{"record":{"id":"ab47afada58f8a28","repo":"slackhq/nebula","slug":"error-while-writing-out-pub-s","errorCode":null,"errorMessage":"error while writing out-pub: %s","messagePattern":"error while writing out-pub: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/keygen.go","lineNumber":107,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while creating PKCS#11 client: %w\", err)\n\t\t}\n\t\tdefer func(client *pkclient.PKClient) {\n\t\t\t_ = client.Close()\n\t\t}(p11Client)\n\t\tpub, err = p11Client.GetPubKey()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while getting public key: %w\", err)\n\t\t}\n\t} else {\n\t\terr = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error while writing out-key: %s\", err)\n\t\t}\n\t}\n\terr = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error while writing out-pub: %s\", err)\n\t}\n\n\treturn nil\n}\n\nfunc keygenSummary() string {\n\treturn \"keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`\"\n}\n\nfunc keygenHelp(out io.Writer) {\n\tcf := newKeygenFlags()\n\t_, _ = out.Write([]byte(\"Usage of \" + os.Args[0] + \" \" + keygenSummary() + \"\\n\"))\n\t_, _ = out.Write([]byte(stdioHelpText))\n\tcf.set.SetOutput(out)\n\tcf.set.PrintDefaults()\n}\n","sourceCodeStart":89,"sourceCodeEnd":124,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/keygen.go#L89-L124","documentation":"keygen wraps any failure from writeOutput (which persists the marshalled public key to the --out-pub path, or emits it on stdout in stdio mode) with this message. It means the public key PEM could not be written to the requested destination. It is thrown after the private key was already written successfully, so the run is partially complete.","triggerScenarios":"calling `nebula-cert keygen` when the --out-pub path is unwritable (missing directory, permission denied, disk full) or the parent function keygen returns non-nil from writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)","commonSituations":"running keygen as a non-root user against a root-owned output directory; --out-pub pointing at a nonexistent directory; a path that is actually a directory rather than a file; read-only filesystems in containers","solutions":["Create the target directory for --out-pub (mkdir -p) and check file permissions","Run with write permission to the output path (correct user, chmod/chown)","Verify --out-pub points to a file, not a directory, and the filesystem is not read-only","Check disk space (ENOSPC) via df","Use stdio mode (--out-pub/stdout behavior) if filesystem writes are unavailable"],"exampleFix":"// before\nnebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/missing-dir/host.pub\n// after\nmkdir -p /etc/nebula && nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub","handlingStrategy":"validation","validationCode":"pubPath := *cf.outPubPath\nif dir := filepath.Dir(pubPath); dir != \"\" {\n    if st, err := os.Stat(dir); err != nil || !st.IsDir() {\n        return fmt.Errorf(\"out-pub directory %q missing\", dir)\n    }\n}\nif f, err := os.OpenFile(pubPath, os.O_WRONLY|os.O_CREATE, 0600); err == nil { f.Close() }","typeGuard":null,"tryCatchPattern":"if err := keygen(args, out); err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && strings.Contains(err.Error(), \"writing out-pub\") {\n        log.Printf(\"cannot write public key to %s: %v\", pe.Path, pe.Err)\n    }\n}","preventionTips":["mkdir -p the output directory before running keygen","Verify write permission on the output directory for the executing user","Prefer absolute paths for --out-pub","Check disk space before batch key generation"],"tags":["filesystem","file-write","nebula-cert"],"backgroundTag":"file-write-permission-denied","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}