tailscale/tailscale · error

absent parent must be represented by a nil slice

Error message

absent parent must be represented by a nil slice

What it means

Returned by AUM.StaticValidate when PrevAUMHash is non-nil but zero-length: CBOR distinguishes absent from present-but-empty, so an absent parent AUM hash must be represented by a nil slice, never an empty one.

Source

Thrown at tka/aum.go:166

	// Votes and Meta describe properties of a key in the key authority.
	// These fields are used for UpdateKey AUMs.
	Votes *uint             `cbor:"6,keyasint,omitempty"`
	Meta  map[string]string `cbor:"7,keyasint,omitempty"`

	// Signatures lists the signatures over this AUM.
	// CBOR key 23 is the last key which can be encoded as a single byte.
	Signatures []tkatype.Signature `cbor:"23,keyasint,omitempty"`
}

// StaticValidate returns a nil error if the AUM is well-formed.
func (a *AUM) StaticValidate() error {
	if a.Key != nil {
		if err := a.Key.StaticValidate(); err != nil {
			return err
		}
	}
	if a.PrevAUMHash != nil && len(a.PrevAUMHash) == 0 {
		return errors.New("absent parent must be represented by a nil slice")
	}
	for i, sig := range a.Signatures {
		if len(sig.KeyID) != 32 || len(sig.Signature) != ed25519.SignatureSize {
			return fmt.Errorf("signature %d has missing keyID or malformed signature", i)
		}
	}

	if a.State != nil {
		if err := a.State.staticValidateCheckpoint(); err != nil {
			return fmt.Errorf("checkpoint state: %v", err)
		}
	}

	switch a.MessageKind {
	case AUMAddKey:
		if a.Key == nil {
			return errors.New("AddKey AUMs must contain a key")
		}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Set PrevAUMHash to nil when there is no parent
2. Provide the full 32-byte parent AUM hash

When it happens

Trigger: Thrown at tka/aum.go:166 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/e01966cc7513dc59. Report an issue: GitHub.