tailscale/tailscale · error

RemoveKey AUMs must specify a key ID

Error message

RemoveKey AUMs must specify a key ID

What it means

AUM.StaticValidate requires a RemoveKey message to name the key to remove via KeyID. It fires when KeyID is empty, so there is no target for the removal.

Source

Thrown at tka/aum.go:190

	}

	if a.State != nil {
		if err := a.State.staticValidateCheckpoint(); err != nil {
			return fmt.Errorf("checkpoint state: %v", err)
		}
	}

	switch a.MessageKind {
	case AUMAddKey:
		if a.Key == nil {
			return errors.New("AddKey AUMs must contain a key")
		}
		if a.KeyID != nil || a.State != nil || a.Votes != nil || a.Meta != nil {
			return errors.New("AddKey AUMs may only specify a Key")
		}
	case AUMRemoveKey:
		if len(a.KeyID) == 0 {
			return errors.New("RemoveKey AUMs must specify a key ID")
		}
		if a.Key != nil || a.State != nil || a.Votes != nil || a.Meta != nil {
			return errors.New("RemoveKey AUMs may only specify a KeyID")
		}
	case AUMUpdateKey:
		if len(a.KeyID) == 0 {
			return errors.New("UpdateKey AUMs must specify a key ID")
		}
		if a.Meta == nil && a.Votes == nil {
			return errors.New("UpdateKey AUMs must contain an update to votes or key metadata")
		}
		if a.Key != nil || a.State != nil {
			return errors.New("UpdateKey AUMs may only specify KeyID, Votes, and Meta")
		}
	case AUMCheckpoint:
		if a.State == nil {
			return errors.New("Checkpoint AUMs must specify the state")
		}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Set KeyID to the 32-byte ID of the key being removed

When it happens

Trigger: Thrown at tka/aum.go:190 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/ee546347f4b1cd7b. Report an issue: GitHub.