{"record":{"id":"25261564ac2efd1f","repo":"netbirdio/netbird","slug":"write-signature-file-s-w-252615","errorCode":null,"errorMessage":"write signature file (%s): %w","messagePattern":"write signature file \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactsign.go","lineNumber":151,"sourceCode":"\n\tprivateKey, err := reposign.ParseArtifactKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse artifact private key: %w\", err)\n\t}\n\n\tartifactData, err := os.ReadFile(artifactFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read artifact file: %w\", err)\n\t}\n\n\tsignature, err := reposign.SignData(privateKey, artifactData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"sign artifact: %w\", err)\n\t}\n\n\tsigFile := artifactFile + \".sig\"\n\tif err := os.WriteFile(artifactFile+\".sig\", signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", sigFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Artifact signed successfully.\\n\")\n\tcmd.Printf(\"Signature file: %s\\n\", sigFile)\n\treturn nil\n}\n\nfunc handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {\n\tcmd.Println(\"🔍 Verifying artifact...\")\n\n\t// Read artifact public key\n\tpubKeyPEM, err := os.ReadFile(pubKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read public key file: %w\", err)\n\t}\n\n\tpublicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)\n\tif err != nil {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactsign.go#L133-L169","documentation":"os.WriteFile of artifactFile+\".sig\" with mode 0600 failed. The message helpfully includes the target path. Typical causes: the target directory is not writable, a stale .sig from a previous run is owned by another user (0600 blocks overwriting), a read-only mount, or a full disk.","triggerScenarios":"Re-running sign-artifact as a different user where <artifact>.sig already exists with owner-only permissions; signing into a read-only dist/release directory; ENOSPC.","commonSituations":"CI job first ran as root, then re-run as non-root; release artifacts directory mounted read-only in a container.","solutions":["Remove or chown the stale .sig file: rm -f <artifact>.sig, then re-run","Confirm write permission on the directory that will hold the .sig (touch <dir>/.wtest)","Sign into a writable staging directory and move the pair into place afterwards","Check disk space with df -h ."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"dir := filepath.Dir(artifactFile)\nif f, err := os.OpenFile(filepath.Join(dir, \".write-test\"), os.O_CREATE|os.O_WRONLY, 0o600); err != nil {\n    log.Fatalf(\"directory %s not writable: %v\", dir, err)\n} else {\n    f.Close()\n    os.Remove(f.Name())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run the signer as the same user across retries so stale 0600 .sig files never block overwrites","Clean the release directory (rm -f *.sig) before each signing run","Sign into a writable staging directory, then publish"],"tags":["go","cli","filesystem","release-signing"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}