{"record":{"id":"1bb0981ac5fab335","repo":"netbirdio/netbird","slug":"read-private-key-file-w","errorCode":null,"errorMessage":"read private key file: %w","messagePattern":"read private key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactsign.go","lineNumber":128,"sourceCode":"\t\tpanic(fmt.Errorf(\"mark signature-file as required: %w\", err))\n\t}\n}\n\nfunc handleSignArtifact(cmd *cobra.Command, privKeyFile, artifactFile string) error {\n\tcmd.Println(\"🖋️  Signing artifact...\")\n\n\t// Load private key from env var or file\n\tvar privKeyPEM []byte\n\tvar err error\n\n\tif envKey := os.Getenv(envArtifactPrivateKey); envKey != \"\" {\n\t\t// Use key from environment variable\n\t\tprivKeyPEM = []byte(envKey)\n\t} else if privKeyFile != \"\" {\n\t\t// Fall back to file\n\t\tprivKeyPEM, err = os.ReadFile(privKeyFile)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"read private key file: %w\", err)\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"artifact private key must be provided via %s environment variable or --artifact-key-file flag\", envArtifactPrivateKey)\n\t}\n\n\tprivateKey, err := reposign.ParseArtifactKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse artifact private key: %w\", err)\n\t}\n\n\tartifactData, err := os.ReadFile(artifactFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read artifact file: %w\", err)\n\t}\n\n\tsignature, err := reposign.SignData(privateKey, artifactData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"sign artifact: %w\", err)","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactsign.go#L110-L146","documentation":"os.ReadFile failed for --artifact-key-file during sign-artifact, in the branch where the NB_ARTIFACT_PRIV_KEY environment variable is empty and the flag path is used. The wrapped *fs.PathError identifies ENOENT, EACCES, or EISDIR on the key file.","triggerScenarios":"sign-artifact with --artifact-key-file pointing at a missing or unreadable file while NB_ARTIFACT_PRIV_KEY is unset; relative key path from a different working directory.","commonSituations":"CI job expects the key from a secret mount that was not attached; local run from the repo root while the key sits elsewhere; key file permissioned 0600 to another user.","solutions":["Verify the path exists and is readable; prefer an absolute path","Alternatively export the key PEM in NB_ARTIFACT_PRIV_KEY (CI secret) to avoid file plumbing","Fix the CI step to fetch/mount the key before signing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if os.Getenv(envArtifactPrivateKey) == \"\" {\n    if _, err := os.Stat(privKeyFile); err != nil {\n        log.Fatalf(\"signing key unavailable via flag or %s\", envArtifactPrivateKey)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount the key file via CI secret and stat it in a setup step","Prefer the NB_ARTIFACT_PRIV_KEY env secret to file-path plumbing","Use absolute key paths in job definitions"],"tags":["cli","file-io","signing","ci","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}