{"record":{"id":"767a97d066b8ec03","repo":"OpenNHP/opennhp","slug":"failed-to-download-hrk-v","errorCode":null,"errorMessage":"failed to download HRK: %v","messagePattern":"failed to download HRK: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":297,"sourceCode":"\t\tY:     yBig,\n\t}\n\n\trBig := new(big.Int).SetBytes(r)\n\tsBig := new(big.Int).SetBytes(s)\n\n\tif VerifySignature(pubKey, msgAllDigest, rBig, sBig) {\n\t\treturn nil\n\t} else {\n\t\treturn fmt.Errorf(\"failed to verify signature\")\n\t}\n}\n\nfunc (a *Attestation) verifyCertChain(chipId string) error {\n\t// Download HRK from Hygon's certificate server\n\tif a.hrk == nil {\n\t\tresp, err := http.Get(\"https://cert.hygon.cn/hrk\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download HRK: %v\", err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn fmt.Errorf(\"unexpected status code when download HRK: %d\", resp.StatusCode)\n\t\t}\n\n\t\t// Read the response body (HRK content)\n\t\thrkData, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read HRK data: %v\", err)\n\t\t}\n\n\t\ta.hrk = hrkData\n\t}\n\n\tdigest, err := Sm3Digest(a.hrk)\n\tif err != nil {","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L279-L315","documentation":"verifyCertChain downloads the Hygon Root Key (HRK) from https://cert.hygon.cn/hrk on first use; this error wraps any transport-level failure of that http.Get (DNS failure, connection refused, TLS error, timeout). It means the verifier could not reach Hygon's certificate server at all, so no network response was obtained.","triggerScenarios":"First call to verifyCertChain when a.hrk is nil and http.Get(\"https://cert.hygon.cn/hrk\") returns a non-nil error: offline machine, DNS resolution failure, blocked egress (firewall/proxy), TLS interception, or the host being unreachable.","commonSituations":"Running in an air-gapped/private datacenter without egress to cert.hygon.cn; corporate proxy required but not configured (HTTPS_PROXY unset); China-CDN connectivity issues from other regions; DNS misconfiguration in containers.","solutions":["Check network connectivity: curl -v https://cert.hygon.cn/hrk from the host running the verifier.","Configure proxy environment variables (HTTPS_PROXY) if the environment routes egress through a proxy.","Pre-populate the HRK (set a.hrk) or cache it locally so the verifier does not need to fetch it at verification time.","Add a retry with timeout around the fetch, since transient network failures abort the whole attestation.","If the domain is unreachable permanently, pin the HRK blob locally after authenticating it against the known digest."],"exampleFix":"// before: single blocking fetch, no timeout\nresp, err := http.Get(\"https://cert.hygon.cn/hrk\")\n// after: client with timeout + load HRK from local cache/fallback\nclient := &http.Client{Timeout: 15 * time.Second}\nresp, err := client.Get(\"https://cert.hygon.cn/hrk\")\nif err != nil {\n\thrk, ferr := os.ReadFile(hrkCachePath)\n\tif ferr != nil {\n\t\treturn fmt.Errorf(\"failed to download HRK: %v\", err)\n\t}\n\ta.hrk = hrk\n}","handlingStrategy":"retry","validationCode":"// check reachability before attestation\nresp, err := http.Head(\"https://cert.hygon.cn/hrk\")\nif err != nil {\n\tlog.Printf(\"Hygon cert server unreachable: %v — will need pinned HRK\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := att.Verify(chipId); err != nil {\n\tif strings.Contains(err.Error(), \"failed to download HRK\") {\n\t\t// offline fallback: load pinned HRK and retry\n\t\thrk, ferr := os.ReadFile(\"/etc/nhp/hrk.bin\")\n\t\tif ferr == nil {\n\t\t\tatt.HRK = hrk\n\t\t\treturn att.Verify(chipId)\n\t\t}\n\t}\n\treturn err\n}","preventionTips":["Pre-download and pin the HRK so verification works offline.","Ensure egress/allowlist rules for cert.hygon.cn in datacenter firewalls.","Set HTTPS_PROXY correctly in containerized/enterprise environments.","Add retry with exponential backoff around attestation."],"tags":["network","http","hrk-download","attestation"],"backgroundTag":"network-request-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}