{"record":{"id":"ad4fb8ea562778c7","repo":"slackhq/nebula","slug":"erremptysignature","errorCode":"ErrEmptySignature","errorMessage":"empty signature","messagePattern":"empty signature","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/errors.go","lineNumber":38,"sourceCode":"\tErrPublicPrivateKeyMismatch   = errors.New(\"public key and private key are not a pair\")\n\tErrPrivateKeyEncrypted        = errors.New(\"private key must be decrypted\")\n\tErrCaNotFound                 = errors.New(\"could not find ca for the certificate\")\n\tErrUnknownVersion             = errors.New(\"certificate version unrecognized\")\n\tErrCertPubkeyPresent          = errors.New(\"certificate has unexpected pubkey present\")\n\tErrCurveMismatch              = errors.New(\"certificate curve does not match CA\")\n\n\tErrInvalidPEMBlock                   = errors.New(\"input did not contain a valid PEM encoded block\")\n\tErrInvalidPEMCertificateBanner       = errors.New(\"bytes did not contain a proper certificate banner\")\n\tErrInvalidPEMX25519PublicKeyBanner   = errors.New(\"bytes did not contain a proper X25519 public key banner\")\n\tErrInvalidPEMX25519PrivateKeyBanner  = errors.New(\"bytes did not contain a proper X25519 private key banner\")\n\tErrInvalidPEMEd25519PublicKeyBanner  = errors.New(\"bytes did not contain a proper Ed25519 public key banner\")\n\tErrInvalidPEMEd25519PrivateKeyBanner = errors.New(\"bytes did not contain a proper Ed25519 private key banner\")\n\n\tErrNoPeerStaticKey = errors.New(\"no peer static key was present\")\n\tErrNoPayload       = errors.New(\"provided payload was empty\")\n\n\tErrMissingDetails  = errors.New(\"certificate did not contain details\")\n\tErrEmptySignature  = errors.New(\"empty signature\")\n\tErrEmptyRawDetails = errors.New(\"empty rawDetails not allowed\")\n)\n\ntype ErrInvalidCertificateProperties struct {\n\tstr string\n}\n\nfunc NewErrInvalidCertificateProperties(format string, a ...any) error {\n\treturn &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}\n}\n\nfunc (e *ErrInvalidCertificateProperties) Error() string {\n\treturn e.str\n}\n","sourceCodeStart":20,"sourceCodeEnd":53,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/errors.go#L20-L53","documentation":"ErrEmptySignature is returned by setSignature on both certificateV1 and certificateV2 when the provided signature byte slice has length zero. Certificates must carry a non-empty signature; setting an empty one would produce an unverifiable certificate.","triggerScenarios":"Calling setSignature([]) or setSignature(nil) on a certificateV1 or certificateV2 — usually after a signing function returned empty bytes or its error was ignored.","commonSituations":"Signing step failed upstream (bad private key) but the empty result was passed through; a zero-length signature decoded from a malformed certificate blob; test harness passing empty signature fixtures.","solutions":["Check the error from the signing call before passing its output to setSignature","Verify the signer's private key is valid and produced non-empty output","Reject empty signature bytes at the decoding boundary before invoking setSignature"],"exampleFix":"// before\nsig, _ := signer.Sign(data) // error ignored, sig empty\nc.setSignature(sig)\n// after\nsig, err := signer.Sign(data)\nif err != nil || len(sig) == 0 {\n    return fmt.Errorf(\"signing failed\")\n}\nc.setSignature(sig)","handlingStrategy":"validation","validationCode":"if len(sig) == 0 {\n    return fmt.Errorf(\"refusing to set empty signature\")\n}","typeGuard":null,"tryCatchPattern":"if err := c.setSignature(sig); errors.Is(err, cert.ErrEmptySignature) {\n    // signing step produced nothing; investigate signer/key\n}","preventionTips":["Always check the signing call's error before using its output","Assert signature non-emptiness in tests and fixtures","Surface signer failures instead of passing empty byte slices downstream"],"tags":["signature","certificate","signing"],"backgroundTag":"empty-signature","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}