{"record":{"id":"e01966cc7513dc59","repo":"tailscale/tailscale","slug":"absent-parent-must-be-represented-by-a-nil-slice","errorCode":null,"errorMessage":"absent parent must be represented by a nil slice","messagePattern":"absent parent must be represented by a nil slice","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tka/aum.go","lineNumber":166,"sourceCode":"\t// Votes and Meta describe properties of a key in the key authority.\n\t// These fields are used for UpdateKey AUMs.\n\tVotes *uint             `cbor:\"6,keyasint,omitempty\"`\n\tMeta  map[string]string `cbor:\"7,keyasint,omitempty\"`\n\n\t// Signatures lists the signatures over this AUM.\n\t// CBOR key 23 is the last key which can be encoded as a single byte.\n\tSignatures []tkatype.Signature `cbor:\"23,keyasint,omitempty\"`\n}\n\n// StaticValidate returns a nil error if the AUM is well-formed.\nfunc (a *AUM) StaticValidate() error {\n\tif a.Key != nil {\n\t\tif err := a.Key.StaticValidate(); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tif a.PrevAUMHash != nil && len(a.PrevAUMHash) == 0 {\n\t\treturn errors.New(\"absent parent must be represented by a nil slice\")\n\t}\n\tfor i, sig := range a.Signatures {\n\t\tif len(sig.KeyID) != 32 || len(sig.Signature) != ed25519.SignatureSize {\n\t\t\treturn fmt.Errorf(\"signature %d has missing keyID or malformed signature\", i)\n\t\t}\n\t}\n\n\tif a.State != nil {\n\t\tif err := a.State.staticValidateCheckpoint(); err != nil {\n\t\t\treturn fmt.Errorf(\"checkpoint state: %v\", err)\n\t\t}\n\t}\n\n\tswitch a.MessageKind {\n\tcase AUMAddKey:\n\t\tif a.Key == nil {\n\t\t\treturn errors.New(\"AddKey AUMs must contain a key\")\n\t\t}","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/tka/aum.go#L148-L184","documentation":"Returned by AUM.StaticValidate when PrevAUMHash is non-nil but zero-length: CBOR distinguishes absent from present-but-empty, so an absent parent AUM hash must be represented by a nil slice, never an empty one.","triggerScenarios":"Thrown at tka/aum.go:166 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set PrevAUMHash to nil when there is no parent","Provide the full 32-byte parent AUM hash"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}