slackhq/nebula · error

notImplemented

notImplemented

Error message

not implemented

What it means

The stub pkclient (built without the PKCS#11/HSM backend, e.g. on unsupported platforms or without the cgo build tag) provides a PKClient that can never be constructed: New returns the sentinel notImplemented, and SignASN1/DeriveNoise/GetPubKey would do the same. It exists only to satisfy compilation on platforms without HSM support.

Source

Thrown at pkclient/pkclient_stub.go:10

//go:build !cgo || !pkcs11

package pkclient

import "errors"

type PKClient struct {
}

var notImplemented = errors.New("not implemented")

func New(hsmPath string, slotId uint, pin string, id string, label string) (*PKClient, error) {
	return nil, notImplemented
}

func (c *PKClient) Close() error {
	return nil
}

func (c *PKClient) SignASN1(data []byte) ([]byte, error) {
	return nil, notImplemented
}

func (c *PKClient) DeriveNoise(_ []byte) ([]byte, error) {
	return nil, notImplemented
}

func (c *PKClient) GetPubKey() ([]byte, error) {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Rebuild the binary with the PKCS#11/HSM backend enabled (correct build tags / cgo enabled).
2. Verify GOOS/GOARCH supports the pkclient implementation, and cross-compile with CGO_ENABLED=1 and the proper toolchain.
3. If HSM is not intended, remove hsm/pkcs11 settings from the config so the stub path is never invoked.
4. Check build pipeline tags to ensure production artifacts match the feature set needed on that host.
5. At runtime, detect notImplemented early and fail fast with a clear message that this binary lacks HSM support.

Example fix

// before: plain build, stub compiled in
go build -o node ./cmd/node
// after: build with HSM/PKCS11 backend
go build -tags hsm -o node ./cmd/node
// runtime guard:
client, err := pkclient.New(hsmPath, slot, pin, id, label)
if errors.Is(err, pkclient.ErrNotImplemented) {
    log.Fatal("binary built without HSM support; rebuild with hsm tag")
}

// Go: detect stub build before relying on HSM features
client, err := pkclient.New(hsmPath, slot, pin, id, label)
if err != nil {
    if err.Error() == "not implemented" {
        log.Fatal("binary built without HSM (pkclient stub); rebuild with hsm build tag")
    }
    return err
}

client, err := pkclient.New(hsmPath, slotId, pin, id, label)
if err != nil {
    if strings.Contains(err.Error(), "not implemented") {
        return fmt.Errorf("pkclient unavailable: rebuild with the pkcs11/hsm build tag")
    }
    return err
}

When it happens

Trigger: Calling pkclient.New(hsmPath, slotId, pin, id, label) in a build that compiled pkclient_stub.go instead of the real implementation — i.e. a binary built without the HSM/PKCS#11 backend (wrong GOOS, missing cgo, or missing build tag).

Common situations: Deploying a binary built for a platform without HSM support while config points at an HSM (pkcs11 path/slot/pin set); CI producing default-build artifacts then running on HSM-backed nodes; forgetting the required build tag (e.g. -tags hsm) when compiling.

Related errors

• error while creating PKCS#11 client: %w
• error while getting public key with PKCS#11: %w
• error while signing with PKCS#11: %w
• error while creating PKCS#11 client: %w
• error while getting public key: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c2f051f9fac3ab65. Report an issue: GitHub.