{"record":{"id":"81808802bdc55928","repo":"ipfs/kubo","slug":"failed-to-derive-peerid-from-privkey-w","errorCode":null,"errorMessage":"failed to derive PeerID from PrivKey: %w","messagePattern":"failed to derive PeerID from PrivKey: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/config.go","lineNumber":643,"sourceCode":"// config. Identity.PeerID must equal this value; the node refuses to start\n// when the two disagree.\nfunc nodePeerID(r repo.Repo) (peer.ID, error) {\n\tkeyF, err := getConfig(r, config.PrivKeySelector)\n\tif err != nil {\n\t\treturn \"\", errors.New(\"failed to get PrivKey\")\n\t}\n\tpkstr, ok := keyF.Value.(string)\n\tif !ok {\n\t\treturn \"\", errors.New(\"private key in config was not a string\")\n\t}\n\tident := config.Identity{PrivKey: pkstr}\n\tpk, err := ident.DecodePrivateKey(\"\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to decode PrivKey: %w\", err)\n\t}\n\tid, err := peer.IDFromPrivateKey(pk)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to derive PeerID from PrivKey: %w\", err)\n\t}\n\treturn id, nil\n}\n\nfunc replaceConfig(r repo.Repo, file io.Reader) error {\n\tvar newCfg config.Config\n\tif err := json.NewDecoder(file).Decode(&newCfg); err != nil {\n\t\treturn errors.New(\"failed to decode file as config\")\n\t}\n\n\t// Handle Identity.PrivKey (secret)\n\n\tif len(newCfg.Identity.PrivKey) != 0 {\n\t\treturn errors.New(\"setting private key with API is not supported\")\n\t}\n\n\tkeyF, err := getConfig(r, config.PrivKeySelector)\n\tif err != nil {","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/config.go#L625-L661","documentation":"After decoding PrivKey into a crypto private key, nodePeerID derives the libp2p PeerID with peer.IDFromPrivateKey. This wraps a failure of that derivation — the decoded key bytes are not usable to compute the corresponding PeerID (malformed key structure despite passing base64 decode). Rare, since decode and derivation usually fail together.","triggerScenarios":"A PrivKey string that base64-decodes and unmarshals but yields a key with invalid/missing public component; corrupted key material; keys of types whose PeerID derivation fails in the linked libp2p version.","commonSituations":"Configs assembled by merging fragments from different repos; keys altered by lossy text processing (charset conversion, line-wrapping corruption) that base64 still happens to accept.","solutions":["Replace the key with a known-good one: re-copy Identity.PrivKey from a backup of the original config","Regenerate the identity: `ipfs init` in a fresh directory and migrate pins/data, accepting the PeerID change","Verify the key round-trips in a scratch repo: set it there and run `ipfs id`; if that fails, the key material itself is corrupt","Check the underlying wrapped error (%w) for the specific crypto failure to confirm it's the key, not the repo"],"exampleFix":"// before: corrupted key from a lossy transfer\n\"PrivKey\": \"CAESqA…(truncated)…\"\n// after: exact base64 string from backup\n\"PrivKey\": \"CAESqA...==\"  # copied byte-for-byte","handlingStrategy":"retry","validationCode":"# verify the key works in a scratch repo before trusting it\nipfs init /tmp/scratch-repo && IPFS_PATH=/tmp/scratch-repo ipfs config --json Identity.PrivKey \"$(jq -r .Identity.PrivKey config.json)\"","typeGuard":null,"tryCatchPattern":"id, err := peer.IDFromPrivateKey(pk)\nif err != nil {\n    return fmt.Errorf(\"decoded PrivKey cannot yield a PeerID (restore key from backup): %w\", err)\n}","preventionTips":["Restore Identity.PrivKey from a known-good backup rather than repairing corrupted material","Round-trip test the key in a scratch repo (`ipfs id`) before deploying it to production configs","Avoid merging config fragments from different repos — take Identity wholesale from one source","Note PeerID changes if you regenerate; plan pin/data migration accordingly"],"tags":["config","crypto","peerid"],"backgroundTag":"peerid-derivation-failed","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}