hashicorp/nomad · error

expected %d signed identities but received %d

Error message

expected %d signed identities but received %d

What it means

SignIdentities verifies the count of signed identities matches the number of requests; a mismatch means the server returned a partial or oversized batch, so the response is rejected with this message to avoid index-based pairing bugs downstream.

Source

Thrown at client/widmgr/signer.go:122

		)
	} else if n > 1 {
		var mErr *multierror.Error
		for _, r := range reply.Rejections {
			mErr = multierror.Append(
				fmt.Errorf(
					"%d/%d signing request was rejected: %v",
					n, len(req), r.Reason,
				))
		}
		return nil, mErr
	}

	if len(reply.SignedIdentities) == 0 {
		return nil, fmt.Errorf("empty signed identity response")
	}

	if exp, act := len(reply.SignedIdentities), len(req); exp != act {
		return nil, fmt.Errorf("expected %d signed identities but received %d", exp, act)
	}

	return reply.SignedIdentities, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify client and server Nomad versions match; upgrade the older one.
2. Check server logs around Alloc.SignIdentities for dropped identities.
3. Retry signing; if reproducible, file/inspect the server-side signing handler for a partial-response bug.
4. Ensure any RPC proxying (e.g. in tests or multi-region forwarding) preserves reply ordering and completeness.

signed, err := signer.SignIdentities(minIndex, reqs)
if err != nil {
    if strings.Contains(err.Error(), "expected") && strings.Contains(err.Error(), "signed identities") {
        logger.Warn("partial signing response, retrying", "err", err)
        return signer.SignIdentities(minIndex, reqs)
    }
    return err
}

When it happens

Trigger: len(reply.SignedIdentities) != len(req) on a successful RPC — the server dropped some identities without marking a rejection or returned duplicates/extras.

Common situations: Partial signing bug on the server, request/reply skew across mixed Nomad versions, or custom/intercepting RPC middleware altering the reply.

Related errors

• failed to retrieve signed workload identity: %w
• %d/%d signing request was rejected: %v
• empty signed identity response
• failed to fetch signed identities: %w
• no identities requested

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/dc15f2b434b86d32. Report an issue: GitHub.