{"record":{"id":"21feabffe1d74bf1","repo":"micro/go-micro","slug":"ap2-invalid-signature-encoding-w","errorCode":null,"errorMessage":"ap2: invalid signature encoding: %w","messagePattern":"ap2: invalid signature encoding: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gateway/a2a/ap2.go","lineNumber":87,"sourceCode":"\t}\n\tif m.Kind == \"\" {\n\t\treturn AP2SignedMandate{}, errors.New(\"ap2: mandate kind is required\")\n\t}\n\tif m.IssuedAt.IsZero() {\n\t\tm.IssuedAt = time.Now().UTC()\n\t}\n\tpayload, err := ap2Payload(m)\n\tif err != nil {\n\t\treturn AP2SignedMandate{}, err\n\t}\n\treturn AP2SignedMandate{Mandate: m, KeyID: keyID, Signature: base64.RawURLEncoding.EncodeToString(ed25519.Sign(private, payload))}, nil\n}\n\n// VerifyAP2Mandate verifies a signed mandate credential.\nfunc VerifyAP2Mandate(s AP2SignedMandate, public ed25519.PublicKey) error {\n\tsig, err := base64.RawURLEncoding.DecodeString(s.Signature)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"ap2: invalid signature encoding: %w\", err)\n\t}\n\tpayload, err := ap2Payload(s.Mandate)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !ed25519.Verify(public, payload, sig) {\n\t\treturn errors.New(\"ap2: mandate signature verification failed\")\n\t}\n\treturn nil\n}\n\n// AP2BindMandateToMessage returns a copy of m bound to the A2A message's task/context.\nfunc AP2BindMandateToMessage(m AP2Mandate, msg Message) AP2Mandate {\n\tm.TaskID = msg.TaskID\n\tm.ContextID = msg.ContextID\n\treturn m\n}\n","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/gateway/a2a/ap2.go#L69-L105","documentation":"VerifyAP2Mandate decodes the mandate's Signature field using base64 RawURL encoding before performing an Ed25519 verification. This error is returned when the signature string is not valid base64url (no padding), so the signature can never be verified. It wraps the underlying base64 decode error with %w.","triggerScenarios":"Calling gateway/a2a.VerifyAP2Mandate(s, publicKey) where s.Signature contains standard base64 with padding, hex, whitespace, or any characters outside the base64url alphabet — producing 'ap2: invalid signature encoding: <decode error>'.","commonSituations":"A client signing with base64.StdEncoding (with '=' padding) while the gateway expects RawURLEncoding; the signature being URL-query-decoded and corrupted; a field mix-up sending a key or payload hash in the Signature field.","solutions":["Re-encode the signature with base64.RawURLEncoding on the signing side: base64.RawURLEncoding.EncodeToString(sig).","If the incoming value uses padded standard base64, strip '=' and translate +/ to -_ before verification (or fix the producer).","Log the received Signature value and confirm it is a 64-byte Ed25519 signature (86 base64url chars) and not a key or hash."],"exampleFix":"// before (producer)\nsig := base64.StdEncoding.EncodeToString(signature)\n// after\nsig := base64.RawURLEncoding.EncodeToString(signature)","handlingStrategy":"validation","validationCode":"if _, err := base64.RawURLEncoding.DecodeString(signed.Signature); err != nil {\n    return fmt.Errorf(\"signature must be base64url without padding: %w\", err)\n}","typeGuard":"func validSignatureEncoding(sig string) bool {\n    _, err := base64.RawURLEncoding.DecodeString(sig)\n    return err == nil && len(sig) == 86\n}","tryCatchPattern":"err := a2a.VerifyAP2Mandate(signed, pub)\nif err != nil && strings.Contains(err.Error(), \"invalid signature encoding\") {\n    // re-encode producer signature with base64.RawURLEncoding\n}","preventionTips":["Always sign and encode with base64.RawURLEncoding on the producer side.","Never pass signatures through URL query decoding; transport them in headers or JSON bodies.","Sanity-check signature length (86 base64url chars for Ed25519) before sending."],"tags":["go","ap2","base64","signature","encoding"],"backgroundTag":"invalid-base64-encoding","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}