{"record":{"id":"eb162e5516243b43","repo":"OpenNHP/opennhp","slug":"failed-to-unmarshal-data-private-key-wrapping-v","errorCode":null,"errorMessage":"failed to unmarshal data private key wrapping: %v","messagePattern":"failed to unmarshal data private key wrapping: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/agent/udpagent.go","lineNumber":1360,"sourceCode":"\tif result {\n\t\ta.trustedByNHPDB.Store(true) // agent has been trusted by NHP DB\n\n\t\t// update smart data policy refresh time\n\t\ta.smartDataPolicyRefreshTime[ztdoId] = time.Now().UnixNano()\n\n\t\tlog.Info(\"[StartConfidentialComputing] Refresh smart data policy for data object which id is %s\", ztdoId)\n\n\t\tif !decrypted {\n\t\t\toutput, err = utils.GenerateTempFilePath(\"plaintext-*\")\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"Error: fail to generating temporary file path: %w\", err)\n\t\t\t}\n\n\t\t\tdataPrkWrapping := ztdolib.DataPrivateKeyWrapping{}\n\n\t\t\tif err := json.Unmarshal([]byte(dagMsg.Kao.WrappedDataKey), &dataPrkWrapping); err != nil {\n\t\t\t\tlog.Error(\"failed to unmarshal data private key wrapping: %v\\n\", err)\n\t\t\t\treturn \"\", fmt.Errorf(\"failed to unmarshal data private key wrapping: %v\", err)\n\t\t\t}\n\n\t\t\tproviderPbk, _ := base64.StdEncoding.DecodeString(dataPrkWrapping.ProviderPublicKeyBase64)\n\n\t\t\tif dagMsg.AccessUrl == \"\" {\n\t\t\t\tlog.Error(\"access url is empty, please check with data provider\")\n\t\t\t\treturn \"\", fmt.Errorf(\"access url is empty, please check with data provider\")\n\t\t\t}\n\n\t\t\tvar err error\n\t\t\tztdoPath, err := utils.DownloadFileToTemp(dagMsg.AccessUrl, \"ztdo-\")\n\t\t\tif err != nil {\n\t\t\t\tlog.Error(\"failed to download ztdo: %v\\n\", err)\n\t\t\t\treturn \"\", fmt.Errorf(\"failed to download ztdo: %v\", err)\n\t\t\t}\n\n\t\t\tif parseErr := ztdo.ParseHeader(ztdoPath); parseErr != nil {\n\t\t\t\tfmt.Printf(\"Error: failed to parse ztdo header:%s\\n\", parseErr)","sourceCodeStart":1342,"sourceCodeEnd":1378,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/agent/udpagent.go#L1342-L1378","documentation":"The WrappedDataKey field of the DAG message (dagMsg.Kao.WrappedDataKey) is expected to be a JSON DataPrivateKeyWrapping object; if json.Unmarshal fails the agent cannot unwrap the data private key and returns this error. It indicates malformed or unexpected key-wrapping payload from the data provider.","triggerScenarios":"StartConfidentialComputing path where dagMsg.Kao.WrappedDataKey is empty, truncated, base64/binary instead of JSON, or JSON of a different schema.","commonSituations":"Data provider produced the ztdo with an older/incompatible wrapping format; WrappedDataKey field double-encoded (base64 of JSON); upstream message corruption.","solutions":["Log the raw WrappedDataKey content to see what was actually received","Verify the producer side serializes a JSON DataPrivateKeyWrapping (not base64-of-JSON); decode first if double-encoded","Check ztdolib.DataPrivateKeyWrapping schema vs the provider's version and upgrade aligning both sides"],"exampleFix":"// before\ndataPrkWrapping := ztdolib.DataPrivateKeyWrapping{}\njson.Unmarshal([]byte(dagMsg.Kao.WrappedDataKey), &dataPrkWrapping)\n// after\nraw, err := base64.StdEncoding.DecodeString(dagMsg.Kao.WrappedDataKey)\nif err != nil { raw = []byte(dagMsg.Kao.WrappedDataKey) }\ndataPrkWrapping := ztdolib.DataPrivateKeyWrapping{}\nif err := json.Unmarshal(raw, &dataPrkWrapping); err != nil { return \"\", err }","handlingStrategy":"type-guard","validationCode":"raw := dagMsg.Kao.WrappedDataKey\nif raw == \"\" || (!strings.HasPrefix(raw, \"{\") && !isB64JSON(raw)) {\n    return fmt.Errorf(\"WrappedDataKey is not a JSON DataPrivateKeyWrapping\")\n}","typeGuard":"func isB64JSON(s string) bool {\n    b, err := base64.StdEncoding.DecodeString(s)\n    if err != nil { return false }\n    return json.Valid(b)\n}","tryCatchPattern":"out, err := a.StartConfidentialComputing(ztdoId, ...)\nif err != nil && strings.Contains(err.Error(), \"data private key wrapping\") {\n    log.Errorf(\"bad key wrapping from provider: %v\", err)\n    // verify provider serialization format / ztdo version\n}","preventionTips":["Agree on and version the DataPrivateKeyWrapping JSON schema between provider and agent","Reject empty WrappedDataKey fields early at message receipt","Add round-trip tests producing and consuming wrapped keys across versions"],"tags":["json","dhp","key-wrapping"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}