{"record":{"id":"08191870b5809544","repo":"sipeed/picoclaw","slug":"credential-keygen-marshal-public-key-w","errorCode":null,"errorMessage":"credential: keygen: marshal public key: %w","messagePattern":"credential: keygen: marshal public key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/credential/keygen.go","lineNumber":52,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: ed25519 key generation failed: %w\", err)\n\t}\n\n\t// Marshal private key as OpenSSH PEM.\n\tblock, err := ssh.MarshalPrivateKey(privRaw, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: marshal private key: %w\", err)\n\t}\n\tprivPEM := pem.EncodeToMemory(block)\n\n\tif err = os.WriteFile(path, privPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: write private key %q: %w\", path, err)\n\t}\n\n\t// Marshal public key as authorized_keys line.\n\tsshPub, err := ssh.NewPublicKey(pubRaw)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: marshal public key: %w\", err)\n\t}\n\tpubLine := ssh.MarshalAuthorizedKey(sshPub)\n\n\tpubPath := path + \".pub\"\n\tif err := os.WriteFile(pubPath, pubLine, 0o644); err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: write public key %q: %w\", pubPath, err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":34,"sourceCodeEnd":63,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/credential/keygen.go#L34-L63","documentation":"ssh.NewPublicKey(pubRaw) converts the generated Ed25519 public key to an ssh.PublicKey for the authorized_keys line. It only errors for unsupported public key algorithms; Ed25519 support is built into every modern x/crypto/ssh, so with a key from ed25519.GenerateKey this branch is defensive and effectively unreachable.","triggerScenarios":"No realistic runtime trigger with the current code path. Would require a stripped-down or modified x/crypto/ssh build lacking ed25519 support, or GenerateSSHKey changed to accept arbitrary external public keys.","commonSituations":"Practically never; treat occurrences as a corrupted/patched dependency rather than an operational issue.","solutions":["Report the failure and abort - retrying cannot help","Run `go mod verify` and pin the upstream x/crypto version in go.mod","Check whether a vendored copy of x/crypto/ssh was locally modified"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := credential.GenerateSSHKey(path); err != nil {\n    if strings.Contains(err.Error(), \"marshal public key\") {\n        return fmt.Errorf(\"internal keygen invariant violated, report upstream: %w\", err)\n    }\n    return err\n}","preventionTips":["Pin upstream x/crypto; verify the module in CI","Consider this a dependency-integrity alarm, not an operational error"],"tags":["crypto","ssh","keygen","internal","defensive"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}