{"record":{"id":"cc17adf252d79f9b","repo":"t8y2/dbx","slug":"read-hive-ca-certificate-w-cc17ad","errorCode":null,"errorMessage":"read Hive CA certificate: %w","messagePattern":"read Hive CA certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1058,"sourceCode":"\t}\n\treturn filepath.Clean(value)\n}\n\nfunc buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {\n\tenabled := params.SSL || parameterBool(values, \"ssl\") || strings.EqualFold(parameter(values, \"ssl\"), \"true\")\n\tif !enabled {\n\t\treturn nil, nil\n\t}\n\tconfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}\n\tif parameterBool(values, \"sslinsecureskipverify\") || parameterBool(values, \"allowselfsigned\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\tvar customRoots *x509.CertPool\n\tcredentialProviderPath := parameter(values, \"storepasswordpath\")\n\tif path := strings.TrimSpace(params.CACertPath); path != \"\" {\n\t\tcontents, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)","sourceCodeStart":1040,"sourceCodeEnd":1076,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1040-L1076","documentation":"This error wraps the underlying os.ReadFile failure that occurs when the driver tries to load a custom CA certificate bundle for the Hive TLS connection (config.go:1058). It is thrown when the cacert path parameter is set but the file at that path cannot be read. The wrapped error identifies the exact OS-level cause (missing file, permissions, etc.).","triggerScenarios":"The 'cacert'-style driver parameter (params.CACertPath) is non-empty, and os.ReadFile(path) fails: the file does not exist, the path is wrong, or the process lacks read permission.","commonSituations":"Typo in the CA cert path in the connection string; certificate mounted into a container at a different path; running as a non-root user without read access to the PEM file; secrets volume not mounted at startup.","solutions":["Verify the CA certificate file exists at the configured path (ls / stat the path).","Correct the cacert path parameter in the connection configuration.","Fix file permissions (chmod/chown) so the process user can read the PEM file.","If running in a container, mount the secret/ConfigMap containing the CA cert at the expected path."],"exampleFix":"// before\ndsn := \"hive://user:pass@host:10000/db?cacert=/etc/ssl/wrong-ca.pem\"\n// after\ndsn := \"hive://user:pass@host:10000/db?cacert=/etc/ssl/certs/hive-ca.pem\"","handlingStrategy":"validation","validationCode":"if path := params.CACertPath; path != \"\" {\n    if _, err := os.Stat(path); err != nil {\n        return fmt.Errorf(\"Hive CA cert not accessible: %w\", err)\n    }\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for certificate files in all environments.","Mount certificates as read-only volumes and verify with a startup check.","Run containerized workloads as a user with read access to mounted secrets.","Validate certificate file presence in CI/deployment smoke tests."],"tags":["tls","configuration","file-io","go"],"backgroundTag":"ca-cert-file-unreadable","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}