{"record":{"id":"aa09ea0194b35a99","repo":"goharbor/harbor","slug":"invalid","errorCode":null,"errorMessage":"invalid {}","messagePattern":"invalid (.+?)","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"make/photon/prepare/models.py","lineNumber":76,"sourceCode":"            if filename in self.required_filenames:\n                return os.path.join(self.data_volume, 'secret', 'tls', filename)\n\n        return object.__getattribute__(self, name)\n\n    def _check(self, filename: str):\n        \"\"\"\n        Check cert and key files are correct\n        \"\"\"\n\n        path = Path(os.path.join(internal_tls_dir, filename))\n\n        if not path.exists:\n            if filename == 'harbor_internal_ca.crt':\n                return\n            raise Exception('File {} not exist'.format(filename))\n\n        if not path.is_file:\n            raise Exception('invalid {}'.format(filename))\n\n        # check key file permission\n        if filename.endswith('.key') and not check_permission(path, mode=0o600):\n            raise Exception('key file {} permission is not 600'.format(filename))\n\n        # check certificate file\n        if filename.endswith('.crt'):\n            if not owner_can_read(path.stat().st_mode):\n                # check owner can read cert file\n                raise Exception('File {} should readable by owner'.format(filename))\n            if not san_existed(path):\n                # check SAN included\n                if filename == 'harbor_internal_ca.crt':\n                    return\n                raise Exception('cert file {} should include SAN'.format(filename))\n\n    def validate(self):\n        if not self.enabled:","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/make/photon/prepare/models.py#L58-L94","documentation":"MergeNativeReport in src/pkg/scan/report/report.go is the merger bound to the native vulnerability mime types (v1.MimeTypeNativeReport and v1.MimeTypeGenericVulnerabilityReport in SupportedMergers). It type-asserts each operand to *vuln.Report; this instance fires when the FIRST operand r1 is not a *vuln.Report pointer — it may be nil, a different model, or a vuln.Report taken by value.","triggerScenarios":"Reports.ResolveData(mimeType) selecting MergeNativeReport while the decoded first report resolved to another type — e.g. SupportedMimes maps the mime to a non-native model, or a caller merged values instead of pointers.","commonSituations":"Registering a custom mime type in SupportedMimes without also binding a matching merger in SupportedMergers; version skew between the adapter's report schema and the Harbor vuln package; passing vuln.Report{} instead of &vuln.Report{}.","solutions":["Ensure both operands are *vuln.Report pointers produced by the same ResolveData path used for the merge","Check the SupportedMimes entry for the mime type in play — the model it resolves must match the merger registered in SupportedMergers","Align scanner adapter and Harbor versions so reports decode into the native model"],"exampleFix":"// before\nmerged, err := report.MergeNativeReport(r1, r2) // r1, r2 are `any`\n\n// after\nnr1, ok1 := r1.(*vuln.Report)\nnr2, ok2 := r2.(*vuln.Report)\nif !ok1 || !ok2 {\n    return nil, fmt.Errorf(\"cannot merge: operands are %T and %T, want *vuln.Report\", r1, r2)\n}\nmerged, err := report.MergeNativeReport(nr1, nr2)","handlingStrategy":"type-guard","validationCode":"if !isNativeReport(r1) || !isNativeReport(r2) {\n    return fmt.Errorf(\"merge operands must be native reports, got %T and %T\", r1, r2)\n}","typeGuard":"func isNativeReport(v any) bool {\n    _, ok := v.(*vuln.Report)\n    return ok\n}","tryCatchPattern":"if _, err := report.MergeNativeReport(r1, r2); err != nil {\n    if strings.Contains(err.Error(), \"native report required\") {\n        log.Printf(\"mime/data mismatch in merge: r1=%T r2=%T\", r1, r2) // inspect SupportedMimes mapping\n    }\n    return err\n}","preventionTips":["Keep mime-to-model (SupportedMimes) and mime-to-merger (SupportedMergers) maps consistent for any custom mime","Always merge values produced by ResolveData, not hand-built ones","Log %T of operands when a merge fails to catch value-vs-pointer mistakes"],"tags":["go","harbor","type-assertion","scan","merge"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}