What causes "load Hive truststore: %w" in t8y2/dbx?

Check the wrapped cause and verify the truststore file path exists and is readable

load Hive truststore: %w

Error message

load Hive truststore: %w

What it means

When truststore parameters are present (truststore location), the driver calls loadTrustStore to obtain root certificates and wraps any failure with this message. The %w preserves the underlying cause — bad path, wrong password, unsupported store type. It is thrown because TLS cannot be established without the trust anchors.

Source

Thrown at agents/drivers/argo-go/config.go:1073

			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}

View on GitHub (pinned to c0390bff16)

Solutions

Check the wrapped cause and verify the truststore file path exists and is readable
Verify truststorepassword matches the store and truststoretype matches its format (JKS/PKCS12)
Re-export or re-download a non-corrupt truststore from the Hive server's CA
If a CA PEM file is available instead, use sslCACertPath rather than a truststore

Example fix

// before
values["truststorepassword"] = "oldpass"
// after
values["truststorepassword"] = os.Getenv("TRUSTSTORE_PASSWORD")

Defensive patterns

Strategy: validation

Validate before calling

if loc := values["truststore"]; loc != "" {
    if _, err := os.Stat(loc); err != nil {
        return fmt.Errorf("truststore missing: %w", err)
    }
    if values["truststorepassword"] == "" {
        return errors.New("truststorepassword required")
    }
}

Try / catch

if err := tryConnect(); err != nil {
    if strings.HasPrefix(err.Error(), "load Hive truststore:") {
        // log wrapped cause, refresh password from secret store, retry once
    }
    return err
}

Prevention

Keep truststore passwords in a secret manager, read at startup
Match truststoretype to the actual store format
Test truststore loading in CI with the same file deployed to prod
Regenerate stores as PKCS12 for best Go compatibility

When it happens

Trigger: Opening a Hive connection with truststore settings configured and loadTrustStore returns an error: unreadable store file, incorrect truststorepassword, unknown truststoretype, or corrupt store contents.

Common situations: Password rotated in the credential provider but not the config; JKS store supplied where PKCS12 expected (or vice versa); store path wrong after migration; store truncated during upload.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/0fba1632978cc8f7. Report an issue: GitHub.