What causes "saving new key to config (%v)" in ipfs/kubo?

Fix filesystem permissions/ownership of $IPFS_PATH/config and retry rotate

saving new key to config (%v)

Error message

saving new key to config (%v)

What it means

The final step of doRotate writes the config containing the NEW identity back to the repo via repo.SetConfig. Failure is wrapped as "saving new key to config (%v)". By this point the old key has already been saved to the keystore, so nothing is lost, but the node still runs the old identity until a successful write.

Source

Thrown at core/commands/keystore.go:816

		return fmt.Errorf("creating identity (%v)", err)
	}

	// Save old identity to keystore
	oldPrivKey, err := cfg.Identity.DecodePrivateKey("")
	if err != nil {
		return fmt.Errorf("decoding old private key (%v)", err)
	}
	keystore := repo.Keystore()
	if err := keystore.Put(oldKey, oldPrivKey); err != nil {
		return fmt.Errorf("saving old key in keystore (%v)", err)
	}

	// Update identity
	cfg.Identity = identity

	// Write config file to repo
	if err = repo.SetConfig(cfg); err != nil {
		return fmt.Errorf("saving new key to config (%v)", err)
	}
	return nil
}

func keyOutputListEncoders() cmds.EncoderFunc {
	return cmds.MakeTypedEncoder(func(req *cmds.Request, w io.Writer, list *KeyOutputList) error {
		withID, _ := req.Options["l"].(bool)

		tw := tabwriter.NewWriter(w, 1, 2, 1, ' ', 0)
		for _, s := range list.Keys {
			if withID {
				fmt.Fprintf(tw, "%s\t%s\t\n", s.Id, cmdenv.EscNonPrint(s.Name))
			} else {
				fmt.Fprintf(tw, "%s\n", cmdenv.EscNonPrint(s.Name))
			}
		}
		tw.Flush()
		return nil

View on GitHub (pinned to 329838acdf)

Solutions

Fix filesystem permissions/ownership of $IPFS_PATH/config and retry rotate
Free disk space (`df -h`) and retry
Re-run the whole `ipfs key rotate --old-key=<name>` command — old key backup already exists, use a new backup name or check `ipfs key list`
Verify config validity afterwards with `ipfs config show`

Defensive patterns

Strategy: try-catch

Validate before calling

[ -w "$IPFS_PATH/config" ] && echo "config writable" || echo "fix permissions"
df -h "$IPFS_PATH" | awk 'NR==2 {exit ($5+0 >= 95) ? 1 : 0}'

Try / catch

if err := doRotate(...); err != nil {
    if strings.Contains(err.Error(), "saving new key to config") {
        // old key already backed up; fix filesystem and re-run rotate
    }
}

Prevention

Verify write access to $IPFS_PATH/config before rotating
Monitor disk space in automation
Re-run rotate after a failed SetConfig; backup naming should account for retries

When it happens

Trigger: Read-only filesystem or permissions error writing $IPFS_PATH/config; disk full during write; config changed concurrently and rejected; serialization failure (rare).

Common situations: Running as wrong user after a sudo invocation changed file ownership; full disk mid-rotation; another process holding/rewriting the config.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/972bd821ea87cc9f. Report an issue: GitHub.