netbirdio/netbird · error

failed to bundle public keys: %w

Error message

failed to bundle public keys: %w

What it means

Generic wrapper returned by the bundle-pub-keys RunE when the underlying handleBundlePubKeys call fails. It always wraps a more specific error with %w (root key read/parse failure, public key read/parse failure, BundleArtifactKeys failure, or an output write failure), so the real cause is in the chained error text after the colon.

Source

Thrown at client/cmd/signer/artifactkey.go:53

		if err := handleCreateArtifactKey(cmd, createArtifactKeyRootPrivKeyFile, createArtifactKeyPrivKeyFile, createArtifactKeyPubKeyFile, createArtifactKeyExpiration); err != nil {
			return fmt.Errorf("failed to create artifact key: %w", err)
		}
		return nil
	},
}

var bundlePubKeysCmd = &cobra.Command{
	Use:   "bundle-pub-keys",
	Short: "Bundle multiple artifact public keys into a signed package",
	Long: `Bundle one or more artifact public keys into a signed package using the root private key.
This command is typically used to distribute or authorize a set of valid artifact signing keys.`,
	RunE: func(cmd *cobra.Command, args []string) error {
		if len(bundlePubKeysPubKeyFiles) == 0 {
			return fmt.Errorf("at least one --artifact-pub-key-file must be provided")
		}

		if err := handleBundlePubKeys(cmd, bundlePubKeysRootPrivKeyFile, bundlePubKeysPubKeyFiles, bundlePubKeysFile); err != nil {
			return fmt.Errorf("failed to bundle public keys: %w", err)
		}
		return nil
	},
}

func init() {
	rootCmd.AddCommand(createArtifactKeyCmd)

	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyRootPrivKeyFile, "root-private-key-file", "", "Path to the root private key file used to sign the artifact key")
	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPrivKeyFile, "artifact-priv-key-file", "", "Path where the artifact private key will be saved")
	createArtifactKeyCmd.Flags().StringVar(&createArtifactKeyPubKeyFile, "artifact-pub-key-file", "", "Path where the artifact public key will be saved")
	createArtifactKeyCmd.Flags().DurationVar(&createArtifactKeyExpiration, "expiration", 0, "Expiration duration for the artifact key (e.g., 720h, 365d, 8760h)")

	if err := createArtifactKeyCmd.MarkFlagRequired("root-private-key-file"); err != nil {
		panic(fmt.Errorf("mark root-private-key-file as required: %w", err))
	}
	if err := createArtifactKeyCmd.MarkFlagRequired("artifact-priv-key-file"); err != nil {
		panic(fmt.Errorf("mark artifact-priv-key-file as required: %w", err))

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Read the chained cause after 'failed to bundle public keys:' and fix that specific error
2. Confirm --root-private-key-file points to a key created by create-root-key and is not expired
3. Confirm every --artifact-pub-key-file entry is an artifact public key produced by create-artifact-key
4. Confirm the output path --bundle-pub-key-file is writable

err := bundlePubKeysCmd.Execute()
if err != nil {
    var exitErr *exec.ExitError
    if errors.As(err, &exitErr) {
        // parse stderr; the root cause follows 'failed to bundle public keys:'
        log.Fatalf("bundle failed: %v", err)
    }
}

When it happens

Trigger: Any failure inside handleBundlePubKeys: unreadable --root-private-key-file, unparseable root key PEM, an unreadable or malformed --artifact-pub-key-file entry, a BundleArtifactKeys error (e.g. root key expired), or a write error on --bundle-pub-key-file or its .sig companion.

Common situations: Running the bundling step with a wrong path, with a root key whose expiration passed, with a file that is a root key instead of an artifact public key, or into a read-only output directory.

Related errors

• failed to sign artifact: %w
• --expiration must be a positive duration (e.g., 720h, 365d,
• failed to create artifact key: %w
• at least one --artifact-pub-key-file must be provided
• read root private key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/1a4bf87644c75717. Report an issue: GitHub.