{"record":{"id":"27b31cadc44b3bfe","repo":"kubernetes/kops","slug":"encoding-public-key-s-v","errorCode":null,"errorMessage":"encoding public key %s: %v","messagePattern":"encoding public key (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"upup/pkg/fi/ca.go","lineNumber":178,"sourceCode":"\tfor k, item := range k.Items {\n\t\tif item.DistrustTimestamp == nil {\n\t\t\tkeys = append(keys, k)\n\t\t}\n\t}\n\tsort.Slice(keys, func(i, j int) bool {\n\t\treturn KeysetItemIdOlder(k.Items[keys[i]].Id, k.Items[keys[j]].Id)\n\t})\n\n\tbuf := new(strings.Builder)\n\tfor _, key := range keys {\n\t\titem := k.Items[key]\n\t\tif item.Certificate != nil {\n\t\t\tpublicKeyData, err := x509.MarshalPKIXPublicKey(item.Certificate.PublicKey)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"marshalling public key %s: %v\", item.Id, err)\n\t\t\t}\n\t\t\tif err = pem.Encode(buf, &pem.Block{Type: \"RSA PUBLIC KEY\", Bytes: publicKeyData}); err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"encoding public key %s: %v\", item.Id, err)\n\t\t\t}\n\t\t}\n\t}\n\treturn buf.String(), nil\n}\n\n// NewKeyset creates a Keyset.\nfunc NewKeyset(cert *pki.Certificate, privateKey *pki.PrivateKey) (*Keyset, error) {\n\tkeyset := &Keyset{\n\t\tItems: map[string]*KeysetItem{},\n\t}\n\t_, err := keyset.AddItem(cert, privateKey, true)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn keyset, nil\n}","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/ca.go#L160-L196","documentation":"Immediately after marshalling, ToPublicKeys PEM-encodes the PKIX bytes as an 'RSA PUBLIC KEY' block into a strings.Builder. pem.Encode returning an error is essentially impossible with a Builder (writes never fail), so this error is defensive — but if hit it means the public key could not be serialized to PEM.","triggerScenarios":"Keyset.ToPublicKeys: pem.Encode fails while writing the PEM block for item.Certificate's public key.","commonSituations":"In practice unreachable with a strings.Builder sink; seen only if the output writer is changed to a failing io.Writer in a fork/modified build.","solutions":["Treat as internal invariant failure; report with the item id and stack.","If running a patched kOps, check the custom output writer for errors.","Re-run the command; the operation is deterministic so escalate to maintainers if reproducible."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// PEM encode should never fail on a strings.Builder; pre-verify the cert marshals\n$ openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum  # DER conversion sanity","typeGuard":null,"tryCatchPattern":"try {\n  const pemKeys = keyset.toPublicKeys()\n} catch (e) {\n  if (/encoding public key/.test(e.message)) {\n    console.error(\"PEM encoding failed (likely modified build):\", e.message)\n    // report bug / check custom writers in patched builds\n  }\n  throw e\n}","preventionTips":["Treat this as a bug and report it with the item id.","Avoid patched kOps builds that change ToPublicKeys output writers.","Re-run to confirm determinism before escalating."],"tags":["pki","pem","keyset"],"backgroundTag":"pem-encoding-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}