{"record":{"id":"19ed447cf2b1fa2f","repo":"netbirdio/netbird","slug":"read-root-private-key-file-w","errorCode":null,"errorMessage":"read root private key file: %w","messagePattern":"read root private key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":102,"sourceCode":"\tbundlePubKeysCmd.Flags().StringVar(&bundlePubKeysFile, \"bundle-pub-key-file\", \"\", \"Path where the public keys will be saved\")\n\n\tif err := bundlePubKeysCmd.MarkFlagRequired(\"root-private-key-file\"); err != nil {\n\t\tpanic(fmt.Errorf(\"mark root-private-key-file as required: %w\", err))\n\t}\n\tif err := bundlePubKeysCmd.MarkFlagRequired(\"artifact-pub-key-file\"); err != nil {\n\t\tpanic(fmt.Errorf(\"mark artifact-pub-key-file as required: %w\", err))\n\t}\n\tif err := bundlePubKeysCmd.MarkFlagRequired(\"bundle-pub-key-file\"); err != nil {\n\t\tpanic(fmt.Errorf(\"mark bundle-pub-key-file as required: %w\", err))\n\t}\n}\n\nfunc handleCreateArtifactKey(cmd *cobra.Command, rootPrivKeyFile, artifactPrivKeyFile, artifactPubKeyFile string, expiration time.Duration) error {\n\tcmd.Println(\"Creating new artifact signing key...\")\n\n\tprivKeyPEM, err := os.ReadFile(rootPrivKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read root private key file: %w\", err)\n\t}\n\n\tprivateRootKey, err := reposign.ParseRootKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)\n\t}\n\n\tartifactKey, privPEM, pubPEM, signature, err := reposign.GenerateArtifactKey(privateRootKey, expiration)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generate artifact key: %w\", err)\n\t}\n\n\tif err := os.WriteFile(artifactPrivKeyFile, privPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write private key file (%s): %w\", artifactPrivKeyFile, err)\n\t}\n\n\tif err := os.WriteFile(artifactPubKeyFile, pubPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public key file (%s): %w\", artifactPubKeyFile, err)","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L84-L120","documentation":"os.ReadFile on the --root-private-key-file path failed inside handleCreateArtifactKey, before any cryptographic work. The wrapped error is a standard *fs.PathError: 'no such file or directory', 'permission denied', or 'is a directory'.","triggerScenarios":"create-artifact-key invoked with a --root-private-key-file path that does not exist, is a directory, or is not readable by the current user (e.g. root-owned 0600 file read as a normal user).","commonSituations":"Typo in the path; running from a different working directory with a relative path; the root key was never generated or was moved; file permissions were tightened after generation.","solutions":["Check the exact path and rerun with an absolute path to rule out working-directory issues","Confirm the file exists and is readable (ls -l, or run as the owning user)","If no root key exists yet, generate one with the create-root-key command first"],"exampleFix":"// before\ncreate-artifact-key --root-private-key-file root.key ...\n// after\ncreate-artifact-key --root-private-key-file /etc/netbird/signing/root.key ...","handlingStrategy":"validation","validationCode":"keyPath := \"/etc/netbird/signing/root.key\"\nif _, err := os.Stat(keyPath); err != nil {\n    log.Fatalf(\"root key not available at %s: %v\", keyPath, err)\n}\n// then invoke create-artifact-key with keyPath","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store root key at a fixed absolute path referenced by the pipeline","Use os.Stat pre-checks in wrapper scripts to give clearer diagnostics","Never rename or move key files after generation"],"tags":["cli","file-io","signing","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}