{"record":{"id":"9f91b745d21a2537","repo":"OpenNHP/opennhp","slug":"fail-to-create-public-key-directory-w","errorCode":null,"errorMessage":"fail to create public key directory: %w","messagePattern":"fail to create public key directory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/server/kbs/resource/resource.go","lineNumber":61,"sourceCode":"\nfunc generateCosignKeyPair(privateKeyPath, publicKeyPath string) error {\n\tif _, err := os.Stat(privateKeyPath); err == nil {\n\t\tif _, err := os.Stat(publicKeyPath); err == nil {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tkeys, err := cosign.GenerateKeyPair(nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(privateKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create private key directory: %w\", err)\n\t}\n\n\tif err := os.MkdirAll(filepath.Dir(publicKeyPath), 0755); err != nil {\n\t\treturn fmt.Errorf(\"fail to create public key directory: %w\", err)\n\t}\n\n\tif err := os.WriteFile(privateKeyPath, keys.PrivateBytes, 0600); err != nil {\n\t\treturn fmt.Errorf(\"fail to write private key file: %w\", err)\n\t}\n\n\tif err := os.WriteFile(publicKeyPath, keys.PublicBytes, 0644); err != nil { //nolint:gosec // G306: Public keys are intentionally world-readable\n\t\treturn fmt.Errorf(\"fail to write public key file: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc GetResource(c *gin.Context) {\n\tpath := c.Param(\"path\")\n\tif path == \"\" {\n\t\tc.JSON(http.StatusBadRequest, gin.H{\"error\": \"resource path is empty\"})\n\t\treturn","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/resource/resource.go#L43-L79","documentation":"generateCosignKeyPair creates the cosign key pair at init time and prepares directories for both key files. This error is returned when os.MkdirAll for the public key's parent directory fails (wrapped as 'fail to create public key directory: %w').","triggerScenarios":"At package init, os.MkdirAll(filepath.Dir(publicKeyPath), 0755) fails because the public key parent directory cannot be created (permissions, read-only fs, path occupied by a file).","commonSituations":"publicKeyPath set to a directory the service user cannot write; container image with read-only filesystem; divergent private/public key directories where only one is writable; init-time crash loop on startup.","solutions":["Check the wrapped error and grant write permission on the public key's parent directory","Align publicKeyPath with privateKeyPath's directory unless a separate public location is required","Make the key paths configurable via env/config and validated at startup","Pre-create and chown the directory in the deployment image"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"pubDir := filepath.Dir(publicKeyPath)\nif err := os.MkdirAll(pubDir, 0755); err != nil {\n\treturn fmt.Errorf(\"public key dir %s not creatable: %w\", pubDir, err)\n}\nif f, err := os.CreateTemp(pubDir, \".wtest\"); err != nil {\n\treturn fmt.Errorf(\"public key dir not writable: %w\", err)\n} else {\n\tf.Close(); os.Remove(f.Name())\n}","typeGuard":null,"tryCatchPattern":"if err := generateCosignKeyPair(); err != nil {\n\tif strings.Contains(err.Error(), \"fail to create public key directory\") {\n\t\tlog.Fatalf(\"cannot create public key dir %s: %v\", filepath.Dir(publicKeyPath), err)\n\t}\n\tlog.Fatalf(\"cosign keypair init failed: %v\", err)\n}","preventionTips":["Keep public and private keys in the same writable directory by default","Pre-create and chown key directories in the container image","Check mounts are read-write before starting the daemon","Validate both key paths point to distinct, regular file names"],"tags":["go","filesystem","mkdir","cosign"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}