{"record":{"id":"aa2761ba4fb06aae","repo":"kubernetes/kops","slug":"empty-pkcs7-signature","errorCode":null,"errorMessage":"empty PKCS7 signature","messagePattern":"empty PKCS7 signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":235,"sourceCode":"\tintermediateCerts, err := fetchIntermediates(signer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fetching intermediate certificates: %w\", err)\n\t}\n\tif err := verifySignerCertChain(signer, p7.Certificates, rootCertPool, intermediateCerts); err != nil {\n\t\treturn nil, fmt.Errorf(\"verifying PKCS7 certificate chain: %w\", err)\n\t}\n\tklog.V(4).Infof(\"PKCS7 certificate chain verified after resolving intermediate certificates for signer issuer %q\", signer.Issuer)\n\n\treturn data, nil\n}\n\n// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its\n// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata\n// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call\n// before triggering intermediate certificate fetches.\nfunc parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {\n\tif signature == \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"empty PKCS7 signature\")\n\t}\n\n\tsigBytes, err := base64.StdEncoding.DecodeString(signature)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"decoding PKCS7 signature: %w\", err)\n\t}\n\tklog.V(4).Infof(\"Decoded PKCS7 signature (%d bytes)\", len(sigBytes))\n\n\tp7, err := pkcs7.Parse(sigBytes)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"parsing PKCS7 signature: %w\", err)\n\t}\n\tklog.V(8).Infof(\"Parsed PKCS7 structure with %d embedded certificate(s)\", len(p7.Certificates))\n\n\t// Verify the PKCS7 signature against the embedded leaf certificate.\n\tif err := p7.Verify(); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"verifying PKCS7 signature: %w\", err)\n\t}","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L217-L253","documentation":"Guard error in parseAndValidatePKCS7Signer: the decoded token's PKCS7 signature blob is empty, so there is nothing to parse or verify. The client sent a well-formed token prefix with an empty payload.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:235 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the bootstrap token","Regenerate the token on the node (restart nodeup / kubelet bootstrap attempt) so a full signature is sent"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}