{"record":{"id":"68ac2d501e054295","repo":"nats-io/nats-server","slug":"unable-to-unmarshal-tpm-file-keys-json-from-s-v","errorCode":null,"errorMessage":"unable to unmarshal TPM file keys JSON from %s: %v","messagePattern":"unable to unmarshal TPM file keys JSON from (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":123,"sourceCode":"func readTPMKeysFromFile(filename string) ([]byte, []byte, error) {\n\tkeysJSON, err := os.ReadFile(filename)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tvar tpmKeys natsTPMPersistedKeys\n\tif err := json.Unmarshal(keysJSON, &tpmKeys); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to unmarshal TPM file keys JSON from %s: %v\", filename, err)\n\t}\n\n\t// Base64 decode the private and public blobs.\n\tprivateBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PrivateKey)))\n\tpublicBlob := make([]byte, base64.StdEncoding.DecodedLen(len(tpmKeys.PublicKey)))\n\tprn, err := base64.StdEncoding.Decode(privateBlob, tpmKeys.PrivateKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to decode privateBlob from base64: %v\", err)\n\t}\n\treturn publicBlob, privateBlob, nil\n}","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L105-L141","documentation":"readTPMKeysFromFile read the JetStream TPM keys file but json.Unmarshal could not parse it into natsTPMPersistedKeys. This means the file exists yet is corrupt, truncated, empty, or was written by an incompatible version — so the sealed key blobs cannot be recovered from disk and unsealing cannot proceed.","triggerScenarios":"Thrown at server/tpm/js_ek_tpm_windows.go:123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the keys file at the reported path for truncation or corruption","Delete the corrupt key file and restart so a new key is created and sealed (note: previously encrypted JetStream data will be unrecoverable)","Restore the file from backup if one exists","Confirm the file was not modified by another process or written by an incompatible NATS version"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}