{"record":{"id":"db50598534e79c13","repo":"hashicorp/nomad","slug":"unknown-algorithm-q","errorCode":null,"errorMessage":"unknown algorithm: %q","messagePattern":"unknown algorithm: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/keyring.go","lineNumber":587,"sourceCode":"// retrieve the public key as functions such as go-jose's Claims(pubKey,\n// claims) inspect pubKey's concrete type.\nfunc (pubKey *KeyringPublicKey) GetPublicKey() (any, error) {\n\tswitch alg := pubKey.Algorithm; alg {\n\n\tcase PubKeyAlgEdDSA:\n\t\t// Convert public key bytes to an ed25519 public key\n\t\treturn ed25519.PublicKey(pubKey.PublicKey), nil\n\n\tcase PubKeyAlgRS256:\n\t\t// PEM -> rsa.PublickKey\n\t\trsaPubKey, err := x509.ParsePKCS1PublicKey(pubKey.PublicKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing %s public key: %w\", alg, err)\n\t\t}\n\t\treturn rsaPubKey, nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown algorithm: %q\", alg)\n\t}\n}\n\n// KeyringGetConfigResponse is the response for Keyring.GetConfig RPCs.\ntype KeyringGetConfigResponse struct {\n\tOIDCDiscovery *OIDCDiscoveryConfig\n}\n\n// OIDCDiscoveryConfig represents the response to OIDC Discovery requests\n// usually at: /.well-known/openid-configuration\n//\n// Only the fields Nomad uses are implemented since many fields in the\n// specification are not relevant to Nomad's use case:\n// https://openid.net/specs/openid-connect-discovery-1_0.html\ntype OIDCDiscoveryConfig struct {\n\tIssuer        string   `json:\"issuer\"`\n\tJWKS          string   `json:\"jwks_uri\"`\n\tIDTokenAlgs   []string `json:\"id_token_signing_alg_values_supported\"`","sourceCodeStart":569,"sourceCodeEnd":605,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/keyring.go#L569-L605","documentation":"This error means the keyring public-key parser received an algorithm string it does not recognize. The switch over the algorithm only handles Ed25519 and RS256; anything else falls to the default branch. It indicates a configuration value or stored key metadata naming an unsupported/unexpected signing algorithm.","triggerScenarios":"Passing an algorithm label other than Ed25519 or RS256 (e.g. ES256, HS256, a misspelled value like \"rs256\" if case is not normalized upstream) into the keyring public-key parsing path used by workload identity/OIDC key configuration.","commonSituations":"Typos in signing_algorithm config; using an algorithm supported by a newer Nomad version on an older server binary; keys stored by a newer version read by an older one; mixing up HMAC (HS256) names with asymmetric key algorithms.","solutions":["Change the configured algorithm to a supported value: RS256 or Ed25519","Check for typos/case mismatches in the algorithm string and correct it","If the algorithm is from a newer Nomad release, upgrade the server to a version that supports it","Check the wrapped error source: whether alg comes from key metadata (stale keyring entries) or from config"],"exampleFix":"// before\nkeyring_config { signing_algorithm = \"ES256\" }\n// after\nkeyring_config { signing_algorithm = \"RS256\" }","handlingStrategy":"validation","validationCode":"func validateKeyAlg(alg string) error {\n\tswitch alg {\n\tcase \"RS256\", \"Ed25519\":\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported key algorithm %q: must be RS256 or Ed25519\", alg)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := validateKeyAlg(cfg.SigningAlgorithm); err != nil {\n\t// fail fast at config load, before calling keyring APIs\n\treturn err\n}","preventionTips":["Only configure RS256 or Ed25519 as the signing algorithm","Keep server and client Nomad versions aligned so algorithm sets match","Check case/spelling of algorithm strings against the Nomad docs","Upgrade Nomad before adopting algorithms introduced in newer releases"],"tags":["nomad","keyring","algorithm","configuration"],"backgroundTag":"unsupported-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}