{"record":{"id":"2813896ead93147d","repo":"netbirdio/netbird","slug":"bundle-artifact-keys-w","errorCode":null,"errorMessage":"bundle artifact keys: %w","messagePattern":"bundle artifact keys: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":162,"sourceCode":"\t}\n\n\tpublicKeys := make([]reposign.PublicKey, 0, len(artifactPubKeyFiles))\n\tfor _, pubFile := range artifactPubKeyFiles {\n\t\tpubPem, err := os.ReadFile(pubFile)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"read public key file: %w\", err)\n\t\t}\n\n\t\tpk, err := reposign.ParseArtifactPubKey(pubPem)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse artifact key: %w\", err)\n\t\t}\n\t\tpublicKeys = append(publicKeys, pk)\n\t}\n\n\tparsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"bundle artifact keys: %w\", err)\n\t}\n\n\tif err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public keys file (%s): %w\", bundlePubKeysFile, err)\n\t}\n\n\tsignatureFile := bundlePubKeysFile + \".sig\"\n\tif err := os.WriteFile(signatureFile, signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", signatureFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Bundle created with %d public keys.\\n\", len(artifactPubKeyFiles))\n\treturn nil\n}\n","sourceCodeStart":144,"sourceCodeEnd":177,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L144-L177","documentation":"reposign.BundleArtifactKeys failed to build and sign the bundle. Its concrete failures are 'no keys to bundle' (unreachable here because the CLI guards for a non-empty list), public key marshalling, or signing the bundle with the root key; a root key past its expiration surfaces at this signing stage.","triggerScenarios":"Bundling with an expired root key; a corrupted root key that fails the bundle signing step; degenerate empty key list reaching the library directly.","commonSituations":"Long-lived CI bundling job whose root key expired between runs; root key file corrupted in storage or truncated in transit.","solutions":["Check the chained message; regenerate the root key with create-root-key if it is expired and re-issue artifact keys","Verify the root key file is intact (parse it standalone with verify-artifact-key or a PEM check)","Confirm the key list passed is non-empty when calling the library directly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Guard before calling the library directly\nif len(publicKeys) == 0 {\n    return errors.New(\"refusing to bundle zero keys\")\n}\nif time.Now().After(rootKey.Metadata.ExpiresAt) {\n    return errors.New(\"rotate root key before bundling\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Track root key expiry in the release calendar and rotate ahead of it","Smoke-test the root key by signing a byte of test data before each bundling run","Keep the root key bytes intact in transit (base64 secrets, not copy-paste)"],"tags":["cli","cryptography","signing","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}