{"record":{"id":"1a8648071efaa828","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-has-empty-tru","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent has empty trust bundle","messagePattern":"X\\.509-SVID response from SPIRE agent has empty trust bundle","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":299,"sourceCode":"\n    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)\n            throws SpiffeConnectionException {\n        List<X509SVID> svids = response.getSvidsList();\n        if (svids.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains no SVIDs\");\n        }\n        X509SVID svid = svids.get(0);\n\n        String protoSpiffeId = svid.getSpiffeId();\n        SpiffeValidator.validateSpiffeId(protoSpiffeId);\n        if (svid.getX509Svid().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty certificate chain\");\n        }\n        if (svid.getX509SvidKey().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty private key\");\n        }\n        if (svid.getBundle().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty trust bundle\");\n        }\n\n        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), \"certificate chain\");\n        if (certChain.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID certificate chain is empty\");\n        }\n\n        X509Certificate leaf = certChain.get(0);\n        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);\n        if (!protoSpiffeId.equals(sanSpiffeId)) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: \"\n                            + protoSpiffeId + \", SAN: \" + sanSpiffeId);\n        }\n        for (int i = 1; i < certChain.size(); i++) {\n            SpiffeValidator.validateIntermediate(certChain.get(i));\n        }\n","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L281-L317","documentation":"The X.509-SVID's bundle field was empty, so no trust bundle bytes accompanied the SVID. The trust bundle is required to validate peer certificates in the SPIFFE trust domain, so the client rejects the response as incomplete.","triggerScenarios":"getWorkloadCertificate when the selected X509SVID's getBundle() ByteString is empty.","commonSituations":"SPIRE agent with an out-of-sync bundle cache; new trust domain not yet federated; agent/server version mismatch where bundle distribution failed.","solutions":["Restart the SPIRE agent to force re-sync of trust bundles from the server.","Verify the SPIRE server has the trust bundle for the domain (spire-server bundle show).","Update agent/server to matching versions.","If federating, ensure the federation relationship and bundle endpoints are configured."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check bundle availability on the server:\n// spire-server bundle show -id spiffe://example.org","typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"empty trust bundle\")) {\n        doc = retryWithBackoff(client::getWorkloadCertificate);\n    } else throw e;\n}","preventionTips":["Ensure the trust domain's bundle exists and is synced on the agent","Restart the agent after server bundle rotation","Configure federation endpoints if using multiple trust domains","Keep agent and server versions aligned"],"tags":["spiffe","spire","trust-bundle","empty-response"],"backgroundTag":"malformed-workload-api-response","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}