What causes "failed to read %s %q: %w" in larksuite/cli?

Verify the file exists: ls -l /path/to/ca.pem (check for typos).

failed to read %s %q: %w

Error message

failed to read %s %q: %w

What it means

The CA file passed the security check but could not be read from disk via vfs.ReadFile. The CLI wraps the OS-level error ('no such file', 'permission denied', etc.) with 'failed to read CLI_CA_PATH ...'. Trust material cannot be loaded, so the transport fails closed.

Source

Thrown at internal/transport/tls_ca.go:39

func applyExtraRootCA(t *http.Transport, caPath string) error {
	caPath = strings.TrimSpace(caPath)
	if caPath == "" {
		return nil
	}
	if !filepath.IsAbs(caPath) {
		return fmt.Errorf("invalid %s %q: must be an absolute path to a PEM file", envvars.CliCAPath, caPath)
	}
	safeCAPath, err := binding.AssertSecurePath(binding.AuditParams{
		TargetPath:            caPath,
		Label:                 envvars.CliCAPath,
		AllowReadableByOthers: true,
	})
	if err != nil {
		return fmt.Errorf("unsafe %s %q: %w", envvars.CliCAPath, caPath, err)
	}
	pemBytes, err := vfs.ReadFile(safeCAPath)
	if err != nil {
		return fmt.Errorf("failed to read %s %q: %w", envvars.CliCAPath, caPath, err)
	}

	// Augment the system trust store. Do NOT silently discard a SystemCertPool
	// error: falling back to an empty pool would make this transport trust ONLY
	// the extra CA (dropping all system roots), which narrows trust unexpectedly
	// and could break TLS to legitimate endpoints. Fail closed instead.
	pool, err := x509.SystemCertPool()
	if err != nil {
		return fmt.Errorf("failed to load system cert pool for %s: %w", envvars.CliCAPath, err)
	}
	if pool == nil {
		pool = x509.NewCertPool()
	}
	if ok := pool.AppendCertsFromPEM(pemBytes); !ok {
		return fmt.Errorf("invalid %s %q: no certificates parsed from PEM", envvars.CliCAPath, caPath)
	}

	if t.TLSClientConfig == nil {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Verify the file exists: ls -l /path/to/ca.pem (check for typos).
Fix permissions so the CLI user can read it (chmod/chown).
Mount or copy the CA bundle into the container/host at the configured absolute path.

Example fix

// before
export LARKSUITE_CLI_CA_PATH="/etc/ssl/corp-ca.pem"  # file does not exist
// after
sudo install -m 0644 corp-ca.pem /etc/ssl/corp-ca.pem && export LARKSUITE_CLI_CA_PATH="/etc/ssl/corp-ca.pem"

Defensive patterns

Strategy: validation

Validate before calling

if _, err := os.Stat(caPath); err != nil {
	return fmt.Errorf("CA file missing/unreadable before launch: %w", err)
}

Try / catch

if _, err := os.ReadFile(caPath); err != nil {
	log.Fatalf("cannot read CA file %q: %v — check path and permissions", caPath, err)
}

Prevention

Pre-flight check file existence/readability in entrypoint scripts.
Ensure container images mount or bake the CA bundle at the configured path.
Watch for permission drift after deploys (chown/chmod in provisioning).

When it happens

Trigger: CLI_CA_PATH points to a non-existent or unreadable file; applyExtraRootCA calls vfs.ReadFile(safeCAPath) and gets an error.

Common situations: Typo in the path; file deleted between provisioning and run; container image missing the mounted CA; user lacks read permission on the PEM file.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/73a0b3ab78fc20fd. Report an issue: GitHub.