{"record":{"id":"3998f3fcf1e1d462","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-description","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field Description","messagePattern":"proto: wrong wireType = (.+?) for field Description","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60766,"sourceCode":"\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tpostIndex := iNdEx + intStringLen\n\t\t\tif postIndex < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif postIndex > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tm.AccountName = string(dAtA[iNdEx:postIndex])\n\t\t\tiNdEx = postIndex\n\t\tcase 4:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field Description\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {","sourceCodeStart":60748,"sourceCodeEnd":60784,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60748-L60784","documentation":"Field Description of IdentityCenterAccount is a string (wire type 2); the generated Unmarshal errors when the field 4 tag has a different wire type. Like its siblings, this guards against decoding a byte stream produced under a different schema revision.","triggerScenarios":"Unmarshaling an IdentityCenterAccount whose field 4 is encoded with a non-length-delimited wire type — version skew between producer and this compiled pb.go, or corruption that misaligned the field boundary after AccountName.","commonSituations":"Cluster upgrades with mixed versions, plugins/pinned deps using an old api release, corrupted cached or persisted AWS Identity Center sync data, fuzzer input.","solutions":["Bring producer and consumer onto the same Teleport api version.","Regenerate api/client/proto bindings from the current .proto.","Discard and re-sync the corrupted IdentityCenterAccount records.","Inspect the payload's field 4 key byte; expect 0x22 ((4<<3)|2)."],"exampleFix":"// before: mismatched vendored api\nreplace github.com/gravitational/teleport/api => ../old-api\n// after: use the api matching the deployed server\nrequire github.com/gravitational/teleport/api vX.Y.Z","handlingStrategy":"validation","validationCode":"func looksLikeIdentityCenterAccount(data []byte) bool {\n  // leading key for field 1 (ID, string) must be 0x0a\n  return len(data) > 0 && data[0] == 0x0a\n}","typeGuard":null,"tryCatchPattern":"if err := proto.Unmarshal(data, &acct); err != nil {\n  if strings.Contains(err.Error(), \"field Description\") {\n    log.Warn(\"IdentityCenterAccount Description wire mismatch; likely version skew\")\n    return ErrIncompatiblePayload\n  }\n  return err\n}","preventionTips":["Upgrade the whole cluster within one maintenance window to avoid mixed schema traffic.","Store AWS Identity Center sync data with a schema/serialization version.","Validate stored records at startup and re-sync on decode failure.","Keep pb.go regeneration automated in CI to prevent stale bindings."],"tags":["protobuf","grpc","wire-format","version-skew","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}