{"record":{"id":"eaf8b821cd55fafe","repo":"t8y2/dbx","slug":"load-hive-truststore-w-eaf8b8","errorCode":null,"errorMessage":"load Hive truststore: %w","messagePattern":"load Hive truststore: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1076,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}","sourceCodeStart":1058,"sourceCodeEnd":1094,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1058-L1094","documentation":"This error wraps failures from loadTrustStore when loading a Java-style truststore for Hive TLS (config.go:1076). It fires when a truststore location parameter is set but the store cannot be opened, decrypted, or parsed. The wrapped error carries the specific cause from the truststore loader.","triggerScenarios":"The 'truststore' location parameter is set and loadTrustStore(location, truststorepassword, truststoretype) returns an error: wrong password, unsupported store type, corrupt or unreadable file.","commonSituations":"Migrating a JDBC-style Hive connection string to the Go driver with a JKS truststore and wrong or missing truststorepassword; truststore type (JKS/PKCS12) mismatch with the actual file; file not present in the container image.","solutions":["Check the truststorepassword parameter matches the store's actual password.","Verify the truststoretype (e.g. JKS vs PKCS12) matches the file format.","Confirm the truststore file exists and is readable at the configured location.","Re-export the truststore from a known-good source if the file is corrupt."],"exampleFix":"// before\ndsn += \"&truststore=/etc/hive/truststore.jks&truststoretype=PKCS12\"\n// after\ndsn += \"&truststore=/etc/hive/truststore.jks&truststorepassword=changeit&truststoretype=JKS\"","handlingStrategy":"validation","validationCode":"if loc := params[\"truststore\"]; loc != \"\" {\n    if _, err := os.Stat(loc); err != nil {\n        return fmt.Errorf(\"truststore not accessible: %w\", err)\n    }\n    if params[\"truststorepassword\"] == \"\" {\n        return errors.New(\"truststorepassword required with truststore\")\n    }\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep truststorepassword and truststoretype alongside the location in one config source.","Document whether your truststore is JKS or PKCS12 and set the type explicitly.","Test TLS config in staging with the same store files as production."],"tags":["tls","truststore","configuration","go"],"backgroundTag":"truststore-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}