{"record":{"id":"8bd50398b6c90fac","repo":"nats-io/nats-server","slug":"tpm-functionality-is-not-supported-on-this-platfor","errorCode":null,"errorMessage":"TPM functionality is not supported on this platform","messagePattern":"TPM functionality is not supported on this platform","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_other.go","lineNumber":22,"sourceCode":"// You may obtain a copy of the License at\n//\n// http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\n//go:build !windows\n\npackage tpm\n\nimport \"fmt\"\n\n// LoadJetStreamEncryptionKeyFromTPM here is a stub for unsupported platforms.\nfunc LoadJetStreamEncryptionKeyFromTPM(srkPassword, jsKeyFile, jsKeyPassword string, pcr int) (string, error) {\n\treturn \"\", fmt.Errorf(\"TPM functionality is not supported on this platform\")\n}\n","sourceCodeStart":4,"sourceCodeEnd":24,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_other.go#L4-L24","documentation":"This is the build-tag stub of the TPM package used on platforms without TPM support (js_ek_tpm_other.go). LoadJetStreamEncryptionKeyFromTPM unconditionally returns this error, so requesting JetStream encryption key loading from a TPM on an unsupported OS/build always fails. Only builds with TPM support (the corresponding platform-specific file) can load keys from a TPM.","triggerScenarios":"Calling initJetStreamEncryption configured to source the JetStream encryption key from a TPM (via TPM-related config such as srk password, key file, key password, and PCR) on a platform compiled without TPM support; i.e., invoking LoadJetStreamEncryptionKeyFromTPM in a non-TPM build.","commonSituations":"Running nats-server built from source with default tags on Linux without the TPM-enabled variant, deploying a container image without TPM device passthrough/support, or copying a config with TPM key settings between machines with different platforms.","solutions":["Use a nats-server build compiled with TPM support for your platform (the platform-specific implementation file)","Remove the TPM-based encryption key configuration and supply the JetStream encryption key via a non-TPM mechanism (key file/environment)","If hardware TPM is intended, verify /dev/tpm* or the TPM device is available and the binary variant supports it","Fall back to software-based encryption keys on unsupported platforms"],"exampleFix":"// before (server config on unsupported platform)\njetstream {\n  key_source: tpm\n}\n// after\njetstream {\n  key_file: \"/etc/nats/enc.key\"\n}","handlingStrategy":"fallback","validationCode":"// at startup, guard TPM key loading with a platform check\nif !tpmSupported() || tpmDeviceMissing() {\n    key, err := loadKeyFromFile(\"/etc/nats/enc.key\")\n    if err != nil { return err }\n}","typeGuard":"func tpmAvailable() bool {\n    if runtime.GOOS == \"windows\" { return false } // build without TPM support\n    if _, err := os.Stat(\"/dev/tpmrm0\"); err != nil { return false }\n    return true\n}","tryCatchPattern":"key, err := tpm.LoadJetStreamEncryptionKeyFromTPM(srk, file, pass, pcr)\nif err != nil && strings.Contains(err.Error(), \"not supported on this platform\") {\n    key, err = loadSoftwareKeyFallback() // file/env based key\n}","preventionTips":["Check platform/TPM support before configuring TPM-based key loading","Deploy TPM-enabled server builds where TPM keys are required","Pass through TPM devices into containers","Always configure a non-TPM key fallback for portability"],"tags":["tpm","platform","encryption","jetstream"],"backgroundTag":"tpm-unsupported-platform","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}