{"record":{"id":"dc15f2b434b86d32","repo":"hashicorp/nomad","slug":"expected-d-signed-identities-but-received-d","errorCode":null,"errorMessage":"expected %d signed identities but received %d","messagePattern":"expected (.+?) signed identities but received (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/widmgr/signer.go","lineNumber":122,"sourceCode":"\t\t)\n\t} else if n > 1 {\n\t\tvar mErr *multierror.Error\n\t\tfor _, r := range reply.Rejections {\n\t\t\tmErr = multierror.Append(\n\t\t\t\tfmt.Errorf(\n\t\t\t\t\t\"%d/%d signing request was rejected: %v\",\n\t\t\t\t\tn, len(req), r.Reason,\n\t\t\t\t))\n\t\t}\n\t\treturn nil, mErr\n\t}\n\n\tif len(reply.SignedIdentities) == 0 {\n\t\treturn nil, fmt.Errorf(\"empty signed identity response\")\n\t}\n\n\tif exp, act := len(reply.SignedIdentities), len(req); exp != act {\n\t\treturn nil, fmt.Errorf(\"expected %d signed identities but received %d\", exp, act)\n\t}\n\n\treturn reply.SignedIdentities, nil\n}\n","sourceCodeStart":104,"sourceCodeEnd":127,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/widmgr/signer.go#L104-L127","documentation":"SignIdentities verifies the count of signed identities matches the number of requests; a mismatch means the server returned a partial or oversized batch, so the response is rejected with this message to avoid index-based pairing bugs downstream.","triggerScenarios":"len(reply.SignedIdentities) != len(req) on a successful RPC — the server dropped some identities without marking a rejection or returned duplicates/extras.","commonSituations":"Partial signing bug on the server, request/reply skew across mixed Nomad versions, or custom/intercepting RPC middleware altering the reply.","solutions":["Verify client and server Nomad versions match; upgrade the older one.","Check server logs around Alloc.SignIdentities for dropped identities.","Retry signing; if reproducible, file/inspect the server-side signing handler for a partial-response bug.","Ensure any RPC proxying (e.g. in tests or multi-region forwarding) preserves reply ordering and completeness."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"signed, err := signer.SignIdentities(minIndex, reqs)\nif err != nil {\n    if strings.Contains(err.Error(), \"expected\") && strings.Contains(err.Error(), \"signed identities\") {\n        logger.Warn(\"partial signing response, retrying\", \"err\", err)\n        return signer.SignIdentities(minIndex, reqs)\n    }\n    return err\n}","preventionTips":["Keep client/server versions in sync","Avoid custom RPC middleware that mutates replies","Log server-side handler warnings for dropped identities"],"tags":["workload-identity","rpc","count-mismatch","nomad"],"backgroundTag":"response-count-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}