{"record":{"id":"be49c852169f014b","repo":"goharbor/harbor","slug":"key-file-permission-is-not-600","errorCode":null,"errorMessage":"key file {} permission is not 600","messagePattern":"key file (.+?) permission is not 600","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"make/photon/prepare/models.py","lineNumber":80,"sourceCode":"\n    def _check(self, filename: str):\n        \"\"\"\n        Check cert and key files are correct\n        \"\"\"\n\n        path = Path(os.path.join(internal_tls_dir, filename))\n\n        if not path.exists:\n            if filename == 'harbor_internal_ca.crt':\n                return\n            raise Exception('File {} not exist'.format(filename))\n\n        if not path.is_file:\n            raise Exception('invalid {}'.format(filename))\n\n        # check key file permission\n        if filename.endswith('.key') and not check_permission(path, mode=0o600):\n            raise Exception('key file {} permission is not 600'.format(filename))\n\n        # check certificate file\n        if filename.endswith('.crt'):\n            if not owner_can_read(path.stat().st_mode):\n                # check owner can read cert file\n                raise Exception('File {} should readable by owner'.format(filename))\n            if not san_existed(path):\n                # check SAN included\n                if filename == 'harbor_internal_ca.crt':\n                    return\n                raise Exception('cert file {} should include SAN'.format(filename))\n\n    def validate(self):\n        if not self.enabled:\n            # pass the validation if not enabled\n            return\n\n        if not internal_tls_dir.exists():","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/make/photon/prepare/models.py#L62-L98","documentation":"The second assertion in MergeNativeReport (src/pkg/scan/report/report.go): after r1 has already passed the *vuln.Report check, the SECOND operand r2 fails the same type assertion. The merge is between two untyped values routed through SupportedMergers, so any operand that is not exactly a *vuln.Report pointer (nil included) aborts the merge.","triggerScenarios":"Merging reports collected from heterogeneous sources — e.g. r1 decoded via ResolveData into *vuln.Report but r2 loaded from a store, a different mime type, or a nil interface.","commonSituations":"Merging a freshly scanned report with a legacy or raw one; mixed mime types funnelled into one merge call; a report slice where one element failed to parse and was left nil.","solutions":["Filter or fail on any element of the report list that does not decode to *vuln.Report before merging","Confirm both reports were resolved under the same mime type and the same SupportedMimes entry","Log %T of both operands at the call site to identify the odd one out"],"exampleFix":"// before\nmerged, err := report.MergeNativeReport(nr1, r2) // r2 is `any`\n\n// after\nnr2, ok := r2.(*vuln.Report)\nif !ok {\n    return nil, fmt.Errorf(\"second operand is %T, want *vuln.Report\", r2)\n}\nmerged, err := report.MergeNativeReport(nr1, nr2)","handlingStrategy":"type-guard","validationCode":"if !isNativeReport(r2) {\n    return fmt.Errorf(\"second merge operand is %T, want *vuln.Report\", r2)\n}","typeGuard":"func isNativeReport(v any) bool {\n    _, ok := v.(*vuln.Report)\n    return ok\n}","tryCatchPattern":"merged, err := report.MergeNativeReport(nr1, r2)\nif err != nil && strings.Contains(err.Error(), \"native report required\") {\n    return fmt.Errorf(\"r2 not a native report (%T); re-resolve it under the same mime type\", r2)\n}","preventionTips":["Filter report lists so every element decodes to the same concrete type before folding","Do not merge reports resolved under different mime types","Skip nil interfaces explicitly before merging"],"tags":["go","harbor","type-assertion","scan","merge"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}