{"record":{"id":"8e09976bb4b95aab","repo":"kubernetes/kops","slug":"loading-system-certificate-pool-w","errorCode":null,"errorMessage":"loading system certificate pool: %w","messagePattern":"loading system certificate pool: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":108,"sourceCode":"\trootCertPool *x509.CertPool\n\n\t// positiveCache caches successful intermediate fetches. negativeCache caches recent fetch\n\t// failures for a shorter window, keyed the same way, so attackers cannot amplify fetches via\n\t// bogus AIA URLs. Stores are read positive-first; transient overlap is harmless.\n\tpositiveCache expirationcache.Store\n\tnegativeCache expirationcache.Store\n\n\t// client is reused for intermediate fetches so each lookup does not build a new transport\n\t// stack. The allowlist lives in URL validation, not in the client.\n\tclient *http.Client\n}\n\n// newAttestationVerifier returns an attestationVerifier anchored at the system root certificate\n// pool.\nfunc newAttestationVerifier() (*attestationVerifier, error) {\n\trootCertPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"loading system certificate pool: %w\", err)\n\t}\n\n\treturn &attestationVerifier{\n\t\trootCertPool:  rootCertPool,\n\t\tpositiveCache: expirationcache.NewTTLStore(intermediateCertCacheEntryKeyFunc, intermediateCertRefreshInterval),\n\t\tnegativeCache: expirationcache.NewTTLStore(intermediateCertCacheEntryKeyFunc, intermediateCertNegativeCacheInterval),\n\t\tclient:        &http.Client{Timeout: 10 * time.Second},\n\t}, nil\n}\n\n// intermediateCertCacheEntry is the object stored in the TTLStore caches.\ntype intermediateCertCacheEntry struct {\n\tkey  string\n\tpool *x509.CertPool\n}\n\n// intermediateCertCacheEntryKeyFunc is the TTLStore key function for cache entries.\nfunc intermediateCertCacheEntryKeyFunc(obj any) (string, error) {","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L90-L126","documentation":"newAttestationVerifier could not load the OS trust store via x509.SystemCertPool while preparing root CA verification for Azure attestation. Fires on platform issues reading the system certificate bundle.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the system CA bundle exists and is readable (e.g. /etc/ssl/certs on Linux)","Set SSL_CERT_FILE/SSL_CERT_DIR to a valid bundle as a workaround"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}