{"record":{"id":"8ced2a7035a0c67c","repo":"hashicorp/terraform","slug":"can-not-read-leafpassphrasebytes-from-s","errorCode":null,"errorMessage":"can not read leafPassphraseBytes from %s","messagePattern":"can not read leafPassphraseBytes from (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":215,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"can not get working directory for current os platform\")\n\t\t}\n\n\t\tcertsDir := filepath.Clean(getEnvSettingWithDefault(\"test_certificates_location\", defaultCertsDir))\n\t\tleafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf certificate from %s\", filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\t}\n\n\t\tleafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_key.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf private key from %s\", filepath.Join(certsDir, \"ip_key.pem\"))\n\t\t}\n\n\t\tleafPassphraseBytes := []byte{}\n\t\tif _, err := os.Stat(certsDir + \"/leaf_passphrase\"); !os.IsNotExist(err) {\n\t\t\tleafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + \"leaf_passphrase\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"can not read leafPassphraseBytes from %s\", filepath.Join(certsDir+\"leaf_passphrase\"))\n\t\t\t}\n\t\t}\n\n\t\tintermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"intermediate.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read intermediate certificate from %s\", filepath.Join(certsDir, \"intermediate.pem\"))\n\t\t}\n\n\t\tintermediateCertificatesBytes := [][]byte{\n\t\t\tintermediateCertificateBytes,\n\t\t}\n\n\t\tcfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L197-L233","documentation":"Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the leaf passphrase file. The code first checks if a file named 'leaf_passphrase' exists (note: the stat check uses certsDir + '/leaf_passphrase' but the read uses certsDir + 'leaf_passphrase' without a separator — a likely path-joining bug in the source). If the stat succeeds but the read fails, this error is returned.","triggerScenarios":"auth=\"InstancePrincipalWithCerts\" is set, the file {certsDir}/leaf_passphrase exists (so the stat check passes), but reading it fails — or it succeeds at an unexpected path due to the missing path separator in the read call (certsDir + 'leaf_passphrase' vs certsDir + '/leaf_passphrase').","commonSituations":"A leaf_passphrase file exists in the certs dir but the path concatenation bug causes the read to look in the wrong location (parent directory); the file exists but has restrictive permissions; user accidentally created a leaf_passphrase file not realizing it triggers this code path.","solutions":["Remove the leaf_passphrase file from the certs directory if your test cert has no passphrase — the code only attempts to read it when it exists.","If a passphrase is needed, ensure the file is readable AND be aware of the path-joining bug: the file may need to exist at the path formed by certsDir+'leaf_passphrase' (no separator) rather than certsDir+'/leaf_passphrase'.","Set test_certificates_location to a directory where the concatenation resolves correctly.","Report the path-joining bug upstream (certsDir + 'leaf_passphrase' should be filepath.Join(certsDir, 'leaf_passphrase'))."],"exampleFix":"// before\n// leaf_passphrase file exists, triggering read at buggy path\n\n// after (if no passphrase needed):\nrm $test_certificates_location/leaf_passphrase\nterraform init\n\n// NOTE: source has a bug: filepath.Join(certsDir+\"leaf_passphrase\") should be\n// filepath.Join(certsDir, \"leaf_passphrase\") — the stat check uses '/leaf_passphrase'\n// but the read uses 'leaf_passphrase' without separator.","handlingStrategy":"validation","validationCode":"// Be aware of the path-joining bug in the source:\n// stat checks: certsDir + \"/leaf_passphrase\"\n// read checks: certsDir + \"leaf_passphrase\" (no separator)\n// The safest approach: remove leaf_passphrase if not needed.\nfunc validatePassphraseFile(certsDir string) error {\n    passphrasePath := filepath.Join(certsDir, \"leaf_passphrase\")\n    if _, err := os.Stat(passphrasePath); err == nil {\n        // File exists — the code will try to read it.\n        // Warn about the path-joining bug.\n        log.Printf(\"WARNING: leaf_passphrase exists; source code has a path-joining bug that may cause read failure\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-check and remove if unnecessary:\np := filepath.Join(certsDir, \"leaf_passphrase\")\nif _, err := os.Stat(p); err == nil {\n    if !passphraseRequired {\n        os.Remove(p) // avoid triggering the buggy read path\n    }\n}","preventionTips":["Remove leaf_passphrase from the certs directory if your test key has no passphrase.","Be aware of the source code bug: the stat check uses '/leaf_passphrase' but the read uses 'leaf_passphrase' without separator.","Report the path-joining bug upstream if it affects your workflow."],"tags":["oci","authentication","filesystem","certificates","instance-principal","bug","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}