{"record":{"id":"c5e04aacef27fdc8","repo":"temporalio/temporal","slug":"next-page-token-is-corrupted","errorCode":null,"errorMessage":"next page token is corrupted","messagePattern":"next page token is corrupted","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/archiver/constants.go","lineNumber":37,"sourceCode":"\t// ErrReasonReadHistory is the error reason for failing to read history\n\tErrReasonReadHistory = \"failed to read history batches\"\n\t// ErrReasonHistoryMutated is the error reason for mutated history\n\tErrReasonHistoryMutated = \"history was mutated\"\n)\n\nvar (\n\t// ErrInvalidURI is the error for invalid URI\n\tErrInvalidURI = errors.New(\"URI is invalid\")\n\t// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver\n\tErrURISchemeMismatch = errors.New(\"URI scheme does not match the archiver\")\n\t// ErrHistoryMutated is the error for mutated history\n\tErrHistoryMutated = errors.New(\"history was mutated\")\n\t// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request\n\tErrInvalidGetHistoryRequest = errors.New(\"get archived history request is invalid\")\n\t// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request\n\tErrInvalidQueryVisibilityRequest = errors.New(\"query visiblity request is invalid\")\n\t// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token\n\tErrNextPageTokenCorrupted = errors.New(\"next page token is corrupted\")\n\t// ErrHistoryNotExist is the error for non-exist history\n\tErrHistoryNotExist = errors.New(\"requested workflow history does not exist\")\n)\n","sourceCodeStart":19,"sourceCodeEnd":41,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/archiver/constants.go#L19-L41","documentation":"This is a wrapping error from validateClientTLS: validateCAs rejected an entry in ClientTLS.RootCAFiles, the list of root CA bundle file paths. An element is empty or whitespace-only, which validateCAs rejects before any file I/O happens.","triggerScenarios":"Calling validateGroupTLS or validateWorkerTLS with ClientTLS.RootCAFiles containing an empty string element.","commonSituations":"Config lists like root_ca_files: [\"ca.pem\", \"\"]; scripted config generation appending an empty path; values-file merge artifacts in Kubernetes deployments.","solutions":["Remove the empty string from RootCAFiles.","If no custom roots are needed, use an empty list rather than [\"\"].","Fix the config generator/template producing the blank path.","Confirm each remaining path exists and holds valid PEM CA certificates."],"exampleFix":"// before\nClientTLS:\n  RootCAFiles: [\"/etc/ssl/certs/ca.pem\", \"\"]\n// after\nClientTLS:\n  RootCAFiles: [\"/etc/ssl/certs/ca.pem\"]","handlingStrategy":"validation","validationCode":"for i, f := range cfg.RootCAFiles {\n\tif strings.TrimSpace(f) == \"\" {\n\t\treturn fmt.Errorf(\"RootCAFiles[%d] is empty\", i)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate file lists programmatically so empty paths never enter the list.","Use empty lists for 'no custom roots' instead of placeholder entries.","Lint client configs for blank strings in path arrays."],"tags":["tls","config-validation","ca-certificates"],"backgroundTag":"tls-config-conflict","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}