{"record":{"id":"1c15840300949653","repo":"run-llama/llama_index","slug":"cannot-sign-without-private-key","errorCode":null,"errorMessage":"Cannot sign without private key","messagePattern":"Cannot sign without private key","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"llama-index-integrations/agent/llama-index-agent-agentmesh/llama_index/agent/agentmesh/identity.py","lineNumber":92,"sourceCode":"        private_key_b64 = base64.b64encode(private_key_obj.private_bytes_raw()).decode(\n            \"ascii\"\n        )\n        public_key_b64 = base64.b64encode(public_key_obj.public_bytes_raw()).decode(\n            \"ascii\"\n        )\n\n        return cls(\n            did=did,\n            agent_name=agent_name,\n            public_key=public_key_b64,\n            private_key=private_key_b64,\n            capabilities=capabilities or [],\n        )\n\n    def sign(self, data: str) -> CMVKSignature:\n        \"\"\"Sign data with this identity's private key.\"\"\"\n        if not self.private_key:\n            raise ValueError(\"Cannot sign without private key\")\n\n        private_key_bytes = base64.b64decode(self.private_key)\n        private_key_obj = ed25519.Ed25519PrivateKey.from_private_bytes(\n            private_key_bytes\n        )\n        signature_bytes = private_key_obj.sign(data.encode(\"utf-8\"))\n        signature_b64 = base64.b64encode(signature_bytes).decode(\"ascii\")\n\n        return CMVKSignature(public_key=self.public_key, signature=signature_b64)\n\n    def verify_signature(self, data: str, signature: CMVKSignature) -> bool:\n        \"\"\"Verify a signature against this identity's public key.\"\"\"\n        if signature.public_key != self.public_key:\n            return False\n\n        try:\n            public_key_bytes = base64.b64decode(self.public_key)\n            public_key_obj = ed25519.Ed25519PublicKey.from_public_bytes(","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/run-llama/llama_index/blob/afd0fef371831f9bda13e5af7167cf4e981278ab/llama-index-integrations/agent/llama-index-agent-agentmesh/llama_index/agent/agentmesh/identity.py#L74-L110","documentation":"Raised by AgentMeshIdentity.sign in the llama-index-agent-agentmesh integration when the identity object has no private key. Identities can be created from public-key-only material (e.g. a remote peer's card) so you can verify signatures but not produce them; sign() guards against this empty private_key with a ValueError before attempting base64 decode and Ed25519 signing.","triggerScenarios":"Calling identity.sign(data) on an AgentMeshIdentity constructed without a private key — e.g. one built from a received agent card containing only did/public_key/capabilities, or created with private_key=None/empty string. The falsy check on self.private_key fires before any crypto operations.","commonSituations":"Loading a peer agent's identity from its published card and then trying to sign a message with it; deserializing an identity where the private-key field was dropped (key stored in a secret manager not loaded in that env); mixing up local identity vs remote identity objects in mesh code.","solutions":["Sign with an identity that was generated with a private key (use the identity-creation/generation path that produces both keys)","Load the private key from your secret store and reconstruct the full identity before signing","If you only need to verify a remote agent, call verify_signature instead of sign"],"exampleFix":"# before\npeer = AgentMeshIdentity.from_agent_card(card)  # public-key only\nsig = peer.sign(payload)  # ValueError: Cannot sign without private key\n\n# after\nme = AgentMeshIdentity.generate(agent_name=\"local-agent\")  # has private key\nsig = me.sign(payload)\nok = peer.verify_signature(payload, sig)","handlingStrategy":"type-guard","validationCode":"def can_sign(identity) -> bool:\n    return bool(getattr(identity, \"private_key\", None))","typeGuard":"from llama_index.agent.agentmesh.identity import AgentMeshIdentity\n\ndef is_signing_identity(id_: AgentMeshIdentity) -> bool:\n    \"\"\"True when the identity carries a private key and can produce signatures.\"\"\"\n    return isinstance(id_, AgentMeshIdentity) and bool(id_.private_key)","tryCatchPattern":"try:\n    sig = identity.sign(payload)\nexcept ValueError as e:\n    if \"Cannot sign\" in str(e):\n        raise PermissionError(\"use a local identity with a private key to sign\") from e\n    raise","preventionTips":["Keep a dedicated local signing identity loaded from your secret manager; never sign with peer cards","Check identity.private_key is non-empty before entering signing code paths","Unit-test that only key-bearing identities reach sign()"],"tags":["crypto","signing","identity","agent-mesh","validation"],"backgroundTag":null,"analyzedSha":"afd0fef371831f9bda13e5af7167cf4e981278ab","analyzedAt":"2026-08-15T05:42:58.429Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}