{"record":{"id":"e0c2eb2b6b4e3d19","repo":"netbirdio/netbird","slug":"write-signature-file-s-w","errorCode":null,"errorMessage":"write signature file (%s): %w","messagePattern":"write signature file \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":125,"sourceCode":"\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)\n\t}\n\n\tartifactKey, privPEM, pubPEM, signature, err := reposign.GenerateArtifactKey(privateRootKey, expiration)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generate artifact key: %w\", err)\n\t}\n\n\tif err := os.WriteFile(artifactPrivKeyFile, privPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write private key file (%s): %w\", artifactPrivKeyFile, err)\n\t}\n\n\tif err := os.WriteFile(artifactPubKeyFile, pubPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public key file (%s): %w\", artifactPubKeyFile, err)\n\t}\n\n\tsignatureFile := artifactPubKeyFile + \".sig\"\n\tif err := os.WriteFile(signatureFile, signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", signatureFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Artifact key created successfully.\\n\")\n\tcmd.Printf(\"%s\\n\", artifactKey.String())\n\treturn nil\n}\n\nfunc handleBundlePubKeys(cmd *cobra.Command, rootPrivKeyFile string, artifactPubKeyFiles []string, bundlePubKeysFile string) error {\n\tcmd.Println(\"📦 Bundling public keys into signed package...\")\n\n\tprivKeyPEM, err := os.ReadFile(rootPrivKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read root private key file: %w\", err)\n\t}\n\n\tprivateRootKey, err := reposign.ParseRootKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L107-L143","documentation":"os.WriteFile failed for the detached root-key signature written next to the public key at the path '<--artifact-pub-key-file>.sig' with mode 0600. This is the last of three writes in handleCreateArtifactKey, so a failure here leaves the priv and pub key files on disk without their signature.","triggerScenarios":"The .sig path being un-writable specifically, e.g. an existing .sig owned by another user or a read-only file at that exact name; disk full after the two key writes; directory made read-only between runs.","commonSituations":"Rerunning create-artifact-key into a directory where a previous run (possibly as root) left a .sig with different ownership; full disks after large artifacts; immutable/RO mount for secrets.","solutions":["Remove or fix ownership of a stale '<pub>.sig' file (rm/chown) and rerun","Confirm write permission on the whole output directory, since priv, pub, and .sig land side by side","Free disk space if the error reports ENOSPC"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"sigFile := artifactPubKeyFile + \".sig\"\nif err := os.Remove(sigFile); err != nil && !os.IsNotExist(err) { ... } // clear stale ownership conflicts\nos.MkdirAll(filepath.Dir(sigFile), 0o700)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Rerun signing steps under a single consistent uid to avoid mixed-ownership files","Treat key directories as disposable: recreate them each pipeline run","Check disk space before long signing jobs"],"tags":["cli","file-io","signing","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}