{"record":{"id":"1f7f373f46820163","repo":"hashicorp/nomad","slug":"disable-artifact-inspection-must-be-set","errorCode":null,"errorMessage":"disable_artifact_inspection must be set","messagePattern":"disable_artifact_inspection must be set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/config/artifact.go","lineNumber":237,"sourceCode":"\n\tif a.DecompressionFileCountLimit == nil {\n\t\treturn fmt.Errorf(\"decompression_file_count_limit must not be nil\")\n\t}\n\tif v := *a.DecompressionFileCountLimit; v < 0 {\n\t\treturn fmt.Errorf(\"decompression_file_count_limit must be >= 0 but found %d\", v)\n\t}\n\n\tif a.DecompressionSizeLimit == nil {\n\t\treturn fmt.Errorf(\"decompression_size_limit must not be nil\")\n\t}\n\tif v, err := humanize.ParseBytes(*a.DecompressionSizeLimit); err != nil {\n\t\treturn fmt.Errorf(\"decompression_size_limit is not a valid size: %w\", err)\n\t} else if v > math.MaxInt64 {\n\t\treturn fmt.Errorf(\"decompression_size_limit must be < %d but found %d\", int64(math.MaxInt64), v)\n\t}\n\n\tif a.DisableArtifactInspection == nil {\n\t\treturn fmt.Errorf(\"disable_artifact_inspection must be set\")\n\t}\n\n\tif a.DisableFilesystemIsolation == nil {\n\t\treturn fmt.Errorf(\"disable_filesystem_isolation must be set\")\n\t}\n\n\tfor _, p := range a.FilesystemIsolationExtraPaths {\n\t\tif _, err := landlock.ParsePath(p); err != nil {\n\t\t\treturn fmt.Errorf(\"filesystem_isolation_extra_paths contains invalid lockdown path %q\", p)\n\t\t}\n\t}\n\n\tif a.SetEnvironmentVariables == nil {\n\t\treturn fmt.Errorf(\"set_environment_variables must be set\")\n\t}\n\n\treturn nil\n}","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/config/artifact.go#L219-L255","documentation":"ArtifactConfig.Validate() requires disable_artifact_inspection to be explicitly set (non-nil bool pointer). Nomad inspects downloaded artifacts for security; the config must state whether inspection is disabled, so nil fails with 'disable_artifact_inspection must be set'.","triggerScenarios":"Calling ArtifactConfig.Validate() where a.DisableArtifactInspection is nil because the disable_artifact_inspection key is absent from the artifact config block.","commonSituations":"Legacy artifact configs from before inspection existed; manually constructed ArtifactConfig in tests or plugins; config merge/render steps that omit false-valued keys; users copying partial example configs.","solutions":["Add disable_artifact_inspection = false (recommended) or true to the artifact block.","Construct configs via DefaultArtifactConfig() so the pointer is initialized before overriding.","Fix merge/render pipelines so boolean defaults are never dropped as 'empty'."],"exampleFix":"// before\nartifact {\n  # disable_artifact_inspection missing\n}\n// after\nartifact {\n  disable_artifact_inspection = false\n}","handlingStrategy":"validation","validationCode":"if cfg.DisableArtifactInspection == nil {\n    return errors.New(\"artifact config must set disable_artifact_inspection (use false to keep inspection on)\")\n}","typeGuard":"func hasInspectionFlag(a *ArtifactConfig) bool { return a.DisableArtifactInspection != nil }","tryCatchPattern":null,"preventionTips":["Explicitly write disable_artifact_inspection = false in every artifact block.","Prefer DefaultArtifactConfig() over zero-value struct literals.","After Nomad upgrades, run validation to catch newly required boolean fields."],"tags":["nomad","config-validation","missing-field","security"],"backgroundTag":"missing-required-argument","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}