{"record":{"id":"775dd39e6959a799","repo":"temporalio/temporal","slug":"history-was-mutated","errorCode":null,"errorMessage":"history was mutated","messagePattern":"history was mutated","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/archiver/constants.go","lineNumber":31,"sourceCode":"\tArchiveSkippedInfoMsg = \"Archive method encountered not found error and skipped the archival\"\n\n\t// ErrReasonInvalidURI is the error reason for invalid URI\n\tErrReasonInvalidURI = \"URI is invalid\"\n\t// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request\n\tErrReasonInvalidArchiveRequest = \"archive request is invalid\"\n\t// ErrReasonReadHistory is the error reason for failing to read history\n\tErrReasonReadHistory = \"failed to read history batches\"\n\t// ErrReasonHistoryMutated is the error reason for mutated history\n\tErrReasonHistoryMutated = \"history was mutated\"\n)\n\nvar (\n\t// ErrInvalidURI is the error for invalid URI\n\tErrInvalidURI = errors.New(\"URI is invalid\")\n\t// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver\n\tErrURISchemeMismatch = errors.New(\"URI scheme does not match the archiver\")\n\t// ErrHistoryMutated is the error for mutated history\n\tErrHistoryMutated = errors.New(\"history was mutated\")\n\t// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request\n\tErrInvalidGetHistoryRequest = errors.New(\"get archived history request is invalid\")\n\t// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request\n\tErrInvalidQueryVisibilityRequest = errors.New(\"query visiblity request is invalid\")\n\t// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token\n\tErrNextPageTokenCorrupted = errors.New(\"next page token is corrupted\")\n\t// ErrHistoryNotExist is the error for non-exist history\n\tErrHistoryNotExist = errors.New(\"requested workflow history does not exist\")\n)\n","sourceCodeStart":13,"sourceCodeEnd":41,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/archiver/constants.go#L13-L41","documentation":"This is a wrapping error: validateCAs failed while checking the ServerTLS.ClientCAFiles entries. Each element must be a non-empty string naming a CA bundle file used to verify client certificates in mTLS. The wrapped error is almost always an empty-string entry.","triggerScenarios":"Calling validateGroupTLS/validateServerTLS with ServerTLS.ClientCAFiles containing an empty or whitespace-only path string.","commonSituations":"A Helm/K8s values merge leaving an empty list element; a config snippet like client_ca_files: [\"\"]; automated tooling appending an empty path when no extra CA is needed.","solutions":["Remove empty strings from the ClientCAFiles list.","If no client CAs are needed, set ClientCAFiles to an empty list instead of [\"\"].","Fix the templating/values logic that inserts the empty path.","Verify each listed file exists and contains valid PEM CA certificates."],"exampleFix":"// before\nClientCAFiles: [\"/etc/temporal/ca.pem\", \"\"]\n// after\nClientCAFiles: [\"/etc/temporal/ca.pem\"]","handlingStrategy":"validation","validationCode":"for i, f := range cfg.ClientCAFiles {\n\tif strings.TrimSpace(f) == \"\" {\n\t\treturn fmt.Errorf(\"ClientCAFiles[%d] is empty\", i)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use empty lists ([]) instead of lists containing empty strings.","Helm/Kustomize: use defaulting/trimming so optional CA paths render as [] not [\"\"].","Verify each CA file path exists in the container image or mounted volume."],"tags":["tls","config-validation","ca-certificates"],"backgroundTag":"tls-config-conflict","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}