{"record":{"id":"54819473344ef98d","repo":"sipeed/picoclaw","slug":"credential-keygen-marshal-private-key-w","errorCode":null,"errorMessage":"credential: keygen: marshal private key: %w","messagePattern":"credential: keygen: marshal private key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/credential/keygen.go","lineNumber":41,"sourceCode":"\n// GenerateSSHKey generates an Ed25519 SSH key pair and writes the private key\n// to path (permissions 0600) and the public key to path+\".pub\" (permissions 0644).\n// The ~/.ssh/ directory is created with 0700 if it does not exist.\n// If the files already exist they are overwritten.\nfunc GenerateSSHKey(path string) error {\n\tif err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: cannot create directory %q: %w\", filepath.Dir(path), err)\n\t}\n\n\tpubRaw, privRaw, err := ed25519.GenerateKey(rand.Reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: ed25519 key generation failed: %w\", err)\n\t}\n\n\t// Marshal private key as OpenSSH PEM.\n\tblock, err := ssh.MarshalPrivateKey(privRaw, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: marshal private key: %w\", err)\n\t}\n\tprivPEM := pem.EncodeToMemory(block)\n\n\tif err = os.WriteFile(path, privPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: write private key %q: %w\", path, err)\n\t}\n\n\t// Marshal public key as authorized_keys line.\n\tsshPub, err := ssh.NewPublicKey(pubRaw)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: marshal public key: %w\", err)\n\t}\n\tpubLine := ssh.MarshalAuthorizedKey(sshPub)\n\n\tpubPath := path + \".pub\"\n\tif err := os.WriteFile(pubPath, pubLine, 0o644); err != nil {\n\t\treturn fmt.Errorf(\"credential: keygen: write public key %q: %w\", pubPath, err)\n\t}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/credential/keygen.go#L23-L59","documentation":"ssh.MarshalPrivateKey(privRaw, \"\") encodes the just-generated Ed25519 private key as an OpenSSH PEM block. In x/crypto/ssh this only errors for key types it cannot serialize (e.g. PKCS1-dependent RSA signature hash configurations). Since the input is an Ed25519 key generated one line above, this branch is a defensive guard and is effectively unreachable.","triggerScenarios":"No realistic runtime trigger: the private key comes straight from ed25519.GenerateKey, which always produces a marshalable key. Could only fire with a patched/vendored x/crypto/ssh or if GenerateSSHKey were modified to accept externally supplied key material.","commonSituations":"Essentially never in the wild. If observed, suspect a forked dependency or a broken vendor tree rather than a runtime condition.","solutions":["Treat as an internal invariant failure: report and abort, do not retry","Verify the x/crypto module is unmodified: `go mod verify`","Rebuild from a clean module cache (`go clean -modcache`) if a corrupted vendored copy is suspected"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := credential.GenerateSSHKey(path); err != nil {\n    if strings.Contains(err.Error(), \"marshal private key\") {\n        return fmt.Errorf(\"internal keygen invariant violated, report upstream: %w\", err)\n    }\n    return err\n}","preventionTips":["Pin and verify the x/crypto module (`go mod verify`) so ssh.MarshalPrivateKey behaves as upstream","Treat as a build/dependency-integrity problem, not a runtime one"],"tags":["crypto","ssh","keygen","internal","defensive"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}