{"record":{"id":"94a4090a406fcf4e","repo":"cloudflare/cloudflared","slug":"failed-to-marshal-signpayload","errorCode":null,"errorMessage":"failed to marshal signPayload","messagePattern":"failed to marshal signPayload","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sshgen/sshgen.go","lineNumber":110,"sourceCode":"\n\tparsedToken, err := jwt.ParseSigned(token, signatureAlgs)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to parse JWT\")\n\t}\n\n\tclaims := jwt.Claims{}\n\terr = parsedToken.UnsafeClaimsWithoutVerification(&claims)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to retrieve JWT claims\")\n\t}\n\n\tbuf, err := json.Marshal(&signPayload{\n\t\tPublicKey: pubKey,\n\t\tJWT:       token,\n\t\tIssuer:    claims.Issuer,\n\t})\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to marshal signPayload\")\n\t}\n\tvar res *http.Response\n\tif mockRequest != nil {\n\t\tres, err = mockRequest(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t} else {\n\t\tclient := http.Client{\n\t\t\tTimeout: 10 * time.Second,\n\t\t}\n\t\tres, err = client.Post(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t}\n\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to send request\")\n\t}\n\tdefer res.Body.Close()\n\n\tdecoder := json.NewDecoder(res.Body)\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/sshgen/sshgen.go#L92-L128","documentation":"After extracting JWT claims, SignCert marshals a signPayload struct (public key, JWT, issuer) to JSON to POST to the token issuer's sign endpoint. This error means json.Marshal failed on that struct, which is essentially impossible for plain string fields and usually indicates a programming-level problem (nil dereference via bad input types) rather than user input.","triggerScenarios":"json.Marshal of the signPayload struct returns an error — practically only when a field holds an unsupported value such as a channel, func, or cyclic value; with current string fields this is effectively dead defensive code.","commonSituations":"Recompiling sshgen with modified signPayload field types that json cannot encode; extremely rare in normal operation.","solutions":["Confirm signPayload fields are JSON-encodable strings or pointers","Log the underlying wrapped error to identify the offending field","If this appears, it is a code bug — fix the signPayload definition rather than retrying","Add a unit test marshaling a representative signPayload"],"exampleFix":"// before\nbuf, err := json.Marshal(&signPayload{PublicKey: pubKey, JWT: token, Issuer: claims.Issuer})\nif err != nil {\n    return \"\", errors.Wrap(err, \"failed to marshal signPayload\")\n}\n// after\npayload := signPayload{PublicKey: pubKey, JWT: token, Issuer: claims.Issuer}\nbuf, err := json.Marshal(&payload)\nif err != nil {\n    return \"\", errors.Wrap(err, fmt.Sprintf(\"failed to marshal signPayload: unsupported value in %T\", payload))\n}","handlingStrategy":"try-catch","validationCode":"// ensure payload is encodable before the call\nif _, err := json.Marshal(signPayload{PublicKey: pubKey, JWT: token, Issuer: issuer}); err != nil {\n    return fmt.Errorf(\"payload not encodable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := SignCert(token, pubKey); err != nil {\n    if strings.Contains(err.Error(), \"failed to marshal signPayload\") {\n        return fmt.Errorf(\"internal encoding bug: %w\", err)\n    }\n}","preventionTips":["Keep signPayload fields to JSON-encodable types (string, []byte) only","Add a unit test that marshals a representative payload","Treat this error as a code bug, not a runtime condition"],"tags":["json","ssh","serialization"],"backgroundTag":"json-marshal-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}