{"record":{"id":"46c8d50439d73277","repo":"OpenNHP/opennhp","slug":"fail-to-create-private-key-directory-w","errorCode":null,"errorMessage":"fail to create private key directory: %w","messagePattern":"fail to create private key directory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/server/kbs/resource/resource.go","lineNumber":57,"sourceCode":"\tif err != nil {\n\t\tpanic(err)\n\t}\n}\n\nfunc generateCosignKeyPair(privateKeyPath, publicKeyPath string) error {\n\tif _, err := os.Stat(privateKeyPath); err == nil {\n\t\tif _, err := os.Stat(publicKeyPath); err == nil {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tkeys, err := cosign.GenerateKeyPair(nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(privateKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create private key directory: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(publicKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create public key directory: %w\", err)\n\t}\n\n\tif err := os.WriteFile(privateKeyPath, keys.PrivateBytes, 0600); err != nil {\n\t\treturn fmt.Errorf(\"fail to write private key file: %w\", err)\n\t}\n\n\tif err := os.WriteFile(publicKeyPath, keys.PublicBytes, 0644); err != nil { //nolint:gosec // G306: Public keys are intentionally world-readable\n\t\treturn fmt.Errorf(\"fail to write public key file: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc GetResource(c *gin.Context) {","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/resource/resource.go#L39-L75","documentation":"generateCosignKeyPair creates the cosign key pair at init time and prepares the directories for the private and public key files. This error is returned when os.MkdirAll for the private key's parent directory fails (wrapped as 'fail to create private key directory: %w').","triggerScenarios":"At package init, filepath.Dir(privateKeyPath) cannot be created — parent path is an existing file, permission denied, or a read-only filesystem.","commonSituations":"Deploying nhp-server with a read-only rootfs; privateKeyPath configured under a directory owned by another user; running the daemon without the required user in Docker; a typo making the dir path collide with an existing file.","solutions":["Check the wrapped error for EACCES/EROFS and fix filesystem permissions or mount","Verify privateKeyPath (private key dir env/config) points to a writable location","Run the daemon as a user with write access to the target directory","Pre-create the directory in the deployment image and give it proper ownership"],"exampleFix":"// before\nif err := os.MkdirAll(filepath.Dir(privateKeyPath), 0755); err != nil {\n\treturn fmt.Errorf(\"fail to create private key directory: %w\", err)\n}\n// after (configurable, validated path)\nkeyDir := os.Getenv(\"KBS_KEY_DIR\")\nif keyDir == \"\" {\n\tkeyDir = defaultKeyDir\n}\nif err := os.MkdirAll(keyDir, 0700); err != nil {\n\treturn fmt.Errorf(\"fail to create private key directory %s: %w\", keyDir, err)\n}","handlingStrategy":"validation","validationCode":"keyDir := filepath.Dir(privateKeyPath)\nif fi, err := os.Stat(keyDir); err == nil && !fi.IsDir() {\n\treturn fmt.Errorf(\"%s exists and is not a directory\", keyDir)\n}\nif err := os.MkdirAll(keyDir, 0755); err != nil {\n\treturn err\n}\nif f, err := os.CreateTemp(keyDir, \".wtest\"); err != nil {\n\treturn fmt.Errorf(\"key dir not writable: %w\", err)\n} else {\n\tf.Close(); os.Remove(f.Name())\n}","typeGuard":null,"tryCatchPattern":"if err := generateCosignKeyPair(); err != nil {\n\tif strings.Contains(err.Error(), \"fail to create private key directory\") {\n\t\tlog.Fatalf(\"cannot create key dir, check permissions/read-only fs: %v\", err)\n\t}\n\tlog.Fatalf(\"cosign keypair init failed: %v\", err)\n}","preventionTips":["Configure key paths to a writable volume (not the read-only image rootfs)","Run the daemon with a user that owns the key directory","Smoke-test directory writability in the deployment script before launch","Never point privateKeyPath at a path occupied by an existing file"],"tags":["go","filesystem","mkdir","cosign"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}