{"record":{"id":"e9ae563aeeabfe6c","repo":"slackhq/nebula","slug":"error-reading-passphrase-s","errorCode":null,"errorMessage":"error reading passphrase: %s","messagePattern":"error reading passphrase: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nebula-cert/ca.go","lineNumber":231,"sourceCode":"\t\t\"out-key\", *cf.outKeyPath,\n\t\t\"out-crt\", *cf.outCertPath,\n\t\t\"out-qr\", *cf.outQRPath,\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tvar passphrase []byte\n\tif !isP11 && *cf.encryption {\n\t\tpassphrase = []byte(os.Getenv(\"NEBULA_CA_PASSPHRASE\"))\n\t\tif len(passphrase) == 0 {\n\t\t\tfor i := 0; i < 5; i++ {\n\t\t\t\terrOut.Write([]byte(\"Enter passphrase: \"))\n\t\t\t\tpassphrase, err = pr.ReadPassword()\n\n\t\t\t\tif err == ErrNoTerminal {\n\t\t\t\t\treturn fmt.Errorf(\"out-key must be encrypted interactively\")\n\t\t\t\t} else if err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error reading passphrase: %s\", err)\n\t\t\t\t}\n\n\t\t\t\tif len(passphrase) > 0 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif len(passphrase) == 0 {\n\t\t\t\treturn fmt.Errorf(\"no passphrase specified, remove -encrypt flag to write out-key in plaintext\")\n\t\t\t}\n\t\t}\n\t}\n\n\tvar curve cert.Curve\n\tvar pub, rawPriv []byte\n\tvar p11Client *pkclient.PKClient\n\n\tif isP11 {","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cmd/nebula-cert/ca.go#L213-L249","documentation":"While prompting up to five times for the encryption passphrase, the nebula-cert ca command wraps any read error (other than ErrNoTerminal) in \"error reading passphrase: %s\". The wrapped message contains the underlying terminal read failure (e.g. interrupted read, closed stdin, termios failure).","triggerScenarios":"Running `nebula-cert ca -encrypt` where pr.ReadPassword() fails with an error other than ErrNoTerminal — e.g. stdin closed mid-prompt, read interrupted by a signal, or a terminal driver error.","commonSituations":"Piping input into the command while -encrypt is set, terminal emulators killing the read on resize/signal, scripted automation closing stdin, or restricted environments where password reading is unsupported.","solutions":["Check the wrapped %s message to identify the underlying read failure.","Run the command in a normal interactive terminal with stdin open.","Remove -encrypt if passphrase entry is impossible in your environment.","Retry the command; transient read interruptions (signals) usually succeed on a clean invocation."],"exampleFix":"// before (stdin closed, e.g. via </dev/null)\nnebula-cert ca -name \"ca\" -encrypt < /dev/null\n\n// after\nnebula-cert ca -name \"ca\" -encrypt  # run interactively","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"nebula-cert\", \"ca\", \"-encrypt\", ...).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"error reading passphrase\") {\n    // inspect wrapped cause; retry in a clean interactive terminal\n    return err\n}","preventionTips":["Keep stdin open and attached when prompting for passphrases.","Avoid piping input into commands invoked with -encrypt.","Handle terminal signals (SIGINT/SIGWINCH) gracefully during prompts."],"tags":["cli","tty","passphrase"],"backgroundTag":"passphrase-read-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}