argoproj/argo-workflows · error

artifact key %q must have a bare filename segment

Error message

artifact key %q must have a bare filename segment

What it means

ValidateUploadedArtifactKey requires the final segment of an upload key to be a bare filename: path.Base(filename) must equal filename. Any embedded '/' (nested path) or traversal-like name is rejected, because the key is applied to the artifact location unchecked and could otherwise smuggle a subdirectory path.

Source

Thrown at server/utils/artifactkey.go:50

		return fmt.Errorf("artifact key %q is not in canonical form", key)
	}

	parts := strings.Split(key, "/")
	if len(parts) != 4 {
		return fmt.Errorf("artifact key %q must have exactly 4 segments: uploads/{namespace}/{uuid}/{filename}", key)
	}
	if slices.Contains(parts, "") {
		return fmt.Errorf("artifact key %q must not contain empty segments", key)
	}

	uuidSegment := parts[2]
	if _, err := uuid.Parse(uuidSegment); err != nil {
		return fmt.Errorf("artifact key %q must have a valid UUID segment: %w", key, err)
	}

	filename := parts[3]
	if path.Base(filename) != filename {
		return fmt.Errorf("artifact key %q must have a bare filename segment", key)
	}

	return nil
}

View on GitHub (pinned to 35bff19146)

Solutions

1. Flatten the upload target to only its base name (filepath.Base) before composing the key.
2. Upload nested content as a single archive (tgz/zip) so the key holds one bare filename.
3. If directory structure matters, encode it inside the archive rather than in the artifact key.

Example fix

// before
key := "uploads/myns/" + uuidStr + "/assets/css/style.css"
// after
key := "uploads/myns/" + uuidStr + "/style.css"

func isBareFilename(name string) bool {
    return name != "" && name != "." && name != string(filepath.Separator) && filepath.Base(name) == name
}

if err := utils.ValidateUploadedArtifactKey(ns, key); err != nil {
    if strings.Contains(err.Error(), "bare filename") {
        key = path.Base(key) // or reject the upload
    }
}

When it happens

Trigger: Calling ValidateUploadedArtifactKey with a 4th segment containing '/': e.g. 'uploads/myns/<uuid>/sub/dir/file.txt' — a nested relative path — or a filename that is itself a path like './file.txt' where Base differs from the input.

Common situations: Clients that preserve the local directory structure of uploaded files (e.g. tarball-style relative paths); building keys from file paths instead of file names; mistakenly treating the upload key as a general-purpose object path with folders.

Related errors

• artifact key %q must not contain '..'
• artifact key %q must have a valid UUID segment: %w
• %w
• successCondition, failureCondition and outputs are not suppo
• failed to load non-plugin input artifacts: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/88c4f51f7e94a59c. Report an issue: GitHub.