{"record":{"id":"e6f3e8f736a1bdd1","repo":"kubernetes/kops","slug":"unmarshalling-attested-data-w","errorCode":null,"errorMessage":"unmarshalling attested data: %w","messagePattern":"unmarshalling attested data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":280,"sourceCode":"\t\treturn nil, nil, fmt.Errorf(\"validating PKCS7 signer SAN: %w\", err)\n\t}\n\tklog.V(4).Infof(\"PKCS7 signer SAN validated as Azure metadata endpoint\")\n\n\treturn p7, signer, nil\n}\n\n// nonceForBody derives the IMDS attestation nonce from the request body; the shared\n// azuremetadata implementation keeps the authenticator and verifier sides identical.\nfunc nonceForBody(body []byte) string {\n\treturn azuremetadata.NonceForBody(body)\n}\n\n// parseAndValidateAttestedDocumentContent unmarshals the signed attestation payload and validates\n// its nonce and freshness timestamps.\nfunc parseAndValidateAttestedDocumentContent(content []byte, body []byte) (*attestedData, error) {\n\tvar data attestedData\n\tif err := json.Unmarshal(content, &data); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling attested data: %w\", err)\n\t}\n\tklog.V(4).Infof(\"Attested document content: vmId=%q subscriptionId=%q createdOn=%q expiresOn=%q\", data.VMId, data.SubscriptionId, data.TimeStamp.CreatedOn, data.TimeStamp.ExpiresOn)\n\n\tif data.VMId == \"\" {\n\t\treturn nil, fmt.Errorf(\"attested document vmId is required\")\n\t}\n\tif data.SubscriptionId == \"\" {\n\t\treturn nil, fmt.Errorf(\"attested document subscriptionId is required\")\n\t}\n\n\t// Verify the nonce matches the request body hash (replay protection).\n\texpectedNonce := nonceForBody(body)\n\tif data.Nonce != expectedNonce {\n\t\treturn nil, fmt.Errorf(\"attested document nonce mismatch: got=%q expected=%q\", data.Nonce, expectedNonce)\n\t}\n\n\tnow := time.Now().UTC()\n\tif data.TimeStamp.CreatedOn == \"\" {","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L262-L298","documentation":"The signed PKCS7 content (the attested document JSON) could not be unmarshalled into attestedData, meaning the Azure-signed payload does not match the expected schema. Indicates an unexpected or tampered document format.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:280 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation","Update kOps if Azure changed the attested document schema","Verify the IMDS endpoint is genuine Azure IMDS (169.254.169.254)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}