slackhq/nebula · error

ErrEmptySignature

ErrEmptySignature

Error message

empty signature

What it means

ErrEmptySignature is returned by setSignature on both certificateV1 and certificateV2 when the provided signature byte slice has length zero. Certificates must carry a non-empty signature; setting an empty one would produce an unverifiable certificate.

Source

Thrown at cert/errors.go:38

	ErrPublicPrivateKeyMismatch   = errors.New("public key and private key are not a pair")
	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
	ErrUnknownVersion             = errors.New("certificate version unrecognized")
	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
	ErrCurveMismatch              = errors.New("certificate curve does not match CA")

	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
	ErrInvalidPEMX25519PublicKeyBanner   = errors.New("bytes did not contain a proper X25519 public key banner")
	ErrInvalidPEMX25519PrivateKeyBanner  = errors.New("bytes did not contain a proper X25519 private key banner")
	ErrInvalidPEMEd25519PublicKeyBanner  = errors.New("bytes did not contain a proper Ed25519 public key banner")
	ErrInvalidPEMEd25519PrivateKeyBanner = errors.New("bytes did not contain a proper Ed25519 private key banner")

	ErrNoPeerStaticKey = errors.New("no peer static key was present")
	ErrNoPayload       = errors.New("provided payload was empty")

	ErrMissingDetails  = errors.New("certificate did not contain details")
	ErrEmptySignature  = errors.New("empty signature")
	ErrEmptyRawDetails = errors.New("empty rawDetails not allowed")
)

type ErrInvalidCertificateProperties struct {
	str string
}

func NewErrInvalidCertificateProperties(format string, a ...any) error {
	return &ErrInvalidCertificateProperties{fmt.Sprintf(format, a...)}
}

func (e *ErrInvalidCertificateProperties) Error() string {
	return e.str
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Check the error from the signing call before passing its output to setSignature
2. Verify the signer's private key is valid and produced non-empty output
3. Reject empty signature bytes at the decoding boundary before invoking setSignature

Example fix

// before
sig, _ := signer.Sign(data) // error ignored, sig empty
c.setSignature(sig)
// after
sig, err := signer.Sign(data)
if err != nil || len(sig) == 0 {
    return fmt.Errorf("signing failed")
}
c.setSignature(sig)

if len(sig) == 0 {
    return fmt.Errorf("refusing to set empty signature")
}

if err := c.setSignature(sig); errors.Is(err, cert.ErrEmptySignature) {
    // signing step produced nothing; investigate signer/key
}

When it happens

Trigger: Calling setSignature([]) or setSignature(nil) on a certificateV1 or certificateV2 — usually after a signing function returned empty bytes or its error was ignored.

Common situations: Signing step failed upstream (bad private key) but the empty result was passed through; a zero-length signature decoded from a malformed certificate blob; test harness passing empty signature fixtures.

Related errors

• ErrNotSelfSigned
• ErrSignatureMismatch
• could not calculate alternate fingerprint to verify: %w
• marshalling certificate details failed: %w
• invalid curve: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ad4fb8ea562778c7. Report an issue: GitHub.