What causes "creating temporary file for %s: %w" in ipfs/kubo?

Ensure the parent directory of -o exists: `mkdir -p $(dirname )`

creating temporary file for %s: %w

Error message

creating temporary file for %s: %w

What it means

Before writing, writeExportedKey creates a temporary file next to the target via atomicfile.New (so the final file is renamed into place atomically with 0600 permissions). This error wraps the failure of that temp-file creation: atomicfile needs the parent directory to exist and be writable. The key is never touched — nothing was written yet.

Source

Thrown at core/commands/keystore.go:368

	if err == nil {
		if info.Mode()&inPlaceModes != 0 {
			return writeExportedKeyInPlace(outPath, writeKey)
		}
		if !info.Mode().IsRegular() {
			return fmt.Errorf("refusing to export key to %s: not a regular file, character device or pipe", outPath)
		}
	}

	// The key is written next to the target and renamed over it, so replace
	// what a symlink points at rather than the symlink itself.
	outPath, err = resolveSymlink(outPath)
	if err != nil {
		return err
	}

	file, err := atomicfile.New(outPath, exportedKeyFileMode)
	if err != nil {
		return fmt.Errorf("creating temporary file for %s: %w", outPath, err)
	}
	if err := writeKey(file); err != nil {
		return errors.Join(err, file.Abort())
	}
	// Flush before the rename, so a crash cannot leave an empty file where the
	// previous export was.
	if err := file.Sync(); err != nil {
		return errors.Join(fmt.Errorf("flushing %s: %w", outPath, err), file.Abort())
	}
	if err := file.Close(); err != nil {
		return fmt.Errorf("writing %s: %w", outPath, err)
	}
	return nil
}

// resolveSymlink returns the path a chain of symlinks ends at.
// filepath.EvalSymlinks cannot be used on the path as a whole: it fails when
// the last link points at a file that does not exist yet, and such a link

View on GitHub (pinned to 329838acdf)

Solutions

Ensure the parent directory of -o exists: `mkdir -p $(dirname <path>)`
Check write permission on the parent directory for the user running the node
Use a writable location (the error's %w shows the underlying errno — ENOENT vs EACCES vs EROFS)
On read-only mounts, export elsewhere and copy, since atomic rename cannot target read-only directories

Example fix

// before
ipfs key export mykey -o /nonexistent/dir/mykey.pem
// after
mkdir -p /nonexistent/dir && ipfs key export mykey -o /nonexistent/dir/mykey.pem

Defensive patterns

Strategy: validation

Validate before calling

test -d "$(dirname "$out")" && test -w "$(dirname "$out")" || { mkdir -p "$(dirname "$out")"; }
# and confirm the fs is writable:
touch "$(dirname "$out")/.wtest" 2>/dev/null && rm "$(dirname "$out")/.wtest"

Prevention

mkdir -p the output directory before exporting
Avoid read-only mounts as export targets (atomic rename needs a writable dir)
In containers, mount the key-export volume read-write

When it happens

Trigger: `ipfs key export <name> -o <path>` where the target's parent directory does not exist, is not writable, or the resolved path (after symlink resolution) is invalid — e.g. exporting into a read-only volume or a path under a nonexistent directory.

Common situations: Typo in the output directory path; exporting to a read-only bind mount (atomic-file rename is impossible there); container with read-only filesystem; missing directory created by a previous step that failed.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/3d684102d03b5b2e. Report an issue: GitHub.