hashicorp/nomad · error

empty signed identity response

Error message

empty signed identity response

What it means

If the RPC neither returned errors nor rejections but reply.SignedIdentities is empty, SignIdentities treats the response as malformed and errors with this message. It guards against a server silently returning an empty success.

Source

Thrown at client/widmgr/signer.go:118

	if n := len(reply.Rejections); n == 1 {
		return nil, fmt.Errorf(
			"%d/%d signing request was rejected: %v",
			n, len(req), reply.Rejections[0].Reason,
		)
	} else if n > 1 {
		var mErr *multierror.Error
		for _, r := range reply.Rejections {
			mErr = multierror.Append(
				fmt.Errorf(
					"%d/%d signing request was rejected: %v",
					n, len(req), r.Reason,
				))
		}
		return nil, mErr
	}

	if len(reply.SignedIdentities) == 0 {
		return nil, fmt.Errorf("empty signed identity response")
	}

	if exp, act := len(reply.SignedIdentities), len(req); exp != act {
		return nil, fmt.Errorf("expected %d signed identities but received %d", exp, act)
	}

	return reply.SignedIdentities, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Retry the signing request; a transient empty reply may succeed.
2. Check server logs for the Alloc.SignIdentities handler for signs of a bug or version skew.
3. Ensure client and server Nomad versions are compatible.
4. Report/pin down the server version producing empty responses; upgrade or downgrade accordingly.

signed, err := signer.SignIdentities(minIndex, reqs)
if err != nil {
    if strings.Contains(err.Error(), "empty signed identity response") {
        // transient/malformed reply: backoff and retry once
        time.Sleep(retryDelay)
        return signer.SignIdentities(minIndex, reqs)
    }
    return err
}

When it happens

Trigger: Alloc.SignIdentities returns successfully but with zero signed identities — an empty-success response from a buggy/misbehaving server or an intermediary dropping the payload.

Common situations: Server-side bug or version mismatch where the handler returns an empty response; corrupted RPC reply; test doubles returning an empty AllocIdentitiesResponse.

Related errors

• failed to retrieve signed workload identity: %w
• %d/%d signing request was rejected: %v
• expected %d signed identities but received %d
• failed to fetch signed identities: %w
• no identities requested

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e0185d02bde431b0. Report an issue: GitHub.