googleapis/mcp-toolbox · error

failed to build DSN: %w

Error message

failed to build DSN: %w

What it means

initTrinoConnectionPool wraps buildTrinoDSN failures with this message. buildTrinoDSN composes the trino:// DSN including query parameters for auth, SSL, catalog/schema and query timeout; it errors when required parameters are missing or invalid combinations are requested (e.g. kerberos options or cert material malformed). The underlying error is preserved.

Source

Thrown at internal/sources/trino/trino.go:174

		out = append(out, vMap)
	}

	if err := results.Err(); err != nil {
		return nil, fmt.Errorf("errors encountered during row iteration: %w", err)
	}

	return out, nil
}

func initTrinoConnectionPool(ctx context.Context, tracer trace.Tracer, name, host, port, user, password, catalog, schema, queryTimeout, accessToken string, kerberosEnabled, sslEnabled bool, sslCertPath, sslCert string, disableSslVerification bool) (*sql.DB, error) {
	//nolint:all // Reassigned ctx
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
	defer span.End()

	// Build Trino DSN
	dsn, err := buildTrinoDSN(host, port, user, password, catalog, schema, queryTimeout, accessToken, kerberosEnabled, sslEnabled, sslCertPath, sslCert)
	if err != nil {
		return nil, fmt.Errorf("failed to build DSN: %w", err)
	}

	logger, err := util.LoggerFromContext(ctx)
	if err != nil {
		return nil, fmt.Errorf("unable to get logger from ctx: %s", err)
	}

	if disableSslVerification {
		logger.WarnContext(ctx, "SSL verification is disabled for trino source %s. This is an insecure setting and should not be used in production.\n", name)
		tr := &http.Transport{
			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
		}
		client := &http.Client{Transport: tr}
		clientName := fmt.Sprintf("insecure_trino_client_%s", name)
		if err := trinogo.RegisterCustomClient(clientName, client); err != nil {
			return nil, fmt.Errorf("failed to register custom client: %w", err)
		}
		dsn = fmt.Sprintf("%s&custom_client=%s", dsn, clientName)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Inspect the wrapped error for the exact DSN parameter rejected
2. Validate port and queryTimeout are numeric strings in the trino source config
3. If SSL is enabled, confirm sslCertPath points to a readable PEM file or remove it to use system roots
4. Disable kerberos/accessToken flags that aren't needed to simplify the DSN

Example fix

// before
queryTimeout: "30s"
// after
queryTimeout: "30"  // seconds, numeric

func validateTrinoDSNInputs(port, queryTimeout, sslCertPath string) error {
    if _, err := strconv.Atoi(port); err != nil { return fmt.Errorf("bad port %q", port) }
    if queryTimeout != "" { if _, err := strconv.Atoi(queryTimeout); err != nil { return fmt.Errorf("bad queryTimeout %q", queryTimeout) } }
    if sslCertPath != "" { if _, err := os.ReadFile(sslCertPath); err != nil { return fmt.Errorf("bad sslCertPath: %w", err) } }
    return nil
}

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "failed to build DSN") {
    return fmt.Errorf("trino DSN construction failed — check port/queryTimeout/cert params: %w", err)
}

When it happens

Trigger: Initialize -> initTrinoConnectionPool where buildTrinoDSN(host, port, user, password, catalog, schema, queryTimeout, accessToken, kerberosEnabled, sslEnabled, sslCertPath, sslCert) returns an error, such as unparsable port/queryTimeout values or invalid cert/kerberos parameter combinations.

Common situations: Non-numeric port or queryTimeout strings from YAML; kerberosEnabled=true without required principal/realm config; sslEnabled with a bad sslCertPath or both sslCertPath and inline sslCert conflicting.

Related errors

• toolbox failed to initialize: %w
• sql.Open: %w
• unable to parse connection uri: %w
• unable to create pool: %w
• sql.Open: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/a8f0a4fcff6a869e. Report an issue: GitHub.