netbirdio/netbird · error

bundle artifact keys: %w

Error message

bundle artifact keys: %w

What it means

reposign.BundleArtifactKeys failed to build and sign the bundle. Its concrete failures are 'no keys to bundle' (unreachable here because the CLI guards for a non-empty list), public key marshalling, or signing the bundle with the root key; a root key past its expiration surfaces at this signing stage.

Source

Thrown at client/cmd/signer/artifactkey.go:162

	}

	publicKeys := make([]reposign.PublicKey, 0, len(artifactPubKeyFiles))
	for _, pubFile := range artifactPubKeyFiles {
		pubPem, err := os.ReadFile(pubFile)
		if err != nil {
			return fmt.Errorf("read public key file: %w", err)
		}

		pk, err := reposign.ParseArtifactPubKey(pubPem)
		if err != nil {
			return fmt.Errorf("failed to parse artifact key: %w", err)
		}
		publicKeys = append(publicKeys, pk)
	}

	parsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)
	if err != nil {
		return fmt.Errorf("bundle artifact keys: %w", err)
	}

	if err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {
		return fmt.Errorf("write public keys file (%s): %w", bundlePubKeysFile, err)
	}

	signatureFile := bundlePubKeysFile + ".sig"
	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
	}

	cmd.Printf("✅ Bundle created with %d public keys.\n", len(artifactPubKeyFiles))
	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Check the chained message; regenerate the root key with create-root-key if it is expired and re-issue artifact keys
2. Verify the root key file is intact (parse it standalone with verify-artifact-key or a PEM check)
3. Confirm the key list passed is non-empty when calling the library directly

// Guard before calling the library directly
if len(publicKeys) == 0 {
    return errors.New("refusing to bundle zero keys")
}
if time.Now().After(rootKey.Metadata.ExpiresAt) {
    return errors.New("rotate root key before bundling")
}

When it happens

Trigger: Bundling with an expired root key; a corrupted root key that fails the bundle signing step; degenerate empty key list reaching the library directly.

Common situations: Long-lived CI bundling job whose root key expired between runs; root key file corrupted in storage or truncated in transit.

Related errors

• generate artifact key: %w
• --expiration must be a positive duration (e.g., 720h, 365d,
• failed to create artifact key: %w
• at least one --artifact-pub-key-file must be provided
• failed to bundle public keys: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/2813896ead93147d. Report an issue: GitHub.