{"record":{"id":"ee649999fd61caac","repo":"kubernetes/kops","slug":"failed-to-marshal-json-w","errorCode":null,"errorMessage":"failed to marshal json: %w","messagePattern":"failed to marshal json: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/issuerdiscovery.go","lineNumber":222,"sourceCode":"\t\tpublicKeyDERHash := hasher.Sum(nil)\n\n\t\tkeyID := base64.RawURLEncoding.EncodeToString(publicKeyDERHash)\n\n\t\tkeys = append(keys, jose.JSONWebKey{\n\t\t\tKey:       publicKey,\n\t\t\tKeyID:     keyID,\n\t\t\tAlgorithm: string(jose.RS256),\n\t\t\tUse:       \"sig\",\n\t\t})\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn keys[i].KeyID < keys[j].KeyID\n\t})\n\n\tkeyResponse := KeyResponse{Keys: keys}\n\tjsonBytes, err := json.MarshalIndent(keyResponse, \"\", \"\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to marshal json: %w\", err)\n\t}\n\n\treturn bytes.NewReader(jsonBytes), nil\n}\n","sourceCodeStart":204,"sourceCodeEnd":227,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/issuerdiscovery.go#L204-L227","documentation":"OIDCKeys.Open() assembles the JWKS-style KeyResponse (service-account signing public keys) and serializes it with json.MarshalIndent before serving it as an io.Reader. If encoding/json cannot marshal the response, this wrapped error is returned. In practice this is nearly impossible with jose.JSONWebKey values, since those structs marshal fine, so it usually indicates a programmer error or an unusual key payload.","triggerScenarios":"Calling Open() when the assembled []jose.JSONWebKey slice or KeyResponse contains a value encoding/json rejects — e.g. a key object whose json.Marshaler or custom marshalling panics/returns an error (unsupported type like channel/func inside the key struct, or an invalid value in an embedded field).","commonSituations":"Custom patches/forks of the jose library changing JSONWebKey field types; very old or mismatched gopkg.in/square/go-jose or github.com/go-jose/go-jose versions; adding non-serializable fields to KeyResponse in a local modification.","solutions":["Check go.mod for a compatible go-jose version and run go mod tidy / upgrade to a known-good release.","If a KeyResponse field was customized, ensure all added fields are JSON-serializable types.","Read the wrapped %w cause in the error to identify the exact JSON marshal failure and fix the offending field.","Rebuild kOps from upstream sources without local struct modifications."],"exampleFix":"// before\ntype KeyResponse struct {\n    Keys []jose.JSONWebKey `json:\"keys\"`\n    Extra map[string]chan int // non-serializable custom field\n}\n// after\ntype KeyResponse struct {\n    Keys []jose.JSONWebKey `json:\"keys\"`\n    Extra map[string]string\n}","handlingStrategy":"try-catch","validationCode":"// ensure response contains only JSON-serializable values\ntypeKey := reflect.TypeOf(KeyResponse{}).Kind()\nif typeKey != reflect.Struct {\n    return fmt.Errorf(\"unexpected KeyResponse type\")\n}","typeGuard":"func isJSONSerializable(v interface{}) bool {\n    b, err := json.Marshal(v)\n    return err == nil && b != nil\n}","tryCatchPattern":"jsonBytes, err := json.MarshalIndent(keyResponse, \"\", \"\")\nif err != nil {\n    var uerr *json.UnsupportedTypeError\n    if errors.As(err, &uerr) {\n        log.Printf(\"unsupported type in JWKS: %v\", uerr.Value)\n    }\n    return nil, fmt.Errorf(\"failed to marshal json: %w\", err)\n}","preventionTips":["Keep KeyResponse fields limited to jose.JSONWebKey and serializable types.","Avoid forked/modified go-jose libraries.","Check wrapped errors with errors.As to pinpoint offending fields.","Run unit tests that marshal KeyResponse with representative keys."],"tags":["oidc","json","marshal","jwks"],"backgroundTag":"json-marshal-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}