{"record":{"id":"0a185a16e4718688","repo":"grpc/grpc-go","slug":"invalid-spiffeid-v","errorCode":null,"errorMessage":"invalid spiffeid: %v","messagePattern":"invalid spiffeid: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/credentials/spiffe/spiffe.go","lineNumber":104,"sourceCode":"\tfor _, root := range roots {\n\t\trootPool.AddCert(root)\n\t}\n\treturn rootPool, nil\n}\n\n// idFromCert parses the SPIFFE ID from the x509.Certificate. If the certificate\n// does not have a valid SPIFFE ID, returns an error.\nfunc idFromCert(cert *x509.Certificate) (*spiffeid.ID, error) {\n\tif cert == nil {\n\t\treturn nil, fmt.Errorf(\"input cert is nil\")\n\t}\n\t// A valid SPIFFE Certificate should have exactly one URI.\n\tif len(cert.URIs) != 1 {\n\t\treturn nil, fmt.Errorf(\"input cert has %v URIs but should have 1\", len(cert.URIs))\n\t}\n\tid, err := spiffeid.FromURI(cert.URIs[0])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid spiffeid: %v\", err)\n\t}\n\treturn &id, nil\n}\n","sourceCodeStart":86,"sourceCodeEnd":108,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/credentials/spiffe/spiffe.go#L86-L108","documentation":"Returned by idFromCert when the single URI SAN of the certificate cannot be parsed as a SPIFFE ID by spiffeid.FromURI. This validates the SPIFFE ID grammar: the URI scheme must be 'spiffe', the host (trust domain) must be non-empty and valid, and the path must conform to the SPIFFE path rules. The underlying go-spiffe error is wrapped.","triggerScenarios":"A URI SAN like \"https://example/workload\", \"spiffe://\", \"spiffe:///path\" (empty trust domain), or a path with forbidden characters. spiffeid.FromURI enforces the grammar from the SPIFFE ID spec.","commonSituations":"Cert minted with a generic URI SAN; SPIRE trust domain left blank during signing; path validation rules tightened by a go-spiffe version bump that rejects previously-accepted IDs.","solutions":["Inspect the URI SAN and confirm it is a well-formed spiffe:// URI with a non-empty trust domain and a conformant path.","Re-issue the SVID through SPIRE with the correct trust domain and workload path.","Upgrade or pin go-spiffe consistently across minting and verifying components so the ID grammar checks agree."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func certHasValidSpiffeID(c *x509.Certificate) error {\n    if len(c.URIs) != 1 { return fmt.Errorf(\"expected 1 URI, got %d\", len(c.URIs)) }\n    if _, err := spiffeid.FromURI(c.URIs[0]); err != nil {\n        return fmt.Errorf(\"invalid spiffe ID: %w\", err)\n    }\n    return nil\n}","typeGuard":"func isValidSpiffeCert(c *x509.Certificate) bool {\n    if c == nil || len(c.URIs) != 1 { return false }\n    _, err := spiffeid.FromURI(c.URIs[0])\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Always mint SPIFFE IDs via SPIRE rather than custom tooling.","Pin go-spiffe consistently across minting and verifying to keep grammar checks aligned.","Test cert generation with a spiffeid.FromURI check before deploying."],"tags":["grpc","spiffe","spiffe-id","validation","certificate"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}