{"id":"2eda0c3f8e54a6ee","repo":"docker/cli","slug":"private-key-file-s-must-not-be-readable-or-writab","errorCode":null,"errorMessage":"private key file %s must not be readable or writable by others","messagePattern":"private key file (.+?) must not be readable or writable by others","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":80,"sourceCode":"\tkeyBytes, err := getPrivKeyBytesFromPath(keyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"refusing to load key from %s: %w\", keyPath, err)\n\t}\n\tif err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {\n\t\treturn fmt.Errorf(\"error importing key from %s: %w\", keyPath, err)\n\t}\n\t_, _ = fmt.Fprintln(streams.Out(), \"Successfully imported key from\", keyPath)\n\treturn nil\n}\n\nfunc getPrivKeyBytesFromPath(keyPath string) ([]byte, error) {\n\tif runtime.GOOS != \"windows\" {\n\t\tfileInfo, err := os.Stat(keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n\t\t\treturn nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n\t\t}\n\t}\n\n\tfrom, err := os.OpenFile(keyPath, os.O_RDONLY, notary.PrivExecPerms)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer from.Close()\n\n\treturn io.ReadAll(from)\n}\n\nfunc loadPrivKeyBytesToStore(privKeyBytes []byte, privKeyImporters []trustmanager.Importer, keyPath, keyName string, passRet notary.PassRetriever) error {\n\tvar err error\n\tif _, _, err = tufutils.ExtractPrivateKeyAttributes(privKeyBytes); err != nil {\n\t\treturn fmt.Errorf(\"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add\", keyPath)\n\t}\n\tif privKeyBytes, err = decodePrivKeyIfNecessary(privKeyBytes, passRet); err != nil {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cmd/docker-trust/trust/key_load.go#L62-L98","documentation":"Error \"private key file %s must not be readable or writable by others\" thrown in docker/cli.","triggerScenarios":"Thrown at cmd/docker-trust/trust/key_load.go:80 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}