{"record":{"id":"9385d71218aa46de","repo":"t8y2/dbx","slug":"unsupported-store-type-q-9385d7","errorCode":null,"errorMessage":"unsupported store type %q","messagePattern":"unsupported store type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":115,"sourceCode":"\t\t\t\tchain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)\n\t\t\t\tif getErr != nil {\n\t\t\t\t\treturn nil, getErr\n\t\t\t\t}\n\t\t\t\tfor _, entry := range chain {\n\t\t\t\t\tcertificate, parseErr := x509.ParseCertificate(entry.Content)\n\t\t\t\t\tif parseErr != nil {\n\t\t\t\t\t\treturn nil, parseErr\n\t\t\t\t\t}\n\t\t\t\t\tcertificates = append(certificates, certificate)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif len(certificates) == 0 {\n\t\t\treturn nil, errors.New(\"JKS truststore contains no certificates\")\n\t\t}\n\t\treturn certificates, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn tls.Certificate{}, err\n\t}\n\tswitch normalizedStoreType(storeType, path) {\n\tcase \"PEM\":\n\t\treturn tls.X509KeyPair(contents, contents)\n\tcase \"PKCS12\":\n\t\tprivateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)\n\t\tif err != nil {\n\t\t\treturn tls.Certificate{}, err\n\t\t}\n\t\tresult := tls.Certificate{PrivateKey: privateKey, Leaf: certificate}\n\t\tresult.Certificate = append(result.Certificate, certificate.Raw)","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L97-L133","documentation":"loadTrustStore only recognizes the store types supported by normalizedStoreType; any other 'zookeepertruststoretype' value hits the default branch and produces 'unsupported store type %q'. This guards against silently parsing a truststore with the wrong decoder.","triggerScenarios":"buildTLSConfig or buildZooKeeperTLSConfig calls loadTrustStore with a storeType that normalizedStoreType cannot resolve to a known format (e.g. 'PFX-BUNDLE', empty type with a path that doesn't imply a known extension, or a typo like 'JKSX').","commonSituations":"Setting zookeepertruststoretype=JKS on a PKCS12 file or vice versa; using a casing/spacing variant outside the normalized set; forgetting to set the type for a PEM truststore.","solutions":["Set zookeepertruststoretype to a supported value: JKS, PKCS12, or PEM","Verify the type matches the actual file contents (PKCS12 files often carry a .p12/.pfx extension)","Check normalizedStoreType in zookeeper_tls.go for the exact accepted values and normalization rules","If the file is a plain PEM bundle, either set type=PEM or omit the type if the default resolves it"],"exampleFix":"// before\nparams: zookeepertruststorelocation=trust.jks, zookeepertruststoretype=PFX\n// after\nparams: zookeepertruststorelocation=trust.jks, zookeepertruststoretype=JKS","handlingStrategy":"validation","validationCode":"func validateTrustStoreType(storeType string) error {\n  switch strings.ToUpper(strings.TrimSpace(storeType)) {\n  case \"\", \"JKS\", \"PKCS12\", \"PEM\":\n    return nil\n  default:\n    return fmt.Errorf(\"unsupported truststore type %q (use JKS, PKCS12 or PEM)\", storeType)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set zookeepertruststoretype explicitly to a known value","Verify file format matches declared type (file magic bytes for JKS/PKCS12)"],"tags":["tls","zookeeper","keystore","config"],"backgroundTag":"unsupported-keystore-type","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}