{"record":{"id":"0ca49496e04eca65","repo":"netbirdio/netbird","slug":"failed-to-create-artifact-key-w","errorCode":null,"errorMessage":"failed to create artifact key: %w","messagePattern":"failed to create artifact key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":36,"sourceCode":"\tcreateArtifactKeyRootPrivKeyFile string\n\tcreateArtifactKeyPrivKeyFile     string\n\tcreateArtifactKeyPubKeyFile      string\n\tcreateArtifactKeyExpiration      time.Duration\n)\n\nvar createArtifactKeyCmd = &cobra.Command{\n\tUse:   \"create-artifact-key\",\n\tShort: \"Create a new artifact signing key\",\n\tLong: `Generate a new artifact signing key pair signed by the root private key.\nThe artifact key will be used to sign software artifacts/updates.`,\n\tSilenceUsage: true,\n\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\tif createArtifactKeyExpiration <= 0 {\n\t\t\treturn fmt.Errorf(\"--expiration must be a positive duration (e.g., 720h, 365d, 8760h)\")\n\t\t}\n\n\t\tif err := handleCreateArtifactKey(cmd, createArtifactKeyRootPrivKeyFile, createArtifactKeyPrivKeyFile, createArtifactKeyPubKeyFile, createArtifactKeyExpiration); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create artifact key: %w\", err)\n\t\t}\n\t\treturn nil\n\t},\n}\n\nvar bundlePubKeysCmd = &cobra.Command{\n\tUse:   \"bundle-pub-keys\",\n\tShort: \"Bundle multiple artifact public keys into a signed package\",\n\tLong: `Bundle one or more artifact public keys into a signed package using the root private key.\nThis command is typically used to distribute or authorize a set of valid artifact signing keys.`,\n\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\tif len(bundlePubKeysPubKeyFiles) == 0 {\n\t\t\treturn fmt.Errorf(\"at least one --artifact-pub-key-file must be provided\")\n\t\t}\n\n\t\tif err := handleBundlePubKeys(cmd, bundlePubKeysRootPrivKeyFile, bundlePubKeysPubKeyFiles, bundlePubKeysFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to bundle public keys: %w\", err)\n\t\t}","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L18-L54","documentation":"The create-artifact-key workflow failed after flag validation: reading the root private key file, parsing it with reposign.ParseRootKey, generating the artifact key pair, or writing the three outputs (private key, public key, .sig). The %w chain names the failing step.","triggerScenarios":"--root-private-key-file missing or unreadable; the file is not a valid root key PEM (wrong key or corrupted); output directories do not exist or are unwritable; disk full while writing key files.","commonSituations":"Pointing at the public instead of the private root key; running the signer in CI where output directories were never created; key files copied between machines with broken permissions.","solutions":["Verify each path exists and is readable: ls -l on all --*-file arguments","mkdir -p the output directories before running","Confirm the root private key was produced by the matching create-root-key command and is the expected key type","Read the wrapped step text ('read root private key file', 'failed to parse private root key', 'write ... file') to target the fix"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := os.Stat(rootPrivKeyFile); err != nil {\n\treturn fmt.Errorf(\"root private key %s unreadable: %w\", rootPrivKeyFile, err)\n}\nfor _, out := range []string{artifactPrivKeyFile, artifactPubKeyFile} {\n\tif err := os.MkdirAll(filepath.Dir(out), 0o700); err != nil {\n\t\treturn err\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := handleCreateArtifactKey(cmd, root, priv, pub, exp); err != nil {\n\t// the wrap names the step: read/parse/generate/write; fix that input before retrying\n\treturn fmt.Errorf(\"failed to create artifact key: %w\", err)\n}","preventionTips":["Create output directories before running the signer","Verify key file paths and permissions in CI before invoking the tool","Keep root keys in a dedicated directory readable only by the signing user"],"tags":["signing","cli","file-io","crypto","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}