{"record":{"id":"f25468058200a749","repo":"t8y2/dbx","slug":"kind-w","errorCode":null,"errorMessage":"kind: %w","messagePattern":"kind: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":787,"sourceCode":"\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))\n\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}","sourceCodeStart":769,"sourceCodeEnd":805,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L769-L805","documentation":"This error is returned while parsing a Hadoop delegation token: the third length-prefixed byte array (the token kind, e.g. 'HIVE_DELEGATION_TOKEN') could not be read. Identifier and password parsed successfully but the stream is corrupt or truncated before the kind field completes.","triggerScenarios":"Decoding a delegation token whose payload ends partway through the kind field, or whose kind length prefix is corrupt.","commonSituations":"Severely truncated token; token mutated in transit; constructing tokens manually with missing fields.","solutions":["Regenerate the delegation token from the Hive server","Verify the full base64 token string is intact end to end","Do not construct or edit token strings manually","Compare token length against the value the issuing server reported"],"exampleFix":"// before\ntoken := base64.StdEncoding.EncodeToString(identifierAndPasswordOnly)\n// after\ntoken := issuedToken // use the token exactly as issued by the server","handlingStrategy":"validation","validationCode":"func checkTokenMinFields(token string) error {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil { return err }\n\tif len(decoded) < 40 { return errors.New(\"token missing trailing fields (kind/service)\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if _, _, err := decodeHadoopDelegationToken(token); err != nil {\n\tif strings.Contains(err.Error(), \"kind\") {\n\t\tlog.Println(\"token incomplete: kind field unreadable — reissue token\")\n\t}\n\treturn err\n}","preventionTips":["Use the token exactly as issued; never reconstruct it manually","Round-trip test base64 encode/decode in CI for stored tokens","Avoid text-mode transformations (editors, email, chat) on token strings"],"tags":["hive","authentication","delegation-token","parsing"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}