{"record":{"id":"e2ddeae6e62ed949","repo":"t8y2/dbx","slug":"load-hive-keystore-w-e2ddea","errorCode":null,"errorMessage":"load Hive keystore: %w","messagePattern":"load Hive keystore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1107,"sourceCode":"\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)","sourceCodeStart":1089,"sourceCodeEnd":1125,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1089-L1125","documentation":"This error wraps failures from loadClientKeyStore when loading a client certificate from a keystore for Hive TLS (config.go:1107). It fires when the 'sslkeystore' location parameter is set but the keystore cannot be opened, decrypted with keystorepassword, or parsed with keystoretype. The wrapped error carries the loader's specific cause.","triggerScenarios":"The 'sslkeystore' parameter is non-empty and loadClientKeyStore(location, keystorepassword, keystoretype) returns an error: wrong password, wrong or missing keystoretype, unreadable/corrupt file.","commonSituations":"Porting a Java Hive JDBC config (sslkeystore/keystorepassword) to the Go driver with an incorrect password; JKS file used while keystoretype says PKCS12; keystore not copied into the deployment; key alias password differs from store password.","solutions":["Verify keystorepassword is correct for the keystore file.","Set keystoretype to match the actual format (JKS vs PKCS12).","Confirm the keystore file exists and is readable at the sslkeystore path.","Convert the keystore (e.g. keytool -importkeystore to PKCS12) if the format is unsupported."],"exampleFix":"// before\ndsn += \"&sslkeystore=/etc/hive/client.p12&keystoretype=JKS\"\n// after\ndsn += \"&sslkeystore=/etc/hive/client.p12&keystorepassword=secret&keystoretype=PKCS12\"","handlingStrategy":"validation","validationCode":"if loc := params[\"sslkeystore\"]; loc != \"\" {\n    if _, err := os.Stat(loc); err != nil {\n        return fmt.Errorf(\"keystore not accessible: %w\", err)\n    }\n    if params[\"keystorepassword\"] == \"\" {\n        return errors.New(\"keystorepassword required with sslkeystore\")\n    }\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep keystorepassword, keystoretype, and sslkeystore defined together in config.","Prefer PKCS12 keystores for cross-language compatibility with the Go driver.","Store keystore passwords in a secret manager, not in plaintext DSNs.","Validate keystore format with keytool -list before deployment."],"tags":["tls","keystore","configuration","go"],"backgroundTag":"keystore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}