{"record":{"id":"bfd9a63bbe9ce665","repo":"ipfs/kubo","slug":"pem-block-not-found-in-input-data-s","errorCode":null,"errorMessage":"PEM block not found in input data:\n%s","messagePattern":"PEM block not found in input data:\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":491,"sourceCode":"\n\t\tfile, err := cmdenv.GetFileArg(req.Files.Entries())\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdefer file.Close()\n\n\t\tdata, err := io.ReadAll(file)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\timportFormat, _ := req.Options[keyFormatOptionName].(string)\n\t\tvar sk crypto.PrivKey\n\t\tswitch importFormat {\n\t\tcase keyFormatPemCleartextOption:\n\t\t\tpemBlock, rest := pem.Decode(data)\n\t\t\tif pemBlock == nil {\n\t\t\t\treturn fmt.Errorf(\"PEM block not found in input data:\\n%s\", rest)\n\t\t\t}\n\n\t\t\tif pemBlock.Type != \"PRIVATE KEY\" {\n\t\t\t\treturn fmt.Errorf(\"expected PRIVATE KEY type in PEM block but got: %s\", pemBlock.Type)\n\t\t\t}\n\n\t\t\tstdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing PKCS8 format: %w\", err)\n\t\t\t}\n\n\t\t\t// In case ed25519.PrivateKey is returned we need the pointer for\n\t\t\t// conversion to libp2p (see export command for more details).\n\t\t\tif ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {\n\t\t\t\tstdKey = &ed25519KeyPointer\n\t\t\t}\n\n\t\t\tsk, _, err = crypto.KeyPairFromStdKey(stdKey)","sourceCodeStart":473,"sourceCodeEnd":509,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L473-L509","documentation":"With `ipfs key import --format=pem-pkcs8-cleartext`, the input bytes are parsed with encoding/pem.Decode. If no PEM block is found (no `-----BEGIN ...-----`/`-----END ...-----` envelope), this error is returned and the non-PEM remainder is echoed for diagnosis. The file must be a PEM envelope around a PKCS8 DER private key (e.g. produced by `openssl genpkey`).","triggerScenarios":"Importing a raw DER key (openssl `genpkey -outform DER`), a libp2p protobuf key file, or an encrypted PEM (`ENCRYPTED PRIVATE KEY` is still a block, but raw DER is not) while `--format=pem-pkcs8-cleartext` is set; also importing an empty file or a file with only garbage.","commonSituations":"Forgetting `--format` (defaults to libp2p-protobuf-cleartext) when feeding a PEM file — that fails differently — versus the reverse: passing a DER/protobuf file with the PEM format selected; downloading a key that got base64-mangled; empty file from a failed openssl run.","solutions":["Check the input actually contains `-----BEGIN PRIVATE KEY-----`; if it is raw DER, re-emit as PEM: `openssl pkey -in key.der -inform DER -out key.pem`","Use the right format flag: PEM files need `-f pem-pkcs8-cleartext`; native libp2p files need the default format","Verify the file is non-empty and not base64-wrapped: `head -1 <file>`","Regenerate the key with `openssl genpkey -algorithm ED25519 > key.pem` if the source file is corrupt"],"exampleFix":"// before\nopenssl genpkey -algorithm ED25519 -outform DER -out k.der\nipfs key import mykey -f pem-pkcs8-cleartext k.der\n// after\nopenssl genpkey -algorithm ED25519 -out k.pem\nipfs key import mykey -f pem-pkcs8-cleartext k.pem","handlingStrategy":"validation","validationCode":"# verify the input is a PEM private-key envelope before import\ngrep -q -- \"-----BEGIN PRIVATE KEY-----\" \"$file\" || { echo \"$file is not PEM PKCS8\"; exit 1; }\nopenssl pkey -in \"$file\" -noout && echo 'valid pkcs8 pem'","typeGuard":null,"tryCatchPattern":"// Go-side pre-check equivalent:\nblock, _ := pem.Decode(data)\nif block == nil || block.Type != \"PRIVATE KEY\" {\n    return fmt.Errorf(\"input is not a PEM PKCS8 PRIVATE KEY\")\n}","preventionTips":["Confirm the file starts with -----BEGIN PRIVATE KEY----- before importing with the pem format","Match the format flag to the file: pem files need -f pem-pkcs8-cleartext","Check openssl exited successfully and the output file is non-empty before importing"],"tags":["cli","keystore","pem","validation","import"],"backgroundTag":"pem-block-not-found","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}