{"record":{"id":"8bbbc7fc31259c77","repo":"docker/cli","slug":"refusing-to-load-key-from-s-w","errorCode":null,"errorMessage":"refusing to load key from %s: %w","messagePattern":"refusing to load key from (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":64,"sourceCode":"func loadPrivKey(streams command.Streams, keyPath string, options keyLoadOptions) error {\n\t// validate the key name if provided\n\tif options.keyName != \"\" && !validKeyName(options.keyName) {\n\t\treturn fmt.Errorf(\"key name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", options.keyName)\n\t}\n\ttrustDir := trust.GetTrustDirectory()\n\tkeyFileStore, err := storage.NewPrivateKeyFileStorage(trustDir, notary.KeyExtension)\n\tif err != nil {\n\t\treturn err\n\t}\n\tprivKeyImporters := []trustmanager.Importer{keyFileStore}\n\n\t_, _ = fmt.Fprintf(streams.Out(), \"Loading key from \\\"%s\\\"...\\n\", keyPath)\n\n\t// Always use a fresh passphrase retriever for each import\n\tpassRet := trust.GetPassphraseRetriever(streams.In(), streams.Out())\n\tkeyBytes, err := getPrivKeyBytesFromPath(keyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"refusing to load key from %s: %w\", keyPath, err)\n\t}\n\tif err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {\n\t\treturn fmt.Errorf(\"error importing key from %s: %w\", keyPath, err)\n\t}\n\t_, _ = fmt.Fprintln(streams.Out(), \"Successfully imported key from\", keyPath)\n\treturn nil\n}\n\nfunc getPrivKeyBytesFromPath(keyPath string) ([]byte, error) {\n\tif runtime.GOOS != \"windows\" {\n\t\tfileInfo, err := os.Stat(keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n\t\t\treturn nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n\t\t}\n\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_load.go#L46-L82","documentation":"In loadPrivKey (key_load.go:62-65), getPrivKeyBytesFromPath(keyPath) failed and is wrapped as 'refusing to load key from <path>'. getPrivKeyBytesFromPath (key_load.go:73-91) stats the file, checks the permission mask on non-Windows, opens it read-only, and reads all bytes - so this wraps any of: file not found, permission check failure (others can read/write it), open error, or read error.","triggerScenarios":"The KEYFILE path does not exist; the file exists but is openable only by another user; the file permissions allow group/other read or write (fails the nonOwnerReadWriteMask check -> but that has its own dedicated message at 557, so this wrap is for the os.Stat/os.OpenFile/io.ReadAll errors); I/O error reading the file.","commonSituations":"Typo in the key file path; relative path from a different cwd; file deleted between check and read; running as a user without read permission; NFS/filesystem hiccup; path is a directory not a file.","solutions":["Verify the file exists and is readable: ls -l <keyfile> and cat <keyfile> | head -c 20.","Use an absolute path to avoid cwd issues.","Check ownership/permissions: chown/chmod so the current user can read it (but keep it 0600 - see error 557).","Confirm the path is a regular file, not a directory.","Inspect the wrapped %w error for the exact os error (ENOENT, EACCES, etc.)."],"exampleFix":"# before\ndocker trust key load ~/wrong-name.key  # typo\ndocker trust key load ./priv.key  # wrong cwd\n# after\ndocker trust key load /home/user/keys/priv.key","handlingStrategy":"validation","validationCode":"// Validate the key file path is readable before loading.\nfunc ensureKeyFileReadable(path string) error {\n    info, err := os.Stat(path)\n    if err != nil {\n        return fmt.Errorf(\"refusing to load key from %s: %w\", path, err)\n    }\n    if info.IsDir() {\n        return fmt.Errorf(\"refusing to load key from %s: not a file\", path)\n    }\n    f, err := os.Open(path)\n    if err != nil {\n        return fmt.Errorf(\"refusing to load key from %s: %w\", path, err)\n    }\n    f.Close()\n    return nil\n}","typeGuard":null,"tryCatchPattern":"keyBytes, err := getPrivKeyBytesFromPath(keyPath)\nif err != nil {\n    return fmt.Errorf(\"refusing to load key from %s: %w\", keyPath, err)\n}","preventionTips":["Use absolute paths for the key file to avoid cwd confusion.","Confirm the file exists and is owned/readable by the current user.","Keep key files at 0600 so the permission guard (error 557) also passes."],"tags":["docker","notary","content-trust","filesystem","validation","path","permissions"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}