{"record":{"id":"44f4ae8de0e8e03b","repo":"txthinking/brook","slug":"certkey-must-be-with-absolute-path","errorCode":null,"errorMessage":"--certkey must be with absolute path","messagePattern":"--certkey must be with absolute path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/brook/main.go","lineNumber":865,"sourceCode":"\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\tif c.String(\"domainaddress\") == \"\" || c.String(\"password\") == \"\" {\n\t\t\t\t\treturn cli.ShowSubcommandHelp(c)\n\t\t\t\t}\n\t\t\t\tif c.String(\"blockDomainList\") != \"\" && !strings.HasPrefix(c.String(\"blockDomainList\"), \"http://\") && !strings.HasPrefix(c.String(\"blockDomainList\"), \"https://\") && !filepath.IsAbs(c.String(\"blockDomainList\")) {\n\t\t\t\t\treturn errors.New(\"--blockDomainList must be with absolute path\")\n\t\t\t\t}\n\t\t\t\tif c.String(\"blockCIDR4List\") != \"\" && !strings.HasPrefix(c.String(\"blockCIDR4List\"), \"http://\") && !strings.HasPrefix(c.String(\"blockCIDR4List\"), \"https://\") && !filepath.IsAbs(c.String(\"blockCIDR4List\")) {\n\t\t\t\t\treturn errors.New(\"--blockCIDR4List must be with absolute path\")\n\t\t\t\t}\n\t\t\t\tif c.String(\"blockCIDR6List\") != \"\" && !strings.HasPrefix(c.String(\"blockCIDR6List\"), \"http://\") && !strings.HasPrefix(c.String(\"blockCIDR6List\"), \"https://\") && !filepath.IsAbs(c.String(\"blockCIDR6List\")) {\n\t\t\t\t\treturn errors.New(\"--blockCIDR6List must be with absolute path\")\n\t\t\t\t}\n\t\t\t\tif c.String(\"cert\") != \"\" && !filepath.IsAbs(c.String(\"cert\")) {\n\t\t\t\t\treturn errors.New(\"--cert must be with absolute path\")\n\t\t\t\t}\n\t\t\t\tif c.String(\"certkey\") != \"\" && !filepath.IsAbs(c.String(\"certkey\")) {\n\t\t\t\t\treturn errors.New(\"--certkey must be with absolute path\")\n\t\t\t\t}\n\t\t\t\tif c.String(\"blockDomainList\") != \"\" || c.String(\"blockCIDR4List\") != \"\" || c.String(\"blockCIDR6List\") != \"\" || len(c.StringSlice(\"blockGeoIP\")) != 0 {\n\t\t\t\t\tp, err := block.NewBlock(c.String(\"blockDomainList\"), c.String(\"blockCIDR4List\"), c.String(\"blockCIDR6List\"), c.StringSlice(\"blockGeoIP\"), c.Int(\"updateListInterval\"))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn err\n\t\t\t\t\t}\n\t\t\t\t\tp.TouchBrook()\n\t\t\t\t\tif c.Int(\"updateListInterval\") != 0 {\n\t\t\t\t\t\tg.Add(&runnergroup.Runner{\n\t\t\t\t\t\t\tStart: func() error {\n\t\t\t\t\t\t\t\tp.Update()\n\t\t\t\t\t\t\t\treturn nil\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tStop: func() error {\n\t\t\t\t\t\t\t\tp.Stop()\n\t\t\t\t\t\t\t\treturn nil\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t})","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/txthinking/brook/blob/5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8/cli/brook/main.go#L847-L883","documentation":"When --certkey is provided to the brook server subcommand it must be an absolute path; relative paths are rejected during argument validation before the server starts. This mirrors the --cert requirement so TLS material is always locatable regardless of working directory.","triggerScenarios":"Running `brook server` with --certkey set to a relative path, e.g. --certkey server.key, even if --cert itself is absolute.","commonSituations":"Users fix --cert to an absolute path but forget --certkey in the same invocation; the key file usually sits next to the certificate in the launch directory.","solutions":["Pass an absolute path: --certkey /etc/brook/server.key","Use realpath: --certkey \"$(realpath server.key)\"","Make both TLS flags absolute in the same config/systemd unit"],"exampleFix":"// before\nbrook server --cert /etc/brook/server.crt --certkey server.key\n// after\nbrook server --cert /etc/brook/server.crt --certkey /etc/brook/server.key","handlingStrategy":"validation","validationCode":"if key := flagValue; key != \"\" && !filepath.IsAbs(key) {\n    return fmt.Errorf(\"--certkey must be an absolute path, got %q\", key)\n}","typeGuard":"func isAbsPath(p string) bool { return filepath.IsAbs(p) }","tryCatchPattern":null,"preventionTips":["Fix both TLS flags in the same edit; never make one absolute and leave the other relative","In launch scripts, derive both from one absolute dir: CERT_DIR=/etc/brook","Validate with a dry run before installing the service unit"],"tags":["cli","go","tls","path-validation","brook"],"backgroundTag":"invalid-flag-value","analyzedSha":"5cd13ef3b1fb574e88ebf2c1b5d95f2ebe1342c8","analyzedAt":"2026-09-06T04:35:00.432Z","contentChangedAt":"2026-09-06T04:35:00.432Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}