{"record":{"id":"d3a6878b528eab76","repo":"docker/cli","slug":"failed-to-write-public-key-to-s-w","errorCode":null,"errorMessage":"failed to write public key to %s: %w","messagePattern":"failed to write public key to (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_generate.go","lineNumber":129,"sourceCode":"\t\treturn pem.Block{}, err\n\t}\n\n\tpubKey := data.PublicKeyFromPrivate(privKey)\n\treturn pem.Block{\n\t\tType: \"PUBLIC KEY\",\n\t\tHeaders: map[string]string{\n\t\t\t\"role\": keyName,\n\t\t},\n\t\tBytes: pubKey.Public(),\n\t}, nil\n}\n\nfunc writePubKeyPEMToDir(pubPEM pem.Block, keyName, workingDir string) (string, error) {\n\t// Output the public key to a file in the CWD or specified dir\n\tpubFileName := strings.Join([]string{keyName, \"pub\"}, \".\")\n\tpubFilePath := filepath.Join(workingDir, pubFileName)\n\tif err := os.WriteFile(pubFilePath, pem.EncodeToMemory(&pubPEM), notary.PrivNoExecPerms); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to write public key to %s: %w\", pubFilePath, err)\n\t}\n\treturn pubFilePath, nil\n}\n","sourceCodeStart":111,"sourceCodeEnd":133,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_generate.go#L111-L133","documentation":"In writePubKeyPEMToDir (key_generate.go:124-131), os.WriteFile to pubFilePath (<workingDir>/<keyName>.pub) failed and is wrapped as 'failed to write public key to <path>'. The file is written with notary.PrivNoExecPerms (0600). The private key was already generated and stored, but the public key PEM could not be written to the working/output directory.","triggerScenarios":"The output directory became read-only or was removed between validateKeyArgs and the write; disk full; permission denied (directory owned by another user); path-too-long; filesystem error; SELinux/AppArmor denying the write.","commonSituations":"Running in CI where the workspace was made read-only after validation; --dir on a mounted volume that dropped permissions; out of disk; running as a different uid than the directory owner; the .pub path conflicts with a directory entry.","solutions":["Confirm the output directory is writable by the current user: touch <dir>/.write-test && rm <dir>/.write-test.","Free disk space if the volume is full (df -h <dir>).","Re-run with the correct --dir or from a writable cwd; if the private key was already generated, note that it remains in ~/.docker/trust/private and you can export the public key separately.","Check SELinux/AppArmor context if on a hardened system."],"exampleFix":"# before: --dir is read-only, write fails\ndocker trust key generate mykey --dir /mnt/readonly\n# after: use a writable directory\ndocker trust key generate mykey --dir ./keys","handlingStrategy":"validation","validationCode":"// Verify the output directory is writable before attempting the public key write.\nfunc ensureDirWritable(dir string) error {\n    f, err := os.CreateTemp(dir, \".wk-\")\n    if err != nil {\n        return fmt.Errorf(\"cannot write to %q: %w\", dir, err)\n    }\n    f.Close()\n    os.Remove(f.Name())\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := os.WriteFile(pubFilePath, pem.EncodeToMemory(&pubPEM), notary.PrivNoExecPerms); err != nil {\n    return \"\", fmt.Errorf(\"failed to write public key to %s: %w\", pubFilePath, err)\n}","preventionTips":["Provision the output directory with correct ownership before key generation.","In CI, write to a known writable workspace rather than a mounted read-only volume.","Check df -h and directory permissions if writes start failing."],"tags":["docker","notary","content-trust","filesystem","io","permissions","disk-space"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}