{"record":{"id":"c31037f12f596a25","repo":"slackhq/nebula","slug":"failed-to-get-public-key-w","errorCode":null,"errorMessage":"failed to get public key: %w","messagePattern":"failed to get public key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient.go","lineNumber":77,"sourceCode":"}\n\nfunc formatPubkeyFromPublicKeyInfoAttr(d []byte) ([]byte, error) {\n\te, err := x509.ParsePKIXPublicKey(d)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tswitch t := e.(type) {\n\tcase *ecdsa.PublicKey:\n\t\treturn ecKeyToArray(e.(*ecdsa.PublicKey)), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown public key type: %T\", t)\n\t}\n}\n\nfunc (c *PKClient) Test() error {\n\tpub, err := c.GetPubKey()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get public key: %w\", err)\n\t}\n\tout, err := c.DeriveNoise(pub) //do an ECDH with ourselves as a quick test\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(out) != NoiseKeySize {\n\t\treturn fmt.Errorf(\"got a key of %d bytes, expected %d\", len(out), NoiseKeySize)\n\t}\n\treturn nil\n}\n","sourceCodeStart":59,"sourceCodeEnd":88,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient.go#L59-L88","documentation":"Test() failed to fetch the public key from the HSM via GetPubKey(); the underlying error (PKCS#11 attribute read, key lookup, or unsupported key type) is wrapped with %w. The library throws it so callers of Test can see the HSM operation failed without losing the cause.","triggerScenarios":"Calling Test() when GetPubKey() errors: the derive key object was not found on the slot, CKA_EC_POINT/CKA_EC_PARAMS attributes are unreadable, or the key type is unsupported (see the 'unknown public key type' error).","commonSituations":"Wrong slot/pin in config; key object missing or deleted; token not logged in for attribute reads; HSM returns the key in an unexpected format.","solutions":["Run Test() with the correct hsm slot, pin, id, and label in config","Verify the EC key exists on the slot (pkcs11-tool --list-objects)","Check the wrapped error for the underlying PKCS#11 return code","Confirm the session login succeeded (no pin needed/needed as appropriate)","Re-provision the key if EC attributes are missing"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// before Test(): confirm a derive-capable EC key exists\nobjs, err := session.FindObjectsInit([]*pkcs11.Attribute{\n    pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),\n    pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, 0x0017), // CKK_EC\n})\nif err != nil || len(objs) == 0 { return errors.New(\"no EC private key on slot\") }","typeGuard":null,"tryCatchPattern":"if err := client.Test(); err != nil {\n    if strings.Contains(err.Error(), \"failed to get public key\") {\n        // inspect wrapped %w cause (lookup/attribute failure) before retrying\n    }\n    return err\n}","preventionTips":["Validate slot/pin/id/label config before connecting","Run pkcs11-tool --list-objects to confirm the key exists","Check the wrapped error's PKCS#11 code for the real cause","Keep the token logged-in/unblocked during tests"],"tags":["pkcs11","hsm","public-key","self-test"],"backgroundTag":"hsm-key-retrieval-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}