keria icon indicating copy to clipboard operation
keria copied to clipboard

"unknown witness {AID}" error message occurs for witnesses whose OOBI is in the "iurls" section of the bootstrap Agency JSON config

Open kentbull opened this issue 5 months ago • 3 comments

Version

0.2.0-rc2

Environment

No response

Expected behavior

When a witness OOBI is in the "iurls" section of the bootstrap Agency config, for example, "keri/cf/keria.json", then the witness should be known and added as a contact for each Agent created by that Agency.

Actual behavior

Currently there are intermittent failures for Agents when they try to use witnesses specified in the Agency configuration. Sometimes it seems to work, sometimes it does not. In a few instances with different community members I worked with this error of a missing witness that should not be missing has been observed.

Steps to reproduce

Reproduction steps have not been nailed down yet. This issue is for collecting information on this intermittent behavior.

This may be related to the recent work enabling environment variables to specify iurls with KERIA_IURLs.

kentbull avatar Jul 16 '25 16:07 kentbull

I haven't seen this recently off main and I always use the json file, but also using localhost witnesses.

Is it possible that you have a script which is booting and agent and immediately creating an identifier, before the OOBI resolution has finished?

iFergal avatar Jul 16 '25 17:07 iFergal

That is possible. I haven't seen it myself, it's usually reported by other community members I work with. I will pass that message along. I think they are not working with main but rather some of the published images which may have issues. We need to do another release soon.

kentbull avatar Jul 16 '25 18:07 kentbull

I think it would be good to know if it's intermittent within a single deployment, or if they are changing deployments and it sometimes happens - they might just have an infrastructure problem too. It's also worth noting that the .json file for each witness needs to be correct too based on the OOBI URL. If the end role auth for the witness is not present and correct in the OOBI response, it won't resolve.

I would expect OOBI resolution from iurls to be very stable, but maybe you're right.

iFergal avatar Jul 17 '25 08:07 iFergal