{"record":{"id":"15dcc1c6fa487353","repo":"t8y2/dbx","slug":"service-w","errorCode":null,"errorMessage":"service: %w","messagePattern":"service: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":790,"sourceCode":"\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}","sourceCodeStart":772,"sourceCodeEnd":808,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L772-L808","documentation":"This error is returned while parsing a Hadoop delegation token: the fourth length-prefixed byte array (the token service field) could not be read. Identifier, password, and kind parsed fine but the stream ends or is corrupt at the service field, so the token is incomplete.","triggerScenarios":"Decoding a delegation token whose payload ends partway through the service field, or whose service length prefix is corrupt.","commonSituations":"Token cut off near the end by copy/paste or log-line wrapping; token stored across multiple config fields incorrectly.","solutions":["Re-copy the complete token from its source without line-wrapping changes","Regenerate the delegation token from the Hive server","Store the token in a single config field/secret, not split across values","Validate token integrity (e.g. round-trip base64 decode) before use"],"exampleFix":"// before\ntoken := strings.Join(logLines, \"\") // wrapped log extraction\n// after\ntoken := readTokenFromSecretStore()","handlingStrategy":"validation","validationCode":"func tokenEndsWithServiceField(token string) error {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil { return err }\n\tif len(decoded) < 48 { return errors.New(\"token appears truncated before service field\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if _, _, err := decodeHadoopDelegationToken(token); err != nil {\n\tif strings.Contains(err.Error(), \"service\") {\n\t\treturn fmt.Errorf(\"token truncated at service field; fetch a fresh token: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Disable log line-wrapping when copying tokens from logs","Keep tokens whole in a single secret field","Verify the final characters of the token match what the issuer emitted","Fail fast: validate tokens at startup, not at first query"],"tags":["hive","authentication","delegation-token","parsing"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}