spiffe: BundleMapFromBytes() invalid trust domain %q found w

Error message

spiffe: BundleMapFromBytes() invalid trust domain %q found when parsing SPIFFE Bundle Map: %v

What it means

Returned when a key inside the parsed Bundle Map's 'trust_domains' object is not a valid SPIFFE trust domain name. Trust domain names are validated by spiffeid.TrustDomainFromString, which rejects empty strings, uppercase letters, and characters outside [a-z0-9._-]. The offending key (the trust domain string) and the underlying validation error are both surfaced.

Source

Thrown at internal/credentials/spiffe/spiffe.go:55

// BundleMapFromBytes parses bytes into a SPIFFE Bundle Map. See the
// SPIFFE Bundle Map spec for more detail -
// https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md#4-spiffe-bundle-format
// If duplicate keys are encountered in the JSON parsing, Go's default unmarshal
// behavior occurs which causes the last processed entry to be the entry in the
// parsed map.
func BundleMapFromBytes(bundleMapBytes []byte) (map[string]*spiffebundle.Bundle, error) {
	var result partialParsedSPIFFEBundleMap
	if err := json.Unmarshal(bundleMapBytes, &result); err != nil {
		return nil, err
	}
	if result.Bundles == nil {
		return nil, fmt.Errorf("spiffe: BundleMapFromBytes() no bundles parsed from spiffe bundle map bytes")
	}
	bundleMap := map[string]*spiffebundle.Bundle{}
	for td, jsonBundle := range result.Bundles {
		trustDomain, err := spiffeid.TrustDomainFromString(td)
		if err != nil {
			return nil, fmt.Errorf("spiffe: BundleMapFromBytes() invalid trust domain %q found when parsing SPIFFE Bundle Map: %v", td, err)
		}
		bundle, err := spiffebundle.Parse(trustDomain, jsonBundle)
		if err != nil {
			return nil, fmt.Errorf("spiffe: BundleMapFromBytes() failed to parse bundle for trust domain %q: %v", td, err)
		}
		bundleMap[td] = bundle
	}
	return bundleMap, nil
}

// GetRootsFromSPIFFEBundleMap returns the root trust certificates from the
// SPIFFE bundle map for the given trust domain from the leaf certificate.
func GetRootsFromSPIFFEBundleMap(bundleMap map[string]*spiffebundle.Bundle, leafCert *x509.Certificate) (*x509.CertPool, error) {
	// 1. Upon receiving a peer certificate, verify that it is a well-formed SPIFFE
	//    leaf certificate.  In particular, it must have a single URI SAN containing
	//    a well-formed SPIFFE ID ([SPIFFE ID format]).
	spiffeID, err := idFromCert(leafCert)
	if err != nil {

View on GitHub (pinned to 03255a9237)

Solutions

Inspect the trust_domains keys and correct any that contain invalid characters, uppercase, colons, or are empty.
Regenerate the Bundle Map from the issuing SPIRE/SPIFFE authority so keys are lowercased trust domain names.
Validate each key with a regex like ^[a-z0-9._-]+$ before constructing the Bundle Map bytes.

Example fix

// before
{"trust_domains": {"Prod Domain": {...}}}

// after
{"trust_domains": {"prod-domain": {...}}}

Defensive patterns

Strategy: validation

Validate before calling

var trustDomainRE = regexp.MustCompile(`^[a-z0-9._-]+$`)

func validateBundleMapKeys(b []byte) error {
    var m map[string]json.RawMessage
    if err := json.Unmarshal(b, &m); err != nil { return err }
    td, ok := m["trust_domains"]
    if !ok { return errors.New("missing trust_domains") }
    var tds map[string]json.RawMessage
    if err := json.Unmarshal(td, &tds); err != nil { return err }
    for k := range tds {
        if !trustDomainRE.MatchString(k) {
            return fmt.Errorf("invalid trust domain key %q", k)
        }
    }
    return nil
}

Type guard

func isValidTrustDomainName(s string) bool {
    if s == "" { return false }
    for _, r := range s {
        if !(r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || r == '.' || r == '_' || r == '-') {
            return false
        }
    }
    return true
}

Prevention

Generate Bundle Maps from SPIRE rather than editing JSON by hand.
Lint trust domain names with a strict character class regex.
Pin trust domain names in config and compare against the loaded map at startup.

When it happens

Trigger: A Bundle Map JSON with a key like "My Domain", "domain.example:443", "", or any value containing spaces, colons, or capitals in the trust_domains map. The loop at spiffe.go:52 calls TrustDomainFromString on every key.

Common situations: Bundle generated by a non-conformant source; hand-edited JSON; a trust domain configured with a URL-like form ("https://x") instead of the bare name; upstream SPIRE misconfiguration that put a URI in the key.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/6dc4f0e44e08d403. Report an issue: GitHub.