{"record":{"id":"17615a9db2518208","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-arn","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field ARN","messagePattern":"proto: wrong wireType = (.+?) for field ARN","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60702,"sourceCode":"\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tpostIndex := iNdEx + intStringLen\n\t\t\tif postIndex < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif postIndex > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tm.ID = string(dAtA[iNdEx:postIndex])\n\t\t\tiNdEx = postIndex\n\t\tcase 2:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ARN\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {","sourceCodeStart":60684,"sourceCodeEnd":60720,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60684-L60720","documentation":"Field ARN of IdentityCenterAccount is a string (wire type 2, length-delimited); the generated Unmarshal rejects field 2 tags with any other wire type. As with all wireType errors, it means the serialized stream disagrees with the compiled proto schema.","triggerScenarios":"Unmarshaling an IdentityCenterAccount payload whose field 2 is encoded as varint/fixed instead of length-delimited — schema mismatch between producer and consumer, or byte-stream corruption that shifted the field start.","commonSituations":"Mixed Teleport versions in a cluster upgrade, plugins built against an older api module, corrupt backend values, feeding non-proto bytes into proto.Unmarshal.","solutions":["Align Teleport api versions across auth server, proxies, and plugins.","Regenerate api/client/proto from the current .proto.","Validate/discard corrupted payloads; re-create the record.","If writing raw proto by hand, emit tag (2<<3)|2 followed by the ARN length and bytes."],"exampleFix":"// before: wrong wire type produced manually\nbuf = proto.AppendVarint(buf, (2<<3)|0) // varint tag for a string field\n// after: length-delimited tag for strings\nbuf = proto.AppendVarint(buf, (2<<3)|2)\nbuf = proto.AppendVarint(buf, uint64(len(arn)))\nbuf = append(buf, arn...)","handlingStrategy":"validation","validationCode":"func validIdentityCenterAccountTags(data []byte) bool {\n  // expected leading key: field 1, wire type 2 (0x0a)\n  return len(data) >= 1 && data[0] == 0x0a\n}","typeGuard":null,"tryCatchPattern":"if err := proto.Unmarshal(data, &acct); err != nil {\n  if strings.Contains(err.Error(), \"field ARN\") {\n    log.WithField(\"len\", len(data)).Warn(\"IdentityCenterAccount ARN wire mismatch\")\n    return ErrSchemaSkew\n  }\n  return err\n}","preventionTips":["Version-stamp serialized IdentityCenter records before persisting them.","Keep all plugins on the released api version matching the cluster.","Never renumber existing proto fields; reserve old numbers.","Round-trip test ARN/AccountName/Description encode+decode in CI."],"tags":["protobuf","grpc","wire-format","version-skew","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}