{"record":{"id":"f031de4824f12c58","repo":"t8y2/dbx","slug":"unsupported-store-type-q","errorCode":null,"errorMessage":"unsupported store type %q","messagePattern":"unsupported store type %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":115,"sourceCode":"\t\t\t\tchain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)\n\t\t\t\tif getErr != nil {\n\t\t\t\t\treturn nil, getErr\n\t\t\t\t}\n\t\t\t\tfor _, entry := range chain {\n\t\t\t\t\tcertificate, parseErr := x509.ParseCertificate(entry.Content)\n\t\t\t\t\tif parseErr != nil {\n\t\t\t\t\t\treturn nil, parseErr\n\t\t\t\t\t}\n\t\t\t\t\tcertificates = append(certificates, certificate)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif len(certificates) == 0 {\n\t\t\treturn nil, errors.New(\"JKS truststore contains no certificates\")\n\t\t}\n\t\treturn certificates, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn tls.Certificate{}, err\n\t}\n\tswitch normalizedStoreType(storeType, path) {\n\tcase \"PEM\":\n\t\treturn tls.X509KeyPair(contents, contents)\n\tcase \"PKCS12\":\n\t\tprivateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)\n\t\tif err != nil {\n\t\t\treturn tls.Certificate{}, err\n\t\t}\n\t\tresult := tls.Certificate{PrivateKey: privateKey, Leaf: certificate}\n\t\tresult.Certificate = append(result.Certificate, certificate.Raw)","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L97-L133","documentation":"loadTrustStore ends in a default case returning \"unsupported store type %q\" when the resolved store type (after normalizedStoreType uppercases/trims zookeepertruststoretype and possibly infers from the extension) is not one of the handled formats (PEM/JKS/PKCS12). The library only knows how to parse those three truststore formats.","triggerScenarios":"parseConnectionConfig or buildTLSConfig passes a zookeepertruststoretype value like \"JKS\" misspelled as \"jks-store\", \"BKS\", \"PKCS11\", or any non-empty string that normalizedStoreType does not map to a supported branch.","commonSituations":"Copying JVM settings that use BKS (Android) or PKCS11 (HSM) stores; whitespace/casing mistakes combined with an unknown token; a docs example for a different driver; typos like \"PEM\" vs \"P12\" confusion.","solutions":["Set zookeepertruststoretype to one of: PEM, JKS, or PKCS12 (case-insensitive).","Clear the parameter entirely to let normalizedStoreType infer the type from the file extension.","Convert BKS/other formats to PKCS12 (e.g. with keytool or openssl) and use the converted file.","Check the %q value in the message to see exactly what string was passed."],"exampleFix":"// before\nparams.Set(\"zookeepertruststoretype\", \"BKS\")\n// after\nparams.Set(\"zookeepertruststoretype\", \"PKCS12\") // or \"PEM\"/\"JKS\", or omit to infer from extension","handlingStrategy":"validation","validationCode":"var supported = map[string]bool{\"PEM\": true, \"JKS\": true, \"PKCS12\": true}\nst := strings.ToUpper(strings.TrimSpace(params.Get(\"zookeepertruststoretype\")))\nif st != \"\" && !supported[st] {\n    return fmt.Errorf(\"zookeepertruststoretype %q not supported; use PEM, JKS, or PKCS12\", st)\n}","typeGuard":null,"tryCatchPattern":"certs, err := loadTrustStore(loc, pw, st)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"unsupported store type\") {\n        return fmt.Errorf(\"convert store to PEM/JKS/PKCS12 (got %s)\", st)\n    }\n    return err\n}","preventionTips":["Restrict store-type config values to an allowlist (PEM, JKS, PKCS12) at config load time.","Convert BKS/PKCS11 artifacts to PKCS12 before distributing them.","Prefer omitting the type parameter so it is inferred from the file extension.","Validate config schema in CI to catch typos before deployment."],"tags":["tls","configuration","truststore","unsupported-format"],"backgroundTag":"unsupported-store-type","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}