{"record":{"id":"9df7e9396565be62","repo":"quarkusio/quarkus","slug":"invalid-privatekey-format","errorCode":null,"errorMessage":"Invalid privateKey format","messagePattern":"Invalid privateKey format","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"extensions/smallrye-reactive-messaging-pulsar/runtime/src/main/java/io/quarkus/pulsar/runtime/graal/Substitutions.java","lineNumber":51,"sourceCode":"    private static KeyFile loadPrivateKey(String privateKeyURL) throws IOException {\n        try {\n            URLConnection urlConnection = new org.apache.pulsar.client.api.url.URL(privateKeyURL).openConnection();\n            try {\n                String protocol = urlConnection.getURL().getProtocol();\n                if (\"data\".equals(protocol) && !\"application/json\".equals(urlConnection.getContentType())) {\n                    throw new IllegalArgumentException(\n                            \"Unsupported media type or encoding format: \" + urlConnection.getContentType());\n                }\n                KeyFile privateKey;\n                try (Reader r = new InputStreamReader(urlConnection.getInputStream(), StandardCharsets.UTF_8)) {\n                    privateKey = KeyFile.fromJson(r);\n                }\n                return privateKey;\n            } finally {\n                IOUtils.close(urlConnection);\n            }\n        } catch (URISyntaxException | InstantiationException | IllegalAccessException e) {\n            throw new IOException(\"Invalid privateKey format\", e);\n        }\n    }\n\n}\n","sourceCodeStart":33,"sourceCodeEnd":56,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/smallrye-reactive-messaging-pulsar/runtime/src/main/java/io/quarkus/pulsar/runtime/graal/Substitutions.java#L33-L56","documentation":"The substituted loadPrivateKey wraps URISyntaxException / InstantiationException / IllegalAccessException from parsing and reflecting the Pulsar key URL into an IOException with message 'Invalid privateKey format', signaling the privateKey URL could not be opened or its content parsed as a JSON KeyFile in native mode.","triggerScenarios":"Passing a malformed authPrivateKey/authPublicKey URL to the Pulsar client in native mode: unparsable URIs, unsupported protocols, or corrupt/non-JSON key file contents causing KeyFile.fromJson to fail.","commonSituations":"Typo'd file: URLs, whitespace or newlines in base64 data URIs, PEM keys supplied where JSON keys are expected, keys truncated by config trimming.","solutions":["Verify the key URL is a well-formed file:/data: URI and the file contains valid Pulsar JSON key format (no PEM)","Regenerate the key pair with Pulsar's tokens tool and re-encode the data URI correctly","Check for config-value trimming/escaping issues (newlines, quotes) in application.properties","Load the key from a plain file path (file:) rather than an exotic URL scheme"],"exampleFix":"// before\nquarkus.native... authPrivateKey=-----BEGIN PRIVATE KEY-----...\n// after (valid Pulsar JSON key file)\nquarkus... authPrivateKey=file:/etc/pulsar/private-key.json","handlingStrategy":"validation","validationCode":"static void validatePulsarKeyUrl(String keyUrl) throws IOException {\n    try {\n        new java.net.URI(keyUrl);\n    } catch (URISyntaxException e) {\n        throw new IOException(\"Malformed Pulsar key URL: \" + keyUrl, e);\n    }\n    if (keyUrl.startsWith(\"data:\")) {\n        String payload = new String(Base64.getDecoder().decode(keyUrl.substring(keyUrl.indexOf(\",\") + 1)), StandardCharsets.UTF_8);\n        if (!payload.trim().startsWith(\"{\")) throw new IOException(\"Key is not Pulsar JSON format\");\n    }\n}","typeGuard":"static boolean isWellFormedKeyUrl(String url) {\n    try { new java.net.URI(url); return true; } catch (URISyntaxException e) { return false; }\n}","tryCatchPattern":"try {\n    configurePulsarAuth(keyUrl);\n} catch (PulsarClientException | IOException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Invalid privateKey format\")) {\n        throw new ConfigurationException(\"authPrivateKey/authPublicKey URL or content is invalid for native mode\", e);\n    }\n    throw e;\n}","preventionTips":["Validate key URLs and JSON structure at app startup, before client creation","Avoid PEM keys; Pulsar expects its JSON KeyFile format","Check application.properties for accidental line-wrapping or whitespace in the key value","Test auth config in native mode early; substitutions behave differently than JVM mode"],"tags":["pulsar","native-image","auth","key-format","config"],"backgroundTag":"invalid-key-format","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}