ipfs/kubo · error

keystore name for back up cannot be named 'self'

Error message

keystore name for back up cannot be named 'self'

What it means

The key rotate command stores the old identity key inside the keystore. 'self' is reserved as the logical name for the node's active identity, so using it as the backup name would collide with / shadow the very key being replaced. The Run function explicitly rejects oldKey == "self" before calling doRotate.

Source

Thrown at core/commands/keystore.go:765

	},
	Arguments: []cmds.Argument{},
	Options: []cmds.Option{
		cmds.StringOption(oldKeyOptionName, "o", "Keystore name to use for backing up your existing identity"),
		cmds.StringOption(keyStoreTypeOptionName, "t", "type of the key to create: rsa, ed25519, secp256k1").WithDefault(keyStoreAlgorithmDefault),
		cmds.IntOption(keyStoreSizeOptionName, "s", "size of the key to generate"),
	},
	NoRemote: true,
	PreRun:   DaemonNotRunning,
	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
		cctx := env.(*oldcmds.Context)
		nBitsForKeypair, nBitsGiven := req.Options[keyStoreSizeOptionName].(int)
		algorithm, _ := req.Options[keyStoreTypeOptionName].(string)
		oldKey, ok := req.Options[oldKeyOptionName].(string)
		if !ok {
			return fmt.Errorf("keystore name for backing up old key must be provided")
		}
		if oldKey == "self" {
			return fmt.Errorf("keystore name for back up cannot be named 'self'")
		}
		return doRotate(os.Stdout, cctx.ConfigRoot, oldKey, algorithm, nBitsForKeypair, nBitsGiven)
	},
}

func doRotate(out io.Writer, repoRoot string, oldKey string, algorithm string, nBitsForKeypair int, nBitsGiven bool) error {
	// Open repo
	repo, err := fsrepo.Open(repoRoot)
	if err != nil {
		return fmt.Errorf("opening repo (%v)", err)
	}
	defer repo.Close()

	// Read config file from repo
	cfg, err := repo.Config()
	if err != nil {
		return fmt.Errorf("reading config from repo (%v)", err)
	}

View on GitHub (pinned to 329838acdf)

Solutions

1. Choose a different backup name, e.g. `--old-key=backup-2024` or `--old-key=previous-self`
2. If you want the old key deleted entirely, note rotate always keeps a backup — there is no 'self' overwrite path
3. After rotation, retrieve the old key with `ipfs key export <name>` if needed

Example fix

// before
ipfs key rotate --old-key=self
// after
ipfs key rotate --old-key=previous-identity

if oldKey == "self" {
    return errors.New("--old-key must not be 'self'; choose a backup name like old-self")
}

func validBackupName(name string) bool {
    return name != "" && name != "self"
}

When it happens

Trigger: Running `ipfs key rotate --old-key=self` (or --old-key with value 'self' in any case variation passed exactly as 'self').

Common situations: Users intuitively thinking 'self' is the right backup name since it backs up the self key; scripts templating the current identity name into the backup slot.

Related errors

• encoding PEM block: %w
• refusing to export key to %s: not a regular file, character
• creating temporary file for %s: %w
• flushing %s: %w
• writing %s: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/ab76793aa94e0ea2. Report an issue: GitHub.