{"record":{"id":"f126c217e187f7bc","repo":"ipfs/kubo","slug":"encoding-pem-block-w","errorCode":null,"errorMessage":"encoding PEM block: %w","messagePattern":"encoding PEM block: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":333,"sourceCode":"// followed and the key lands where they point.\n//\n// A path that resolves to a character device or a pipe cannot be renamed over\n// and is written in place, without permission enforcement, because the\n// operating system owns those objects. Every other target is refused.\nfunc writeExportedKey(outPath string, outReader io.Reader, exportFormat string) error {\n\twriteKey := func(w io.Writer) error {\n\t\tswitch exportFormat {\n\t\tcase keyFormatPemCleartextOption:\n\t\t\tprivKeyBytes, err := io.ReadAll(outReader)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tif err := pem.Encode(w, &pem.Block{\n\t\t\t\tType:  \"PRIVATE KEY\",\n\t\t\t\tBytes: privKeyBytes,\n\t\t\t}); err != nil {\n\t\t\t\treturn fmt.Errorf(\"encoding PEM block: %w\", err)\n\t\t\t}\n\t\tcase keyFormatLibp2pCleartextOption:\n\t\t\tif _, err := io.Copy(w, outReader); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unrecognized export format: %s\", exportFormat)\n\t\t}\n\t\treturn nil\n\t}\n\n\t// Stat resolves symlinks: -o /dev/stdout is a link into /proc/self/fd.\n\tinfo, err := os.Stat(outPath)\n\tif err != nil && !errors.Is(err, os.ErrNotExist) {\n\t\treturn err\n\t}\n\tif err == nil {\n\t\tif info.Mode()&inPlaceModes != 0 {","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L315-L351","documentation":"`ipfs key export --format=pem-pkcs8-cleartext` marshals the private key to PKCS8 bytes and then encodes them as a PEM block written to the output writer. encoding/pem.Encode only fails when the underlying writer returns an error, so this wraps an I/O failure that happened while writing the PEM text to the destination (file, stdout, or character device). It is not a key-format problem; the key bytes were already produced successfully.","triggerScenarios":"Running `ipfs key export <name> --format=pem-pkcs8-cleartext -o <path>` (or letting output go through PostRun's writeExportedKey) where the write target returns an error mid-write: full disk, closed pipe (e.g. `ipfs key export k | head -c 1`), EIO on a failing device, or a character device that rejects writes.","commonSituations":"Piping output into a consumer that closes the pipe early; exporting to a removable drive that disconnects; disk quota/full-disk conditions; broken /dev/stdout redirection in restricted containers.","solutions":["Check the wrapped error (%w) for the real write failure: ENOSPC means free disk space, EPIPE means the downstream consumer exited","If piping, ensure the consumer reads all output before exiting (avoid `head` truncation)","Retry the export to a different, healthy destination path","Verify write permissions and disk state on the output filesystem"],"exampleFix":"// before\nipfs key export mykey --format=pem-pkcs8-cleartext | head -c 100  # EPIPE\n// after\nipfs key export mykey --format=pem-pkcs8-cleartext -o mykey.pem  # write to file","handlingStrategy":"try-catch","validationCode":"// Pre-check destination writability and space\ndf -h \"$(dirname \"$out\")\" && test -w \"$(dirname \"$out\")\" && echo writable","typeGuard":null,"tryCatchPattern":"// In Go callers wrapping the CLI output handling:\nif err := writeExportedKey(outPath, r, exportFormat); err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) {\n        log.Printf(\"write to %s failed: %v\", pe.Path, pe.Err)\n    }\n    return err\n}","preventionTips":["Write exports to regular files rather than pipes with early-exiting consumers","Monitor disk space/quota on the export target filesystem","Avoid exporting onto flaky removable or network storage"],"tags":["cli","keystore","pem","io"],"backgroundTag":"pem-encode-write-failure","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}