{"record":{"id":"73a0b3ab78fc20fd","repo":"larksuite/cli","slug":"failed-to-read-s-q-w","errorCode":null,"errorMessage":"failed to read %s %q: %w","messagePattern":"failed to read (.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/tls_ca.go","lineNumber":39,"sourceCode":"func applyExtraRootCA(t *http.Transport, caPath string) error {\n\tcaPath = strings.TrimSpace(caPath)\n\tif caPath == \"\" {\n\t\treturn nil\n\t}\n\tif !filepath.IsAbs(caPath) {\n\t\treturn fmt.Errorf(\"invalid %s %q: must be an absolute path to a PEM file\", envvars.CliCAPath, caPath)\n\t}\n\tsafeCAPath, err := binding.AssertSecurePath(binding.AuditParams{\n\t\tTargetPath:            caPath,\n\t\tLabel:                 envvars.CliCAPath,\n\t\tAllowReadableByOthers: true,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unsafe %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\tpemBytes, err := vfs.ReadFile(safeCAPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\n\t// Augment the system trust store. Do NOT silently discard a SystemCertPool\n\t// error: falling back to an empty pool would make this transport trust ONLY\n\t// the extra CA (dropping all system roots), which narrows trust unexpectedly\n\t// and could break TLS to legitimate endpoints. Fail closed instead.\n\tpool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load system cert pool for %s: %w\", envvars.CliCAPath, err)\n\t}\n\tif pool == nil {\n\t\tpool = x509.NewCertPool()\n\t}\n\tif ok := pool.AppendCertsFromPEM(pemBytes); !ok {\n\t\treturn fmt.Errorf(\"invalid %s %q: no certificates parsed from PEM\", envvars.CliCAPath, caPath)\n\t}\n\n\tif t.TLSClientConfig == nil {","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/tls_ca.go#L21-L57","documentation":"The CA file passed the security check but could not be read from disk via vfs.ReadFile. The CLI wraps the OS-level error ('no such file', 'permission denied', etc.) with 'failed to read CLI_CA_PATH ...'. Trust material cannot be loaded, so the transport fails closed.","triggerScenarios":"CLI_CA_PATH points to a non-existent or unreadable file; applyExtraRootCA calls vfs.ReadFile(safeCAPath) and gets an error.","commonSituations":"Typo in the path; file deleted between provisioning and run; container image missing the mounted CA; user lacks read permission on the PEM file.","solutions":["Verify the file exists: ls -l /path/to/ca.pem (check for typos).","Fix permissions so the CLI user can read it (chmod/chown).","Mount or copy the CA bundle into the container/host at the configured absolute path."],"exampleFix":"// before\nexport LARKSUITE_CLI_CA_PATH=\"/etc/ssl/corp-ca.pem\"  # file does not exist\n// after\nsudo install -m 0644 corp-ca.pem /etc/ssl/corp-ca.pem && export LARKSUITE_CLI_CA_PATH=\"/etc/ssl/corp-ca.pem\"","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(caPath); err != nil {\n\treturn fmt.Errorf(\"CA file missing/unreadable before launch: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := os.ReadFile(caPath); err != nil {\n\tlog.Fatalf(\"cannot read CA file %q: %v — check path and permissions\", caPath, err)\n}","preventionTips":["Pre-flight check file existence/readability in entrypoint scripts.","Ensure container images mount or bake the CA bundle at the configured path.","Watch for permission drift after deploys (chown/chmod in provisioning)."],"tags":["tls","filesystem","certificate"],"backgroundTag":"ca-file-read-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}