{"record":{"id":"1a4bf87644c75717","repo":"netbirdio/netbird","slug":"failed-to-bundle-public-keys-w","errorCode":null,"errorMessage":"failed to bundle public keys: %w","messagePattern":"failed to bundle public keys: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":53,"sourceCode":"\t\tif err := handleCreateArtifactKey(cmd, createArtifactKeyRootPrivKeyFile, createArtifactKeyPrivKeyFile, createArtifactKeyPubKeyFile, createArtifactKeyExpiration); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create artifact key: %w\", err)\n\t\t}\n\t\treturn nil\n\t},\n}\n\nvar bundlePubKeysCmd = &cobra.Command{\n\tUse:   \"bundle-pub-keys\",\n\tShort: \"Bundle multiple artifact public keys into a signed package\",\n\tLong: `Bundle one or more artifact public keys into a signed package using the root private key.\nThis command is typically used to distribute or authorize a set of valid artifact signing keys.`,\n\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\tif len(bundlePubKeysPubKeyFiles) == 0 {\n\t\t\treturn fmt.Errorf(\"at least one --artifact-pub-key-file must be provided\")\n\t\t}\n\n\t\tif err := handleBundlePubKeys(cmd, bundlePubKeysRootPrivKeyFile, bundlePubKeysPubKeyFiles, bundlePubKeysFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to bundle public keys: %w\", err)\n\t\t}\n\t\treturn nil\n\t},\n}\n\nfunc init() {\n\trootCmd.AddCommand(createArtifactKeyCmd)\n\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyRootPrivKeyFile, \"root-private-key-file\", \"\", \"Path to the root private key file used to sign the artifact key\")\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPrivKeyFile, \"artifact-priv-key-file\", \"\", \"Path where the artifact private key will be saved\")\n\tcreateArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPubKeyFile, \"artifact-pub-key-file\", \"\", \"Path where the artifact public key will be saved\")\n\tcreateArtifactKeyCmd.Flags().DurationVar(&createArtifactKeyExpiration, \"expiration\", 0, \"Expiration duration for the artifact key (e.g., 720h, 365d, 8760h)\")\n\n\tif err := createArtifactKeyCmd.MarkFlagRequired(\"root-private-key-file\"); err != nil {\n\t\tpanic(fmt.Errorf(\"mark root-private-key-file as required: %w\", err))\n\t}\n\tif err := createArtifactKeyCmd.MarkFlagRequired(\"artifact-priv-key-file\"); err != nil {\n\t\tpanic(fmt.Errorf(\"mark artifact-priv-key-file as required: %w\", err))","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L35-L71","documentation":"Generic wrapper returned by the bundle-pub-keys RunE when the underlying handleBundlePubKeys call fails. It always wraps a more specific error with %w (root key read/parse failure, public key read/parse failure, BundleArtifactKeys failure, or an output write failure), so the real cause is in the chained error text after the colon.","triggerScenarios":"Any failure inside handleBundlePubKeys: unreadable --root-private-key-file, unparseable root key PEM, an unreadable or malformed --artifact-pub-key-file entry, a BundleArtifactKeys error (e.g. root key expired), or a write error on --bundle-pub-key-file or its .sig companion.","commonSituations":"Running the bundling step with a wrong path, with a root key whose expiration passed, with a file that is a root key instead of an artifact public key, or into a read-only output directory.","solutions":["Read the chained cause after 'failed to bundle public keys:' and fix that specific error","Confirm --root-private-key-file points to a key created by create-root-key and is not expired","Confirm every --artifact-pub-key-file entry is an artifact public key produced by create-artifact-key","Confirm the output path --bundle-pub-key-file is writable"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := bundlePubKeysCmd.Execute()\nif err != nil {\n    var exitErr *exec.ExitError\n    if errors.As(err, &exitErr) {\n        // parse stderr; the root cause follows 'failed to bundle public keys:'\n        log.Fatalf(\"bundle failed: %v\", err)\n    }\n}","preventionTips":["Always read the wrapped cause, not the generic prefix, before acting","Pre-flight check root key, every pub key path, and output dir in one script step","Log the exact command line on failure for reproducibility"],"tags":["cli","signing","error-wrapping","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}