tailscale/tailscale · error

reading AUM (%v): %w

Error message

reading AUM (%v): %w

What it means

Walking the AUM chain backwards from head, reading the AUM at the given hash from TKA storage failed with something other than not-exist (which ends the walk normally). The store is corrupt or unreadable.

Source

Thrown at ipn/ipnlocal/tailnet-lock.go:1028

// TailnetLockLog returns the changelog of TKA state up to maxEntries in size.
func (b *LocalBackend) TailnetLockLog(maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
	b.mu.Lock()
	defer b.mu.Unlock()

	if b.tka == nil {
		return nil, errTailnetLockNotActive
	}

	var out []ipnstate.TailnetLockUpdate
	cursor := b.tka.authority.Head()
	for range maxEntries {
		aum, err := b.tka.storage.AUM(cursor)
		if err != nil {
			if err == os.ErrNotExist {
				break
			}
			return out, fmt.Errorf("reading AUM (%v): %w", cursor, err)
		}

		update := ipnstate.TailnetLockUpdate{
			Hash:   cursor,
			Change: aum.MessageKind.String(),
			Raw:    aum.Serialize(),
		}
		out = append(out, update)

		parent, hasParent := aum.Parent()
		if !hasParent {
			break
		}
		cursor = parent
	}

	return out, nil
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. The AUM (authority update message) could not be read/decoded; the tailnet lock log may be corrupted — re-fetch the lock state from the control server or reset local lock state.

When it happens

Trigger: Thrown at ipn/ipnlocal/tailnet-lock.go:1028 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/c8803ba59e7f3fc5. Report an issue: GitHub.