{"record":{"id":"0c6df503df552307","repo":"tailscale/tailscale","slug":"attestationkey-load-called-without-tpmprivate-or-t","errorCode":null,"errorMessage":"attestationKey.load called without tpmPrivate or tpmPublic","messagePattern":"attestationKey\\.load called without tpmPrivate or tpmPublic","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"feature/tpm/attestation.go","lineNumber":114,"sourceCode":"\t\treturn nil\n\t}); err != nil {\n\t\treturn nil, err\n\t}\n\treturn ak, ak.load()\n}\n\nfunc (ak *attestationKey) loaded() bool {\n\treturn ak.tpm != nil && ak.handle != nil && ak.pub != nil\n}\n\n// load the key into the TPM from its public/private components. Must be called\n// before Sign or Public.\nfunc (ak *attestationKey) load() error {\n\tif ak.loaded() {\n\t\treturn nil\n\t}\n\tif len(ak.tpmPrivate.Buffer) == 0 || len(ak.tpmPublic.Bytes()) == 0 {\n\t\treturn fmt.Errorf(\"attestationKey.load called without tpmPrivate or tpmPublic\")\n\t}\n\treturn withSRK(log.Printf, ak.tpm, func(srk tpm2.AuthHandle) error {\n\t\tresp, err := tpm2.Load{\n\t\t\tParentHandle: tpm2.NamedHandle{\n\t\t\t\tHandle: srk.Handle,\n\t\t\t\tName:   srk.Name,\n\t\t\t},\n\t\t\tInPrivate: ak.tpmPrivate,\n\t\t\tInPublic:  ak.tpmPublic,\n\t\t}.Execute(ak.tpm)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"tpm2.Load: %w\", err)\n\t\t}\n\n\t\tak.handle = &tpm2.NamedHandle{\n\t\t\tHandle: resp.ObjectHandle,\n\t\t\tName:   resp.Name,\n\t\t}","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/feature/tpm/attestation.go#L96-L132","documentation":"load was invoked on an attestationKey that is not yet loaded and has empty tpmPrivate or tpmPublic blobs, so there is nothing to hand the TPM. It means the key was deserialized from JSON or cloned without its wrapped components.","triggerScenarios":"Thrown at feature/tpm/attestation.go:114 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the attestation key with a fresh create call.","Check the persisted prefs contain the key blobs."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}