{"record":{"id":"d5d807474e536c13","repo":"t8y2/dbx","slug":"password-w","errorCode":null,"errorMessage":"password: %w","messagePattern":"password: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":781,"sourceCode":"\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,\n\t} {\n\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)","sourceCodeStart":763,"sourceCodeEnd":799,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L763-L799","documentation":"This error is returned while parsing a Hadoop delegation token: the second length-prefixed byte array (the token password/authenticator) could not be read. The identifier parsed fine but the stream ended or the length encoding was corrupt at the password field, so the token is malformed or truncated mid-way.","triggerScenarios":"Decoding a delegation token whose payload ends after the identifier but before the password field can be fully read.","commonSituations":"Token truncated during copy/paste at roughly the halfway point; partial write into a config file; incompatible token format from a different Kerberos/Hadoop distribution.","solutions":["Re-copy the complete delegation token string","Regenerate the token from the Hive server","Verify the token was not split across lines in the config with characters lost","Confirm the token encoding matches what the server emitted"],"exampleFix":"// before\ntoken := parts[0] // only half the token\n// after\ntoken := wholeToken // complete token string from server response","handlingStrategy":"validation","validationCode":"func tokenNotHalfCut(token string) error {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil { return err }\n\t// Hadoop tokens carry 4 length-prefixed fields; require a sane minimum\n\tif len(decoded) < 32 { return errors.New(\"token likely truncated mid-field\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"_, _, err := decodeHadoopDelegationToken(token)\nif err != nil && strings.Contains(err.Error(), \"password\") {\n\treturn fmt.Errorf(\"token truncated at password field; re-fetch from Hive: %w\", err)\n}","preventionTips":["Never split tokens across config keys or multiple environment variables","Check config file writes completed (compare byte counts)","Use single-line secret storage for tokens","Regenerate the token on any parse failure"],"tags":["hive","authentication","delegation-token","parsing"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}