{"record":{"id":"0b3593669650863e","repo":"slackhq/nebula","slug":"error-while-reading-in-pub-s","errorCode":null,"errorMessage":"error while reading in-pub: %s","messagePattern":"error while reading in-pub: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/sign.go","lineNumber":280,"sourceCode":"\t\tcurve = cert.Curve_P256\n\t\tp11Client, err = pkclient.FromUrl(*sf.p11url)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t}\n\n\tif fips140.Enforced() && curve == cert.Curve_CURVE25519 {\n\t\treturn errors.New(\"use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t}\n\n\tif *sf.inPubPath != \"\" {\n\t\tvar pubCurve cert.Curve\n\t\trawPub, err := readInput(\"in-pub\", *sf.inPubPath, &claims)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while reading in-pub: %s\", err)\n\t\t}\n\n\t\tpub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while parsing in-pub: %s\", err)\n\t\t}\n\t\tif pubCurve != curve {\n\t\t\treturn fmt.Errorf(\"curve of in-pub does not match ca\")\n\t\t}\n\t} else if isP11 {\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key with PKCS#11: %w\", err)\n\t\t}\n\t} else {\n\t\tpub, rawPriv = newKeypair(curve)\n\t}\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/sign.go#L262-L298","documentation":"Wraps an error from readInput when the -in-pub option is set and its public-key file cannot be read during nebula-cert sign. It only fires when inPubPath was explicitly provided (signing a certificate for a supplied public key); the underlying error is an OS read failure (missing file, bad permissions, empty input). Signing of that certificate aborts before the public key is unmarshaled.","triggerScenarios":"Thrown at cmd/nebula-cert/sign.go:280 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the -in-pub path exists and is readable","Omit -in-pub if a new keypair should be generated instead"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}