t8y2/dbx · error

load Hive truststore: %w

Error message

load Hive truststore: %w

What it means

This error wraps failures from loadTrustStore when loading a Java-style truststore for Hive TLS (config.go:1076). It fires when a truststore location parameter is set but the store cannot be opened, decrypted, or parsed. The wrapped error carries the specific cause from the truststore loader.

Source

Thrown at agents/drivers/hive-go/config.go:1076

			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the truststorepassword parameter matches the store's actual password.
2. Verify the truststoretype (e.g. JKS vs PKCS12) matches the file format.
3. Confirm the truststore file exists and is readable at the configured location.
4. Re-export the truststore from a known-good source if the file is corrupt.

Example fix

// before
dsn += "&truststore=/etc/hive/truststore.jks&truststoretype=PKCS12"
// after
dsn += "&truststore=/etc/hive/truststore.jks&truststorepassword=changeit&truststoretype=JKS"

if loc := params["truststore"]; loc != "" {
    if _, err := os.Stat(loc); err != nil {
        return fmt.Errorf("truststore not accessible: %w", err)
    }
    if params["truststorepassword"] == "" {
        return errors.New("truststorepassword required with truststore")
    }
}

When it happens

Trigger: The 'truststore' location parameter is set and loadTrustStore(location, truststorepassword, truststoretype) returns an error: wrong password, unsupported store type, corrupt or unreadable file.

Common situations: Migrating a JDBC-style Hive connection string to the Go driver with a JKS truststore and wrong or missing truststorepassword; truststore type (JKS/PKCS12) mismatch with the actual file; file not present in the container image.

Related errors

• unsupported store type %q
• failed to parse CA certificate at %s
• read Hive CA certificate: %w
• load Hive keystore: %w
• load ZooKeeper truststore: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/eaf8b821cd55fafe. Report an issue: GitHub.