{"record":{"id":"98bed4f36dc2b09d","repo":"apache/beam","slug":"can-t-read-parse-private-key","errorCode":null,"errorMessage":"Can't read parse private key","messagePattern":"Can't read parse private key","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java","lineNumber":138,"sourceCode":"      if (pemObject == null) {\n        // If it is not a PEM file then it is not possible to determine the encryption state\n        return KeyEncryptionState.UNKNOWN;\n      }\n      if (ENCRYPTED_PRIVATE_KEY.equals(pemObject.getType())) {\n        return KeyEncryptionState.ENCRYPT;\n      } else if (UNENCRYPTED_PRIVATE_KEY.equals(pemObject.getType())) {\n        return KeyEncryptionState.UNENCRYPTED;\n      } else {\n        throw new RuntimeException(\n            \"Invalid type of PEM file: \"\n                + pemObject.getType()\n                + \". Supported types: \"\n                + ENCRYPTED_PRIVATE_KEY\n                + \", \"\n                + UNENCRYPTED_PRIVATE_KEY);\n      }\n    } catch (IOException e) {\n      throw new RuntimeException(\"Can't read parse private key\");\n    }\n  }\n\n  public static String readPrivateKeyFile(String privateKeyPath) {\n    try {\n      byte[] keyBytes = Files.readAllBytes(Paths.get(privateKeyPath));\n      return new String(keyBytes, StandardCharsets.UTF_8);\n    } catch (IOException e) {\n      throw new RuntimeException(\"Can't read private key from provided path\");\n    }\n  }\n}\n","sourceCodeStart":120,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java#L120-L151","documentation":"KeyPairUtils.guessKeyEncryptionState reads a private key file and, if any IOException occurs while parsing the key's encryption state, wraps it in an uninformative RuntimeException('Can't read parse private key'). It is thrown only in the catch block after attempting to read the file contents, so it signals the key file could not be read or the input stream failed mid-parse.","triggerScenarios":"Calling SnowflakeIO with a private key path/file whose underlying IOException occurs inside guessKeyEncryptionState (e.g. unreadable file, invalid path, stream closed) while the transform determines whether the key is ENCRYPTED_PRIVATE_KEY or UNENCRYPTED_PRIVATE_KEY.","commonSituations":"Private key file deleted or moved after config was written; wrong path or relative path resolved against a different working directory on a Beam worker; file permissions deny read on the runner node; key file is a directory or symlink to nothing.","solutions":["Verify the private key file exists and is readable at the exact path on the machine executing the transform (Beam workers may differ from your local machine).","Stage the key file with Beam's FileSystems/withBeamPipelineOptions (e.g. copy to a GCS path and use snowflake's keyFile staging) instead of relying on a local path.","Convert the PKCS8 key to a plain unencrypted file (openssl pkcs8 -topk8 -nocrypt) if you don't need passphrase encryption, avoiding the encrypted-key parse path.","Check file permissions (chmod 400/600) and that the path is absolute."],"exampleFix":"// before\n.withPrivateKey(\"/home/me/wrong-name.p8\")\n// after\n.withPrivateKey(\"/etc/beam/keys/rsa_key.p8\")  // absolute, existing, readable path","handlingStrategy":"validation","validationCode":"java.nio.file.Path p = java.nio.file.Paths.get(keyPath);\nif (!java.nio.file.Files.isRegularFile(p) || !java.nio.file.Files.isReadable(p)) {\n  throw new IllegalStateException(\"Private key file missing or unreadable: \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for key files.","Stage key files with the pipeline (worker images differ from local machines).","Check readability with Files.isReadable before building the pipeline.","Prefer unencrypted PKCS8 keys when passphrase handling isn't needed."],"tags":["java","file-io","snowflake","private-key"],"backgroundTag":"file-read-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}