{"record":{"id":"d2e56d58601fe516","repo":"netbirdio/netbird","slug":"failed-to-parse-artifact-key-w","errorCode":null,"errorMessage":"failed to parse artifact key: %w","messagePattern":"failed to parse artifact key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":155,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"read root private key file: %w\", err)\n\t}\n\n\tprivateRootKey, err := reposign.ParseRootKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)\n\t}\n\n\tpublicKeys := make([]reposign.PublicKey, 0, len(artifactPubKeyFiles))\n\tfor _, pubFile := range artifactPubKeyFiles {\n\t\tpubPem, err := os.ReadFile(pubFile)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"read public key file: %w\", err)\n\t\t}\n\n\t\tpk, err := reposign.ParseArtifactPubKey(pubPem)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse artifact key: %w\", err)\n\t\t}\n\t\tpublicKeys = append(publicKeys, pk)\n\t}\n\n\tparsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"bundle artifact keys: %w\", err)\n\t}\n\n\tif err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public keys file (%s): %w\", bundlePubKeysFile, err)\n\t}\n\n\tsignatureFile := bundlePubKeysFile + \".sig\"\n\tif err := os.WriteFile(signatureFile, signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", signatureFile, err)\n\t}\n","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L137-L173","documentation":"reposign.ParseArtifactPubKey rejected one of the bundled files. It requires a PEM block whose type tag is the artifact public key tag and a correctly sized Ed25519 public key; common chained causes are 'failed to decode PEM data', 'PEM type is X, want Y', or 'incorrect Ed25519 public key size'.","triggerScenarios":"Feeding bundle-pub-keys an artifact private key, a root public/private key, or any PEM whose header is not the artifact public key type; truncated files; a bundle file fed back in as an input key.","commonSituations":"Confusing create-artifact-key's two output files; passing the bundle-pub-keys output as an input to itself; mixing keys from a different signer version or scheme.","solutions":["Use only the artifact public key file produced by create-artifact-key","Inspect the PEM '-----BEGIN ...-----' header of the failing entry and drop or regenerate mismatched files","Never feed a bundle output back as an --artifact-pub-key-file input"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func isArtifactPublicKeyPEM(data []byte) bool {\n    block, _ := pem.Decode(data)\n    return block != nil && block.Type == artifactPublicKeyPEMType\n}","tryCatchPattern":null,"preventionTips":["Never feed the private key, root key, or a previous bundle as an --artifact-pub-key-file input","Automate hand-off: pipe create-artifact-key's pub output path directly into bundle-pub-keys","Validate PEM headers in a pre-step when keys arrive from external storage"],"tags":["cli","cryptography","pem","parsing","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}