{"record":{"id":"d4169654deaf3cb4","repo":"ipfs/kubo","slug":"marshalling-key-to-pkcs8-format-w","errorCode":null,"errorMessage":"marshalling key to PKCS8 format: %w","messagePattern":"marshalling key to PKCS8 format: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":248,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"converting libp2p private key to std Go key: %w\", err)\n\t\t\t}\n\t\t\t// For some reason the ed25519.PrivateKey does not use pointer\n\t\t\t// receivers, so we need to convert it for MarshalPKCS8PrivateKey.\n\t\t\t// (We should probably change this upstream in PrivKeyToStdKey).\n\t\t\tif ed25519KeyPointer, ok := stdKey.(*ed25519.PrivateKey); ok {\n\t\t\t\tstdKey = *ed25519KeyPointer\n\t\t\t}\n\t\t\tif secpKey, ok := stdKey.(*crypto.Secp256k1PrivateKey); ok {\n\t\t\t\t// crypto/x509 does not support the secp256k1 curve\n\t\t\t\tformattedKey, err = marshalSecp256k1PrivateKey(secpKey)\n\t\t\t} else {\n\t\t\t\t// This function supports a restricted list of public key algorithms,\n\t\t\t\t// but we generate and use only the RSA and ed25519 types that are on that list.\n\t\t\t\tformattedKey, err = x509.MarshalPKCS8PrivateKey(stdKey)\n\t\t\t}\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"marshalling key to PKCS8 format: %w\", err)\n\t\t\t}\n\n\t\tcase keyFormatLibp2pCleartextOption:\n\t\t\tformattedKey, err = crypto.MarshalPrivateKey(sk)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unrecognized export format: %s\", exportFormat)\n\t\t}\n\n\t\treturn res.Emit(bytes.NewReader(formattedKey))\n\t},\n\tPostRun: cmds.PostRunMap{\n\t\tcmds.CLI: func(res cmds.Response, re cmds.ResponseEmitter) error {\n\t\t\treq := res.Request()\n\n\t\t\tv, err := res.Next()","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L230-L266","documentation":"Failure in the PEM export path of `ipfs key export` after the libp2p key was converted: x509.MarshalPKCS8PrivateKey (or the local secp256k1 marshaller) rejected the standard Go key. This means the private key bytes are structurally invalid for its claimed algorithm, practically indicating keystore corruption or an unsupported key shape rather than a user input mistake.","triggerScenarios":"Thrown at core/commands/keystore.go:248 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the key with ipfs key gen and re-import dependent resources","Export with --format=libp2p-protobuf-cleartext to bypass PKCS8 marshalling","Verify the keystore file under <IPFS_PATH>/keystore is not truncated or corrupted"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}