{"record":{"id":"ff23ee244c7f5bb9","repo":"netbirdio/netbird","slug":"write-private-key-file-s-w","errorCode":null,"errorMessage":"write private key file (%s): %w","messagePattern":"write private key file \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/signer/artifactkey.go","lineNumber":116,"sourceCode":"\tcmd.Println(\"Creating new artifact signing key...\")\n\n\tprivKeyPEM, err := os.ReadFile(rootPrivKeyFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read root private key file: %w\", err)\n\t}\n\n\tprivateRootKey, err := reposign.ParseRootKey(privKeyPEM)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to parse private root key: %w\", err)\n\t}\n\n\tartifactKey, privPEM, pubPEM, signature, err := reposign.GenerateArtifactKey(privateRootKey, expiration)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generate artifact key: %w\", err)\n\t}\n\n\tif err := os.WriteFile(artifactPrivKeyFile, privPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write private key file (%s): %w\", artifactPrivKeyFile, err)\n\t}\n\n\tif err := os.WriteFile(artifactPubKeyFile, pubPEM, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write public key file (%s): %w\", artifactPubKeyFile, err)\n\t}\n\n\tsignatureFile := artifactPubKeyFile + \".sig\"\n\tif err := os.WriteFile(signatureFile, signature, 0o600); err != nil {\n\t\treturn fmt.Errorf(\"write signature file (%s): %w\", signatureFile, err)\n\t}\n\n\tcmd.Printf(\"✅ Artifact key created successfully.\\n\")\n\tcmd.Printf(\"%s\\n\", artifactKey.String())\n\treturn nil\n}\n\nfunc handleBundlePubKeys(cmd *cobra.Command, rootPrivKeyFile string, artifactPubKeyFiles []string, bundlePubKeysFile string) error {\n\tcmd.Println(\"📦 Bundling public keys into signed package...\")","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/signer/artifactkey.go#L98-L134","documentation":"os.WriteFile failed while writing the newly generated artifact private key to --artifact-priv-key-file with mode 0600. The wrapped *fs.PathError names the target path: typically 'no such file or directory' (missing parent directory) or 'permission denied'.","triggerScenarios":"create-artifact-key with an output path whose parent directory does not exist, or into a directory the user cannot write (e.g. /etc without root); a read-only filesystem or full disk.","commonSituations":"Output paths like keys/artifact.key where keys/ was never created; running unprivileged against root-owned directories; disk quota exhausted on a CI runner.","solutions":["Create the parent directory first (mkdir -p) or point to an existing writable directory","Run with write permission on the target directory, or write to a user-writable path and move the file with correct ownership","Check df/free space if the error is a write/ENOSPC failure"],"exampleFix":"// before\ncreate-artifact-key --artifact-priv-key-file keys/artifact.key ...\n// after (mkdir -p keys first)\nmkdir -p keys && create-artifact-key --artifact-priv-key-file keys/artifact.key ...","handlingStrategy":"validation","validationCode":"outDir := filepath.Dir(artifactPrivKeyFile)\nif err := os.MkdirAll(outDir, 0o700); err != nil { ... }\nif err := unix.Access(outDir, unix.W_OK); err != nil { ... } // or simply attempt a temp file write","typeGuard":null,"tryCatchPattern":null,"preventionTips":["mkdir -p output directories in the pipeline before the signing step","Run the signer as the user that owns the output directory","Write keys to a dedicated directory with 0700 permissions"],"tags":["cli","file-io","permissions","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}