netbirdio/netbird · error

anonymize sync response: %w

Error message

anonymize sync response: %w

What it means

Returned by BundleGenerator.addSyncResponse in client/internal/debug/debug.go:884 when anonymizeSyncResponse fails. That function redacts the SyncResponse in place (NetbirdConfig URIs, TURN credentials, relay/flow tokens, peer IPs, FQDNs, routes, DNS, firewall rules) and only anonymizeNetworkMap can return an error; in the current code anonymizeNetworkMap always returns nil, so this wrap is defensive. If it ever fires it signals a logic error in the anonymization walk rather than an environmental problem.

Source

Thrown at client/internal/debug/debug.go:884

	resolvedDomainsContent := formatResolvedDomains(resolvedDomains, g.anonymize, g.anonymizer)
	resolvedDomainsReader := strings.NewReader(resolvedDomainsContent)
	if err := g.addFileToZip(resolvedDomainsReader, "resolved_domains.txt"); err != nil {
		return fmt.Errorf("add resolved domains file to zip: %w", err)
	}

	return nil
}

func (g *BundleGenerator) addSyncResponse() error {
	if g.syncResponse == nil {
		log.Debugf("skipping empty sync response in debug bundle")
		return nil
	}

	if g.anonymize {
		if err := anonymizeSyncResponse(g.syncResponse, g.anonymizer); err != nil {
			return fmt.Errorf("anonymize sync response: %w", err)
		}
	}

	options := protojson.MarshalOptions{
		EmitUnpopulated: true,
		UseProtoNames:   true,
		Indent:          "  ",
		AllowPartial:    true,
	}

	g.maskSecrets()

	jsonBytes, err := options.Marshal(g.syncResponse)
	if err != nil {
		return fmt.Errorf("generate json: %w", err)
	}

	if err := g.addFileToZip(bytes.NewReader(jsonBytes), "network_map.json"); err != nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Regenerate the bundle with anonymization off (level none) to confirm this path is the source.
2. Align daemon and CLI versions so the anonymizer matches the SyncResponse shape.
3. If this fires on stock builds, report it: on current code the wrapped path cannot error, so it indicates modified or mismatched code.

// Go: probe anonymization before committing to an anonymized bundle
if cfg.Anonymize && deps.SyncResponse != nil {
    if err := anonymizeSyncResponse(deps.SyncResponse, anonymizer); err != nil {
        cfg.Anonymize = false // fall back to a non-anonymized bundle
    }
}

// Go: switch anonymization off and regenerate if this path errors
if err := gen.Generate(); err != nil && strings.Contains(err.Error(), "anonymize sync response") {
    cfg.Anonymize = false
    gen = debug.NewBundleGenerator(cfg, deps)
    _, err = gen.Generate()
}

When it happens

Trigger: Debug bundle generation with cfg.Anonymize true (or AnonymizeLevel >= strict) where a future or modified anonymizeNetworkMap returns an error, e.g. unparseable IP/prefix data inside the network map.

Common situations: Custom or in-development builds where anonymization code was extended to return errors; version combinations where network-map payloads contain fields the anonymizer cannot process.

Related errors

• add sync response: %w
• decode v6 overlay address: %w
• close archive writer: %w
• add readme: %w
• add status: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d3e461a67449a9ed. Report an issue: GitHub.