{"record":{"id":"2ac377381cadd256","repo":"slackhq/nebula","slug":"build-noise-state-w","errorCode":null,"errorMessage":"build noise state: %w","messagePattern":"build noise state: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"handshake/machine.go","lineNumber":96,"sourceCode":"\tgetCred GetCredentialFunc,\n\tverifier CertVerifier,\n\tallocIndex IndexAllocator,\n\tinitiator bool,\n\tsubtype header.MessageSubType,\n) (*Machine, error) {\n\tinfo, err := subtypeInfoFor(subtype)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tcred := getCred(version)\n\tif cred == nil {\n\t\treturn nil, fmt.Errorf(\"%w: %v\", ErrNoCredential, version)\n\t}\n\n\ths, err := cred.buildHandshakeState(initiator, info.pattern)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"build noise state: %w\", err)\n\t}\n\n\treturn &Machine{\n\t\ths:         hs,\n\t\tsubtype:    subtype,\n\t\tmsgs:       info.msgs,\n\t\tgetCred:    getCred,\n\t\tallocIndex: allocIndex,\n\t\tverifier:   verifier,\n\t\tmyVersion:  version,\n\t\tresult: &Result{\n\t\t\tInitiator: initiator,\n\t\t\tCipher:    cred.cipherSuite,\n\t\t},\n\t}, nil\n}\n\n// Failed returns true if the Machine is in an unrecoverable state.","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/handshake/machine.go#L78-L114","documentation":"NewMachine wraps an error returned while initializing the Noise protocol handshake state (cred.buildHandshakeState) with the message 'build noise state: %w'. This happens when the credential's private key or peer static key cannot be used to construct the Noise cipher/handshake (e.g. invalid key length or unsupported pattern).","triggerScenarios":"NewMachine is called and cred.buildHandshakeState(initiator, info.pattern) returns an error — malformed or wrong-size private key material loaded from the pki config, or an unsupported handshake pattern for the negotiated version.","commonSituations":"Corrupted or truncated key files, keys generated by mismatched tooling versions, custom/old Nebula builds negotiating patterns the noise library doesn't support.","solutions":["Regenerate the node's keypair and certificate with a matching nebula-cert version","Verify the key files under the pki config section are complete PEM blocks (no truncation/concatenation)","Ensure both peers run compatible Nebula versions so the same Noise pattern is selected"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify key material loads and has correct length before handshake\nblock, _ := pem.Decode(keyPEM)\nif block == nil || len(block.Bytes) != expectedKeySize {\n\treturn fmt.Errorf(\"invalid private key material\")\n}","typeGuard":null,"tryCatchPattern":"m, err := handshake.NewMachine(...)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"build noise state:\") {\n\t\t// regenerate keypair / check key files\n\t}\n\treturn err\n}","preventionTips":["Generate keys only with the matching nebula-cert version","Check file integrity (checksums) when distributing pki key material","Never concatenate or truncate PEM files during provisioning","Pin nebula versions across the deployment"],"tags":["handshake","noise","key-material"],"backgroundTag":"noise-handshake-init-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}