argoproj/argo-workflows · error

generated artifact key failed self-validation: %w

Error message

generated artifact key failed self-validation: %w

What it means

While generating a unique artifact key for an input-artifact upload, the constructed key failed the key-format self-check (invalid characters or shape after sanitizing the filename). The upload request is aborted rather than storing under a malformed key.

Source

Thrown at server/artifacts/artifact_server.go:241

	if !artifactCopy.HasLocation() {
		http.Error(w, fmt.Sprintf("Artifact '%s' does not have a storage location configured (s3, gcs, azure, oss). Please configure a storage location in the WorkflowTemplate or set up a default artifact repository.", artifactName), http.StatusBadRequest)
		return
	}

	// Generate unique key for the artifact
	uploadUUID := uuid.NewString()
	originalKey, _ := artifactCopy.GetKey()
	// Sanitize filename to prevent path traversal attacks. path.Base only
	// recognises '/' as a separator, so normalise Windows-style '\' first.
	sanitizedFilename := path.Base(strings.ReplaceAll(header.Filename, "\\", "/"))
	if sanitizedFilename == "." || sanitizedFilename == "/" || sanitizedFilename == "" {
		http.Error(w, "Invalid filename", http.StatusBadRequest)
		return
	}
	// Replace the key with uploaded file path under uploads/
	newKey := fmt.Sprintf("uploads/%s/%s/%s", namespace, uploadUUID, sanitizedFilename)
	if validateErr := sutils.ValidateUploadedArtifactKey(namespace, newKey); validateErr != nil {
		a.serverInternalError(ctx, fmt.Errorf("generated artifact key failed self-validation: %w", validateErr), w)
		return
	}

	// Create a copy of the artifact for uploading (using artifactCopy which has resolved location)
	outputArtifact := artifactCopy.DeepCopy()
	if setErr := outputArtifact.SetKey(newKey); setErr != nil {
		http.Error(w, fmt.Sprintf("Failed to set artifact key: %v", setErr), http.StatusInternalServerError)
		return
	}

	a.logger.WithFields(logging.Fields{
		"originalKey": originalKey,
		"newKey":      newKey,
	}).Info(ctx, "Uploading artifact with new key")

	// Get the driver for the artifact
	kubeClient := auth.GetKubeClient(ctx)
	driver, err := a.artDriverFactory(ctx, outputArtifact, resources{kubeClient, namespace})

View on GitHub (pinned to 35bff19146)

Solutions

1. Check the artifact name/filename for characters the key format disallows
2. Report the wrapped validation error; avoid exotic filenames in artifact names

When it happens

Trigger: Thrown at server/artifacts/artifact_server.go:241 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/2e331e0b0453ec5f. Report an issue: GitHub.