{"record":{"id":"862d5b3294d8ebda","repo":"netbirdio/netbird","slug":"read-artifact-key-file-w","errorCode":null,"errorMessage":"read artifact key file: %w","messagePattern":"read artifact key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactsign.go","lineNumber":208,"sourceCode":"\t// Validate artifact\n\tif err := reposign.ValidateArtifact([]reposign.PublicKey{publicKey}, artifactData, *signature); err != nil {\n\t\treturn fmt.Errorf(\"artifact verification failed: %w\", err)\n\t}\n\n\tcmd.Println(\"✅ Artifact signature is valid\")\n\tcmd.Printf(\"Artifact: %s\\n\", artifactFile)\n\tcmd.Printf(\"Signed by key: %s\\n\", signature.KeyID)\n\tcmd.Printf(\"Signature timestamp: %s\\n\", signature.Timestamp.Format(\"2006-01-02 15:04:05 MST\"))\n\treturn nil\n}\n\nfunc handleVerifyArtifactKey(cmd *cobra.Command, artifactKeyFile, rootKeyFile, signatureFile, revocationFile string) error {\n\tcmd.Println(\"🔍 Verifying artifact key...\")\n\n\t// Read artifact key data\n\tartifactKeyData, err := os.ReadFile(artifactKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read artifact key file: %w\", err)\n\t}\n\n\t// Read root public key(s)\n\trootKeyData, err := os.ReadFile(rootKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read root key file: %w\", err)\n\t}\n\n\trootPublicKeys, err := parseRootPublicKeys(rootKeyData)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse root public key(s): %w\", err)\n\t}\n\n\t// Read signature\n\tsigBytes, err := os.ReadFile(signatureFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read signature file: %w\", err)\n\t}","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactsign.go#L190-L226","documentation":"os.ReadFile on the --artifact-key-file path failed during verify-artifact-key. This flag takes the artifact public key (or root-signed bundle) file whose chain of trust is being checked. Standard *fs.PathError causes: missing path, permission denied, directory.","triggerScenarios":"Bundle file not copied to the verifier machine; relative path from wrong cwd; the flag was given the .sig file path instead of the key PEM.","commonSituations":"Verifying the published key bundle but pointing at a local path that was never fetched; flag confusion between --artifact-key-file and --signature-file.","solutions":["ls -l the exact --artifact-key-file value and fix the path","Download the published artifact-key-pub.pem (and its .sig) from the key store before verifying","Check the file is the PEM bundle, not the JSON .sig"],"exampleFix":"// before\nreturn fmt.Errorf(\"read artifact key file: %w\", err)\n\n// after\nreturn fmt.Errorf(\"read artifact key file %s: %w\", artifactKeyFile, err)","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(artifactKeyFile); err != nil {\n    log.Fatalf(\"artifact key bundle %s not readable: %v\", artifactKeyFile, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Download artifact-key-pub.pem and its .sig together from the key store","Distinguish key files from signature files by extension in scripts"],"tags":["go","cli","filesystem","release-signing"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}