{"record":{"id":"2eda0c3f8e54a6ee","repo":"docker/cli","slug":"private-key-file-s-must-not-be-readable-or-writab","errorCode":null,"errorMessage":"private key file %s must not be readable or writable by others","messagePattern":"private key file (.+?) must not be readable or writable by others","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":80,"sourceCode":"\tkeyBytes, err := getPrivKeyBytesFromPath(keyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"refusing to load key from %s: %w\", keyPath, err)\n\t}\n\tif err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {\n\t\treturn fmt.Errorf(\"error importing key from %s: %w\", keyPath, err)\n\t}\n\t_, _ = fmt.Fprintln(streams.Out(), \"Successfully imported key from\", keyPath)\n\treturn nil\n}\n\nfunc getPrivKeyBytesFromPath(keyPath string) ([]byte, error) {\n\tif runtime.GOOS != \"windows\" {\n\t\tfileInfo, err := os.Stat(keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n\t\t\treturn nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n\t\t}\n\t}\n\n\tfrom, err := os.OpenFile(keyPath, os.O_RDONLY, notary.PrivExecPerms)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer from.Close()\n\n\treturn io.ReadAll(from)\n}\n\nfunc loadPrivKeyBytesToStore(privKeyBytes []byte, privKeyImporters []trustmanager.Importer, keyPath, keyName string, passRet notary.PassRetriever) error {\n\tvar err error\n\tif _, _, err = tufutils.ExtractPrivateKeyAttributes(privKeyBytes); err != nil {\n\t\treturn fmt.Errorf(\"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add\", keyPath)\n\t}\n\tif privKeyBytes, err = decodePrivKeyIfNecessary(privKeyBytes, passRet); err != nil {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_load.go#L62-L98","documentation":"In getPrivKeyBytesFromPath (key_load.go:74-81), on non-Windows the file's mode bits ANDed with nonOwnerReadWriteMask (0o077) are non-zero, meaning group or others have read and/or write permission on the private key file. The loader refuses to use an over-exposed private key as a security guard. This check is skipped on Windows (runtime.GOOS == 'windows').","triggerScenarios":"Loading a private key file whose permissions include group read (mode ...04X), other read (...0X4), or any group/other write bit. Common after copying a key via a shared medium, extracting from a tarball that preserved loose perms, or creating it with a permissive umask.","commonSituations":"Key extracted from a zip/tar that set 0644; file created on a system with umask 022; key rsync'd with -p preserving group-readable perms; shared team directory where the file ended up group-readable; key downloaded from a secret manager with default perms.","solutions":["Tighten permissions to owner-only: chmod 600 <keyfile>, then re-run 'docker trust key load <keyfile>'.","If a stricter mode is desired, chmod 400; ensure no group/other bits remain (chmod go-rwx).","Fix the source so future copies preserve 0600 (e.g. cp --preserve=mode, or set umask 077 before creating)."],"exampleFix":"# before: key is group/other readable\nchmod 664 priv.key  # or it was extracted loose\ndocker trust key load priv.key  # -> must not be readable by others\n# after\nchmod 600 priv.key\ndocker trust key load priv.key","handlingStrategy":"validation","validationCode":"// Enforce owner-only permissions before handing the path to the loader.\nfunc enforceKeyFilePerms(path string) error {\n    if runtime.GOOS == \"windows\" {\n        return nil // check skipped on Windows by the loader\n    }\n    info, err := os.Stat(path)\n    if err != nil {\n        return err\n    }\n    if info.Mode()&0o077 != 0 {\n        if err := os.Chmod(path, 0o600); err != nil {\n            return fmt.Errorf(\"private key %s is group/other accessible and chmod failed: %w\", path, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if runtime.GOOS != \"windows\" {\n    if fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n        return nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n    }\n}","preventionTips":["Always create/copy private keys with chmod 600.","Set umask 077 in environments that materialize key files.","Avoid shared-group directories for private keys.","When extracting keys from archives, re-tighten permissions before use."],"tags":["docker","notary","content-trust","security","filesystem","permissions","private-key"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}