crowdsecurity/crowdsec · error

no embedded content for %s

Error message

no embedded content for %s

What it means

writeEmbeddedContentTo is only safe to call when Item.Content is populated (non-empty) from the downloaded index. It returns this error when the item has no embedded content, meaning the caller proceeded down the embedded-content path incorrectly.

Source

Thrown at pkg/cwhub/fetch.go:22

	"bytes"
	"context"
	"crypto"
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"io"
	"os"
	"path/filepath"

	"github.com/crowdsecurity/go-cs-lib/downloader"
)

// writeEmbeddedContentTo writes the embedded content to the specified path and checks the hash.
// If the content is base64 encoded, it will be decoded before writing. Call this method only
// if item.Content if not empty.
func (i *Item) writeEmbeddedContentTo(destPath, wantHash string) error {
	if i.Content == "" {
		return fmt.Errorf("no embedded content for %s", i.Name)
	}

	content, err := base64.StdEncoding.DecodeString(i.Content)
	if err != nil {
		content = []byte(i.Content)
	}

	dir := filepath.Dir(destPath)
	reader := bytes.NewReader(content)
	hash := crypto.SHA256.New()

	tee := io.TeeReader(reader, hash)
	if err := os.MkdirAll(dir, 0o755); err != nil {
		return fmt.Errorf("while creating %s: %w", dir, err)
	}

	f, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Run `sudo cscli hub update` to refresh the index file
2. If it persists, delete the hub index file (`/var/lib/crowdsec/data/hub/.index.json`) and re-run `cscli hub update`
3. Check crowdsec/hub version compatibility and upgrade if mismatched

if item.Content == "" {
    // fall back to network download instead of embedded write
    return fetchViaNetwork(ctx, item, destPath)
}

func hasEmbeddedContent(i *cwhub.Item) bool { return i.Content != "" }

if err := item.FetchContentTo(ctx, provider, dest); err != nil {
    if strings.Contains(err.Error(), "no embedded content") {
        logger.Warnf("%s has no embedded content; forcing index refresh", item.FQName())
        return refreshHubIndex(ctx)
    }
    return err
}

When it happens

Trigger: Calling FetchContentTo on an item whose index entry has an empty Content field but a non-empty latestHash — i.e. the index says the item has a hash but no inline base64 content.

Common situations: Corrupted or partially written hub index file, an index produced by an older hub version without embedded content, or manually edited index entries.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• %w. The index file is invalid, please run 'cscli hub update'
• %s: latest hash missing from index. The index file is invali
• invalid hub index: %w. Run 'sudo cscli hub update' to downlo
• unable to read index file: %w
• failed to parse index: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/1926807367c04f7d. Report an issue: GitHub.