{"record":{"id":"71a3fd1b67e3532e","repo":"hashicorp/nomad","slug":"w-must-be-absolute-got-s","errorCode":null,"errorMessage":"%w: must be absolute; got: %s","messagePattern":"%w: must be absolute; got: (.+?)","errorType":"validation","errorClass":"ErrInvalidClientAssertionKeyPath","httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":1864,"sourceCode":"\n// Validate ensures that one Key and one Cert or KeyID are provided,\n// and that the key ID header is valid for the provided KeyID or cert.\nfunc (k *OIDCClientAssertionKey) Validate() error {\n\tif k == nil {\n\t\treturn nil\n\t}\n\n\t// mutually exclusive key fields\n\t// must have key file or base64, but not both\n\tif k.PemKey == \"\" && k.PemKeyFile == \"\" {\n\t\treturn ErrMissingClientAssertionKey\n\t}\n\tif k.PemKey != \"\" && k.PemKeyFile != \"\" {\n\t\treturn ErrAmbiguousClientAssertionKey\n\t}\n\tif k.PemKeyFile != \"\" {\n\t\tif !path.IsAbs(k.PemKeyFile) {\n\t\t\treturn fmt.Errorf(\"%w: must be absolute; got: %s\", ErrInvalidClientAssertionKeyPath, k.PemKeyFile)\n\t\t}\n\t}\n\n\t// mutually exclusive cert fields\n\t// must have exactly one of: cert file or base64, or keyid\n\tif k.PemCert == \"\" && k.PemCertFile == \"\" && k.KeyID == \"\" {\n\t\treturn ErrMissingClientAssertionKeyID\n\t}\n\tif k.PemCert != \"\" && (k.PemCertFile != \"\" || k.KeyID != \"\") {\n\t\treturn ErrAmbiguousClientAssertionKeyID\n\t}\n\tif k.PemCertFile != \"\" && (k.PemCert != \"\" || k.KeyID != \"\") {\n\t\treturn ErrAmbiguousClientAssertionKeyID\n\t}\n\tif k.KeyID != \"\" && (k.PemCert != \"\" || k.PemCertFile != \"\") {\n\t\treturn ErrAmbiguousClientAssertionKeyID\n\t}\n\tif k.PemCertFile != \"\" {","sourceCodeStart":1846,"sourceCodeEnd":1882,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L1846-L1882","documentation":"Part of OIDCClientAssertionKey.Validate(): when a PemKeyFile is provided it must be an absolute filesystem path, because the Nomad server reads the key material locally. A relative path cannot be resolved reliably, so validation fails with ErrInvalidClientAssertionKeyPath wrapped with this message.","triggerScenarios":"Submitting an OIDC client assertion key config with pem_key_file set to a relative path like \"client.key\" or \"./keys/client.key\" instead of \"/etc/nomad/keys/client.key\".","commonSituations":"Config written on a laptop with relative paths then deployed to the server; templating tools producing relative paths; assuming Nomad resolves paths relative to the config file.","solutions":["Change pem_key_file to an absolute path, e.g. /etc/nomad.d/keys/client.key.","If the path is generated dynamically, prefix it with the base directory at render time.","Alternatively inline the key via pem_key to avoid file paths entirely."],"exampleFix":"// before\npem_key_file = \"keys/client.key\"\n\n// after\npem_key_file = \"/etc/nomad.d/keys/client.key\"","handlingStrategy":"validation","validationCode":"if k.PemKeyFile != \"\" && !path.IsAbs(k.PemKeyFile) {\n    return fmt.Errorf(\"pem_key_file must be absolute, got %q\", k.PemKeyFile)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Resolve paths with filepath.Abs at config-render time.","Never use relative paths in server-side file references.","Verify the file exists on the Nomad server host before applying."],"tags":["nomad","acl","oidc","file-path","validation"],"backgroundTag":"path-must-be-absolute","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}