{"record":{"id":"0c964c246cfa3cfb","repo":"OpenNHP/opennhp","slug":"fail-to-write-public-key-file-w","errorCode":null,"errorMessage":"fail to write public key file: %w","messagePattern":"fail to write public key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/server/kbs/resource/resource.go","lineNumber":69,"sourceCode":"\tkeys, err := cosign.GenerateKeyPair(nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(privateKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create private key directory: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(publicKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create public key directory: %w\", err)\n\t}\n\n\tif err := os.WriteFile(privateKeyPath, keys.PrivateBytes, 0600); err != nil {\n\t\treturn fmt.Errorf(\"fail to write private key file: %w\", err)\n\t}\n\n\tif err := os.WriteFile(publicKeyPath, keys.PublicBytes, 0644); err != nil { //nolint:gosec // G306: Public keys are intentionally world-readable\n\t\treturn fmt.Errorf(\"fail to write public key file: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc GetResource(c *gin.Context) {\n\tpath := c.Param(\"path\")\n\tif path == \"\" {\n\t\tc.JSON(http.StatusBadRequest, gin.H{\"error\": \"resource path is empty\"})\n\t\treturn\n\t}\n\n\tauthHeader := c.GetHeader(\"Authorization\")\n\tif authHeader == \"\" || !strings.HasPrefix(authHeader, \"Bearer \") {\n\t\tc.JSON(http.StatusUnauthorized, kbsError.TokenNotFound())\n\t\treturn\n\t}\n\ttokenStr := strings.TrimPrefix(authHeader, \"Bearer \")","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/resource/resource.go#L51-L87","documentation":"generateCosignKeyPair writes the cosign public key bytes to publicKeyPath with mode 0644 after creating its directory. This error is returned when os.WriteFile fails (wrapped as 'fail to write public key file: %w').","triggerScenarios":"At init, writing the public key fails — parent directory not writable, disk full, publicKeyPath exists as a directory, or read-only filesystem.","commonSituations":"Same root causes as the private-key write error but on the public path: read-only rootfs, wrong ownership, disk exhaustion; often encountered right after fixing the private-key error when the two paths live on different mounts.","solutions":["Check the wrapped error and fix permissions or disk space on the public key path","Ensure publicKeyPath is a file path in a writable directory","Keep both keys on the same writable volume to avoid split-mount failures","Pre-provision the public key directory with correct ownership in the image"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if fi, err := os.Stat(publicKeyPath); err == nil && fi.IsDir() {\n\treturn fmt.Errorf(\"%s is a directory\", publicKeyPath)\n}\nif err := syscall.Access(filepath.Dir(publicKeyPath), syscall.W_OK); err != nil {\n\treturn fmt.Errorf(\"public key dir not writable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := generateCosignKeyPair(); err != nil {\n\tif strings.Contains(err.Error(), \"fail to write public key file\") {\n\t\tlog.Fatalf(\"public key write failed (check disk space/permissions): %v\", err)\n\t}\n\tlog.Fatalf(\"cosign keypair init failed: %v\", err)\n}","preventionTips":["Place both keys on the same writable volume","Monitor disk usage on the node","Verify path is a regular file target, not a directory","Run a startup readiness check that attempts a temp-file write in the key dir"],"tags":["go","filesystem","file-write","cosign"],"backgroundTag":"file-write-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}