{"record":{"id":"92ed6b610c4b8627","repo":"OpenNHP/opennhp","slug":"fail-to-write-private-key-file-w","errorCode":null,"errorMessage":"fail to write private key file: %w","messagePattern":"fail to write private key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/server/kbs/resource/resource.go","lineNumber":65,"sourceCode":"\t\t\treturn nil\n\t\t}\n\t}\n\n\tkeys, err := cosign.GenerateKeyPair(nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(privateKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create private key directory: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(publicKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create public key directory: %w\", err)\n\t}\n\n\tif err := os.WriteFile(privateKeyPath, keys.PrivateBytes, 0600); err != nil {\n\t\treturn fmt.Errorf(\"fail to write private key file: %w\", err)\n\t}\n\n\tif err := os.WriteFile(publicKeyPath, keys.PublicBytes, 0644); err != nil { //nolint:gosec // G306: Public keys are intentionally world-readable\n\t\treturn fmt.Errorf(\"fail to write public key file: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc GetResource(c *gin.Context) {\n\tpath := c.Param(\"path\")\n\tif path == \"\" {\n\t\tc.JSON(http.StatusBadRequest, gin.H{\"error\": \"resource path is empty\"})\n\t\treturn\n\t}\n\n\tauthHeader := c.GetHeader(\"Authorization\")\n\tif authHeader == \"\" || !strings.HasPrefix(authHeader, \"Bearer \") {","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/resource/resource.go#L47-L83","documentation":"generateCosignKeyPair writes the cosign private key bytes to privateKeyPath with mode 0600 after creating its directory. This error is returned when os.WriteFile fails (wrapped as 'fail to write private key file: %w').","triggerScenarios":"At init, writing the private key fails — directory exists but is not writable, disk full, path is an existing directory, or quota exceeded.","commonSituations":"Disk-full on the node hosting nhp-server; privateKeyPath colliding with an existing directory name; permissions changed after first run; read-only overlay during container upgrades.","solutions":["Check the wrapped error for EACCES/ENOSPC/EISDIR and correct permissions or free disk space","Ensure privateKeyPath is a writable file path, not an existing directory","Run the process as a user owning the key directory","Mount the key directory as a writable volume in container deployments"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if fi, err := os.Stat(privateKeyPath); err == nil && fi.IsDir() {\n\treturn fmt.Errorf(\"%s is a directory\", privateKeyPath)\n}\nif err := syscall.Access(filepath.Dir(privateKeyPath), syscall.W_OK); err != nil {\n\treturn fmt.Errorf(\"key dir not writable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := generateCosignKeyPair(); err != nil {\n\tif strings.Contains(err.Error(), \"fail to write private key file\") {\n\t\tlog.Fatalf(\"private key write failed (check disk space/permissions): %v\", err)\n\t}\n\tlog.Fatalf(\"cosign keypair init failed: %v\", err)\n}","preventionTips":["Monitor free disk space on the key volume","Write keys to a dedicated persistent volume in containers","Ensure the process user has write access to the key directory","Do not let a directory name collide with the key file path"],"tags":["go","filesystem","file-write","cosign"],"backgroundTag":"file-write-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}