{"record":{"id":"8edf30092ded6c07","repo":"netbirdio/netbird","slug":"write-public-keys-file-s-w","errorCode":null,"errorMessage":"write public keys file (%s): %w","messagePattern":"write public keys file \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":166,"sourceCode":"\t\tpubPem, err := os.ReadFile(pubFile)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"read public key file: %w\", err)\n\t\t}\n\n\t\tpk, err := reposign.ParseArtifactPubKey(pubPem)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse artifact key: %w\", err)\n\t\t}\n\t\tpublicKeys = append(publicKeys, pk)\n\t}\n\n\tparsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"bundle artifact keys: %w\", err)\n\t}\n\n\tif err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public keys file (%s): %w\", bundlePubKeysFile, err)\n\t}\n\n\tsignatureFile := bundlePubKeysFile + \".sig\"\n\tif err := os.WriteFile(signatureFile, signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", signatureFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Bundle created with %d public keys.\\n\", len(artifactPubKeyFiles))\n\treturn nil\n}\n","sourceCodeStart":148,"sourceCodeEnd":177,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L148-L177","documentation":"os.WriteFile failed for the signed bundle output at --bundle-pub-key-file with mode 0600. Standard *fs.PathError: missing parent directory, permission denied, read-only filesystem, or ENOSPC.","triggerScenarios":"bundle-pub-keys writing to a path whose directory does not exist or is not writable; existing bundle file owned by another user.","commonSituations":"Output dir never created in the release pipeline; rerunning as a different user over an earlier root-owned bundle; read-only artifact mount.","solutions":["mkdir -p the output directory and confirm write permission","Remove or chown a stale bundle file from a previous run","Use an absolute output path to avoid working-directory surprises"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"os.MkdirAll(filepath.Dir(bundlePubKeysFile), 0o700)\nif err := os.WriteFile(bundlePubKeysFile+\".probe\", []byte{}, 0o600); err != nil { ... }\nos.Remove(bundlePubKeysFile + \".probe\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create and permission the output directory in a preparatory CI step","Recreate the whole output directory each run instead of reusing it","Use consistent uid across pipeline steps that write release artifacts"],"tags":["cli","file-io","permissions","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}