{"record":{"id":"6e96817dc001b8c1","repo":"slackhq/nebula","slug":"errnopeerstatickey","errorCode":"ErrNoPeerStaticKey","errorMessage":"no peer static key was present","messagePattern":"no peer static key was present","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":34,"sourceCode":"\tErrSignatureMismatch          = errors.New(\"certificate signature did not match\")\n\tErrInvalidPublicKey           = errors.New(\"invalid public key\")\n\tErrInvalidPrivateKey          = errors.New(\"invalid private key\")\n\tErrPublicPrivateCurveMismatch = errors.New(\"public key does not match private key curve\")\n\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")\n\tErrInvalidPEMEd25519PrivateKeyBanner = errors.New(\"bytes did not contain a proper Ed25519 private key banner\")\n\n\tErrNoPeerStaticKey = errors.New(\"no peer static key was present\")\n\tErrNoPayload       = errors.New(\"provided payload was empty\")\n\n\tErrMissingDetails  = errors.New(\"certificate did not contain details\")\n\tErrEmptySignature  = errors.New(\"empty signature\")\n\tErrEmptyRawDetails = errors.New(\"empty rawDetails not allowed\")\n)\n\ntype ErrInvalidCertificateProperties struct {\n\tstr string\n}\n\nfunc NewErrInvalidCertificateProperties(format string, a ...any) error {\n\treturn &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}\n}\n\nfunc (e *ErrInvalidCertificateProperties) Error() string {\n\treturn e.str\n}","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L16-L52","documentation":"ErrNoPeerStaticKey is returned by Recombine when the publicKey argument is nil. Recombine reassembles a peer certificate from its raw bytes plus the peer's static public key; without that key the certificate cannot be completed, so the call fails fast.","triggerScenarios":"Calling cert.Recombine(version, rawCertBytes, nil, curve) — i.e. the peer's static public key slice is nil, typically because key loading failed or was skipped earlier.","commonSituations":"Peer handshake data missing the static key field; config where the peer public key env var is unset; deserialization of handshake messages that omitted the key; attempting Recombine before receiving the peer's key exchange message.","solutions":["Ensure the peer's static public key is loaded and non-nil before calling Recombine","Fix upstream key loading (config/env/file) so the peer key bytes are actually populated","Return/handle the missing-key condition earlier in the handshake flow instead of calling Recombine"],"exampleFix":"// before\ncert, err := Recombine(v, raw, peerPub, curve) // peerPub == nil\n// after\nif peerPub == nil {\n    return nil, fmt.Errorf(\"peer static key missing\")\n}\ncert, err := Recombine(v, raw, peerPub, curve)","handlingStrategy":"validation","validationCode":"if publicKey == nil {\n    return fmt.Errorf(\"peer static key missing; cannot Recombine\")\n}","typeGuard":"func hasPeerKey(b []byte) bool { return len(b) > 0 }","tryCatchPattern":"c, err := cert.Recombine(v, raw, peerPub, curve)\nif errors.Is(err, cert.ErrNoPeerStaticKey) {\n    // defer until the peer's key exchange message arrives\n}","preventionTips":["Only call Recombine after the peer's static key has been received and stored","Fail fast at handshake message decoding when the static key field is absent","Log nil-key conditions at the source of key loading"],"tags":["handshake","peer-key","nil-argument"],"backgroundTag":"missing-peer-public-key","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}