{"record":{"id":"41a91524144f1999","repo":"t8y2/dbx","slug":"read-hive-ca-certificate-w","errorCode":null,"errorMessage":"read Hive CA certificate: %w","messagePattern":"read Hive CA certificate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1055,"sourceCode":"\t}\n\treturn filepath.Clean(value)\n}\n\nfunc buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {\n\tenabled := params.SSL || parameterBool(values, \"ssl\") || strings.EqualFold(parameter(values, \"ssl\"), \"true\")\n\tif !enabled {\n\t\treturn nil, nil\n\t}\n\tconfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}\n\tif parameterBool(values, \"sslinsecureskipverify\") || parameterBool(values, \"allowselfsigned\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\tvar customRoots *x509.CertPool\n\tcredentialProviderPath := parameter(values, \"storepasswordpath\")\n\tif path := strings.TrimSpace(params.CACertPath); path != \"\" {\n\t\tcontents, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)","sourceCodeStart":1037,"sourceCodeEnd":1073,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1037-L1073","documentation":"The Hive driver reads a custom CA certificate PEM file when sslCACertPath (params.CACertPath) is set, wrapping any os.ReadFile error with this message. The %w keeps the OS cause (missing file, permissions). It is thrown instead of silently skipping TLS trust configuration because a TLS connection would silently fail or be insecure without the CA.","triggerScenarios":"Opening a Hive connection with the CA-cert path parameter set while os.ReadFile on that path fails — path typo, file deleted, wrong mount, no read permission.","commonSituations":"Kubernetes secret not mounted; corporate CA bundle path changed after an OS upgrade; using a relative path with a different working directory; mismatch between config written for driver A and driver B hosts.","solutions":["Check the wrapped cause and verify the file exists and is readable (stat the path before connecting)","Use an absolute path for the CA bundle in the connection config","Re-deploy/mount the CA certificate file (e.g. configmap/secret volume)","Confirm the file contains valid PEM certificates (see the follow-up 'contains no certificates' error if readable but empty)"],"exampleFix":"// before\nparams.CACertPath = \"ca.pem\" // relative, working dir differs\n// after\nparams.CACertPath = \"/etc/hive/certs/ca.pem\"","handlingStrategy":"validation","validationCode":"if params.CACertPath != \"\" {\n    pem, err := os.ReadFile(params.CACertPath)\n    if err != nil {\n        return fmt.Errorf(\"Hive CA cert unreadable: %w\", err)\n    }\n    if !x509.NewCertPool().AppendCertsFromPEM(pem) {\n        return errors.New(\"CA file has no PEM certificates\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := db.Conn(ctx); err != nil {\n    if errors.Is(err, os.ErrNotExist) || errors.Is(err, os.ErrPermission) {\n        log.Fatalf(\"fix Hive CA cert path/permissions: %v\", err)\n    }\n    return err\n}","preventionTips":["Use absolute paths for CA bundles","Validate PEM content at config-load time","Mount CA certs via configmap/secret and pin the mount path","Watch for the sibling 'contains no certificates' error when the file is readable but empty"],"tags":["tls","hive","file-io","config"],"backgroundTag":"file-not-found","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}