{"record":{"id":"c2f051f9fac3ab65","repo":"slackhq/nebula","slug":"notimplemented","errorCode":"notImplemented","errorMessage":"not implemented","messagePattern":"not implemented","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient_stub.go","lineNumber":10,"sourceCode":"//go:build !cgo || !pkcs11\n\npackage pkclient\n\nimport \"errors\"\n\ntype PKClient struct {\n}\n\nvar notImplemented = errors.New(\"not implemented\")\n\nfunc New(hsmPath string, slotId uint, pin string, id string, label string) (*PKClient, error) {\n\treturn nil, notImplemented\n}\n\nfunc (c *PKClient) Close() error {\n\treturn nil\n}\n\nfunc (c *PKClient) SignASN1(data []byte) ([]byte, error) {\n\treturn nil, notImplemented\n}\n\nfunc (c *PKClient) DeriveNoise(_ []byte) ([]byte, error) {\n\treturn nil, notImplemented\n}\n\nfunc (c *PKClient) GetPubKey() ([]byte, error) {","sourceCodeStart":1,"sourceCodeEnd":28,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient_stub.go#L1-L28","documentation":"The stub pkclient (built without the PKCS#11/HSM backend, e.g. on unsupported platforms or without the cgo build tag) provides a PKClient that can never be constructed: New returns the sentinel notImplemented, and SignASN1/DeriveNoise/GetPubKey would do the same. It exists only to satisfy compilation on platforms without HSM support.","triggerScenarios":"Calling pkclient.New(hsmPath, slotId, pin, id, label) in a build that compiled pkclient_stub.go instead of the real implementation — i.e. a binary built without the HSM/PKCS#11 backend (wrong GOOS, missing cgo, or missing build tag).","commonSituations":"Deploying a binary built for a platform without HSM support while config points at an HSM (pkcs11 path/slot/pin set); CI producing default-build artifacts then running on HSM-backed nodes; forgetting the required build tag (e.g. -tags hsm) when compiling.","solutions":["Rebuild the binary with the PKCS#11/HSM backend enabled (correct build tags / cgo enabled).","Verify GOOS/GOARCH supports the pkclient implementation, and cross-compile with CGO_ENABLED=1 and the proper toolchain.","If HSM is not intended, remove hsm/pkcs11 settings from the config so the stub path is never invoked.","Check build pipeline tags to ensure production artifacts match the feature set needed on that host.","At runtime, detect notImplemented early and fail fast with a clear message that this binary lacks HSM support."],"exampleFix":"// before: plain build, stub compiled in\ngo build -o node ./cmd/node\n// after: build with HSM/PKCS11 backend\ngo build -tags hsm -o node ./cmd/node\n// runtime guard:\nclient, err := pkclient.New(hsmPath, slot, pin, id, label)\nif errors.Is(err, pkclient.ErrNotImplemented) {\n    log.Fatal(\"binary built without HSM support; rebuild with hsm tag\")\n}","handlingStrategy":"try-catch","validationCode":"// Go: detect stub build before relying on HSM features\nclient, err := pkclient.New(hsmPath, slot, pin, id, label)\nif err != nil {\n    if err.Error() == \"not implemented\" {\n        log.Fatal(\"binary built without HSM (pkclient stub); rebuild with hsm build tag\")\n    }\n    return err\n}","typeGuard":null,"tryCatchPattern":"client, err := pkclient.New(hsmPath, slotId, pin, id, label)\nif err != nil {\n    if strings.Contains(err.Error(), \"not implemented\") {\n        return fmt.Errorf(\"pkclient unavailable: rebuild with the pkcs11/hsm build tag\")\n    }\n    return err\n}","preventionTips":["Build production binaries with the HSM/PKCS11 build tag and CGO enabled.","Fail fast at startup when HSM is configured but New returns notImplemented.","Pin build tags per environment so HSM-backed nodes get HSM-enabled artifacts.","Add a CI check that the artifact for HSM hosts actually links the real pkclient."],"tags":["hsm","pkcs11","build-tags","stub","cgo"],"backgroundTag":"not-implemented-on-this-platform","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}