{"record":{"id":"3037ac8473356a27","repo":"netbirdio/netbird","slug":"read-public-key-file-w-3037ac","errorCode":null,"errorMessage":"read public key file: %w","messagePattern":"read public key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactsign.go","lineNumber":165,"sourceCode":"\t}\n\n\tsigFile := artifactFile + \".sig\"\n\tif err := os.WriteFile(artifactFile+\".sig\", signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", sigFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Artifact signed successfully.\\n\")\n\tcmd.Printf(\"Signature file: %s\\n\", sigFile)\n\treturn nil\n}\n\nfunc handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {\n\tcmd.Println(\"🔍 Verifying artifact...\")\n\n\t// Read artifact public key\n\tpubKeyPEM, err := os.ReadFile(pubKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read public key file: %w\", err)\n\t}\n\n\tpublicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse artifact public key: %w\", err)\n\t}\n\n\t// Read artifact data\n\tartifactData, err := os.ReadFile(artifactFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read artifact file: %w\", err)\n\t}\n\n\t// Read signature\n\tsigBytes, err := os.ReadFile(signatureFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read signature file: %w\", err)\n\t}","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactsign.go#L147-L183","documentation":"os.ReadFile on the --artifact-public-key-file path failed during verify-artifact. The wrapped *fs.PathError names the cause (missing file, permission denied, is a directory). The path is required by the command, so this is purely a bad path or permissions.","triggerScenarios":"Typo in the flag value; relative path resolved from the wrong cwd; the public key file was not fetched from the release key store; directory passed instead of the PEM file.","commonSituations":"Verifier machine has a stale copy of the keys directory; CI checkout path differs from the one hard-coded in the script.","solutions":["ls -l the exact --artifact-public-key-file value and fix the path (prefer absolute paths)","Re-download or copy the artifact public key from the release key store","Check read permission on the file and parent directories"],"exampleFix":"// before\nreturn fmt.Errorf(\"read public key file: %w\", err)\n\n// after\nreturn fmt.Errorf(\"read public key file %s: %w\", pubKeyFile, err)","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(pubKeyFile); err != nil {\n    log.Fatalf(\"public key %s not readable: %v\", pubKeyFile, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fetch the key set from a single canonical location before every verification run","Pin absolute paths in verification scripts"],"tags":["go","cli","filesystem","release-signing"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}