{"record":{"id":"2b8c4ac3fb2a728b","repo":"t8y2/dbx","slug":"hive-storepasswordpath-uses-the-java-hadoop-creden","errorCode":null,"errorMessage":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent","messagePattern":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1064,"sourceCode":"\tconfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}\n\tif parameterBool(values, \"sslinsecureskipverify\") || parameterBool(values, \"allowselfsigned\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\tvar customRoots *x509.CertPool\n\tcredentialProviderPath := parameter(values, \"storepasswordpath\")\n\tif path := strings.TrimSpace(params.CACertPath); path != \"\" {\n\t\tcontents, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots","sourceCodeStart":1046,"sourceCodeEnd":1082,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1046-L1082","documentation":"When ssltruststore is set but no explicit trustStorePassword is provided and the configuration came from a Java credential-provider file (credentialProviderPath), this error is thrown. Java Hadoop credential providers store passwords in a binary JCEKS file that the native Go agent cannot transparently resolve for truststore decryption, so the library demands the password be configured explicitly rather than guessing.","triggerScenarios":"Configuring the Hive driver with ssltruststore pointing at a Java truststore, with truststorepassword empty, while credentialProviderPath is set (i.e. the password is only available via the Hadoop credential-provider format).","commonSituations":"Migrating a JDBC connection string that used Hadoop credential providers (e.g. hadoop.security.credential.provider.path=jceks://...) to the native agent; tooling copied the Java config verbatim; the truststore password was expected to be picked up from the credential provider but the native agent requires it explicitly.","solutions":["Set the truststorepassword parameter explicitly to the truststore's password.","Extract the password from the Hadoop credential provider first (hadoop credential list / hadoop credential get <alias>) and put the value into truststorepassword.","If the truststore has no password (identity truststores are often unencrypted), pass an empty-string password explicitly or confirm the parameter key spelling (truststorepassword, not password).","If the store is actually a PEM CA bundle, remove ssltruststore and use the CA-certificate parameter instead so loadTrustStore is not invoked."],"exampleFix":"// before\nvalues[\"ssltruststore\"] = \"/etc/hive/conf/truststore.jks\"\n// (truststorepassword unset; credentialProviderPath set)\n// after\nvalues[\"ssltruststore\"] = \"/etc/hive/conf/truststore.jks\"\nvalues[\"truststorepassword\"] = \"<resolved-password-from-jceks>\"","handlingStrategy":"validation","validationCode":"if values[\"ssltruststore\"] != \"\" && values[\"truststorepassword\"] == \"\" && credentialProviderPath != \"\" {\n\treturn errors.New(\"provide truststorepassword explicitly; credential-provider format is not supported by the native agent\")\n}","typeGuard":"func hasExplicitTruststorePassword(values map[string]string) bool {\n\tv, ok := values[\"truststorepassword\"]\n\treturn values[\"ssltruststore\"] == \"\" || (ok && v != \"\")\n}","tryCatchPattern":"tlsCfg, err := buildTLSConfig(values)\nif err != nil {\n\tif strings.Contains(err.Error(), \"configure trustStorePassword explicitly\") {\n\t\treturn fmt.Errorf(\"migrate Hadoop credential-provider password into truststorepassword: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["When migrating from JDBC/Hadoop configs, translate credential-provider aliases into explicit password parameters.","Resolve JCEKS-stored passwords at deploy time (hadoop credential get) and inject via env/secret manager.","Keep parameter names exactly lowercase: truststorepassword, truststoretype.","If the truststore is unencrypted, still configure the password parameter consistently rather than relying on the provider."],"tags":["tls","hive","truststore","config-migration"],"backgroundTag":"credential-provider-not-supported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}