjectID() == id }

path, err := fetchZtdo(ctx, ztdoId)
var idm *ZtdoIdMismatchError
if errors.As(err, &idm) {
    // notify provider with both ids for reconciliation
}

When it happens

Trigger: dagMsg carries a ztdo whose header object id differs from the ztdoId the agent requested — e.g. the DB/provider overwrote a record with a new ztdo id, or the wrong record was served due to an id collision/typo.

Common situations: Provider re-encrypted data and updated the ztdo id but the DB still serves the old URL; client passes the wrong ztdo-id to a cached/misrouted DB entry; concurrent writers overwriting the same object storage key.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• failed to parse ztdo header
• access url is empty, please check with data provider
• failed to unwrap data private key
• Failed to refresh SDP
• Error: fail to find policyId for ztdoId

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/3a476daad76af88e. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/agent/udpagent.go:1384

				log.Error("access url is empty, please check with data provider")
				return "", fmt.Errorf("access url is empty, please check with data provider")
			}

			var err error
			ztdoPath, err := utils.DownloadFileToTemp(dagMsg.AccessUrl, "ztdo-")
			if err != nil {
				log.Error("failed to download ztdo: %v\n", err)
				return "", fmt.Errorf("failed to download ztdo: %v", err)
			}

			if parseErr := ztdo.ParseHeader(ztdoPath); parseErr != nil {
				fmt.Printf("Error: failed to parse ztdo header:%s\n", parseErr)
				return "", fmt.Errorf("failed to parse ztdo header:%s", parseErr)
			}

			if ztdoId != ztdo.GetObjectID() {
				fmt.Printf("Error: ztdo id mismatch, please check with data provider\n")
				return "", fmt.Errorf("ztdo id mismatch, please check with data provider")
			}

			// decrypt data private key
			saDataPrk := ztdolib.NewSymmetricAgreement(ztdo.GetECCMode(), false)
			saDataPrk.SetMessagePatterns(ztdolib.DataPrivateKeyWrappingPatterns)
			saDataPrk.SetPsk([]byte(ztdolib.InitialDHPKeyWrappingString))
			saDataPrk.SetStaticKeyPair(teeEcdh)
			saDataPrk.SetEphemeralKeyPair(consumerEphemeralEcdh)
			saDataPrk.SetRemoteStaticPublicKey(providerPbk)

			gcmKey, ad := saDataPrk.AgreeSymmetricKey()

			dataPrkBase64, err := dataPrkWrapping.Unwrap(gcmKey[:], ad)
			if err != nil {
				return "", fmt.Errorf("failed to unwrap data private key: %s", err)
			}

			if ztdoPath == "" || output == "" {

View on GitHub (pinned to 6e04ca5ff0)