{"record":{"id":"dde055976645959b","repo":"netbirdio/netbird","slug":"failed-to-read-private-root-key-file-w","errorCode":null,"errorMessage":"failed to read private root key file: %w","messagePattern":"failed to read private root key file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/revocation.go","lineNumber":99,"sourceCode":"\n\tverifyRevocationListCmd.Flags().StringVar(&revocationListFile, \"revocation-list-file\", \"\", \"Path to the revocation list file\")\n\tverifyRevocationListCmd.Flags().StringVar(&signatureFile, \"signature-file\", \"\", \"Path to the signature file\")\n\tverifyRevocationListCmd.Flags().StringVar(&publicRootKeyFile, \"public-root-key\", \"\", \"Path to the public root key PEM file\")\n\tif err := verifyRevocationListCmd.MarkFlagRequired(\"revocation-list-file\"); err != nil {\n\t\tpanic(err)\n\t}\n\tif err := verifyRevocationListCmd.MarkFlagRequired(\"signature-file\"); err != nil {\n\t\tpanic(err)\n\t}\n\tif err := verifyRevocationListCmd.MarkFlagRequired(\"public-root-key\"); err != nil {\n\t\tpanic(err)\n\t}\n}\n\nfunc handleCreateRevocationList(cmd *cobra.Command, revocationListFile string, privateRootKeyFile string) error {\n\tprivKeyPEM, err := os.ReadFile(privateRootKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read private root key file: %w\", err)\n\t}\n\n\tprivateRootKey, err := reposign.ParseRootKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)\n\t}\n\n\trlBytes, sigBytes, err := reposign.CreateRevocationList(*privateRootKey, expirationDuration)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create revocation list: %w\", err)\n\t}\n\n\tif err := writeOutputFiles(revocationListFile, revocationListFile+\".sig\", rlBytes, sigBytes); err != nil {\n\t\treturn fmt.Errorf(\"failed to write output files: %w\", err)\n\t}\n\n\tcmd.Println(\"✅ Revocation list created successfully\")\n\treturn nil","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/revocation.go#L81-L117","documentation":"os.ReadFile on the --private-root-key path failed in `signer create-revocation-list`. This flag must point at the ROOT PRIVATE KEY PEM. Wrapped *fs.PathError causes: missing file, permission denied, or directory. Because the private root key is highly sensitive, it is often stored in a vault or restricted path, which makes permission errors common.","triggerScenarios":"Private root key not mounted from the secret store in CI; path typo; the operator only has the public root key locally; file mode 0600 owned by another user.","commonSituations":"See trigger scenarios.","solutions":["ls -l the exact --private-root-key value and fix the path","Mount/provision the private root key from the vault before running the command","Run as the user that owns the key file or fix its permissions","If only the public key exists locally, obtain the private key from the key custodian"],"exampleFix":"// before\nreturn fmt.Errorf(\"failed to read private root key file: %w\", err)\n\n// after\nreturn fmt.Errorf(\"failed to read private root key file %s: %w\", privateRootKeyFile, err)","handlingStrategy":"validation","validationCode":"if info, err := os.Stat(privateRootKeyFile); err != nil || info.IsDir() {\n    log.Fatalf(\"private root key %s not readable: %v\", privateRootKeyFile, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount the private root key from the secret store at a fixed absolute path in CI","Restrict operations requiring the private root key to a dedicated, audited pipeline job"],"tags":["go","cli","filesystem","release-signing","secrets"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}