netbirdio/netbird · error

failed to parse artifact key: %w

Error message

failed to parse artifact key: %w

What it means

reposign.ParseArtifactPubKey rejected one of the bundled files. It requires a PEM block whose type tag is the artifact public key tag and a correctly sized Ed25519 public key; common chained causes are 'failed to decode PEM data', 'PEM type is X, want Y', or 'incorrect Ed25519 public key size'.

Source

Thrown at client/cmd/signer/artifactkey.go:155

	if err != nil {
		return fmt.Errorf("read root private key file: %w", err)
	}

	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse private root key: %w", err)
	}

	publicKeys := make([]reposign.PublicKey, 0, len(artifactPubKeyFiles))
	for _, pubFile := range artifactPubKeyFiles {
		pubPem, err := os.ReadFile(pubFile)
		if err != nil {
			return fmt.Errorf("read public key file: %w", err)
		}

		pk, err := reposign.ParseArtifactPubKey(pubPem)
		if err != nil {
			return fmt.Errorf("failed to parse artifact key: %w", err)
		}
		publicKeys = append(publicKeys, pk)
	}

	parsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)
	if err != nil {
		return fmt.Errorf("bundle artifact keys: %w", err)
	}

	if err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {
		return fmt.Errorf("write public keys file (%s): %w", bundlePubKeysFile, err)
	}

	signatureFile := bundlePubKeysFile + ".sig"
	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use only the artifact public key file produced by create-artifact-key
2. Inspect the PEM '-----BEGIN ...-----' header of the failing entry and drop or regenerate mismatched files
3. Never feed a bundle output back as an --artifact-pub-key-file input

func isArtifactPublicKeyPEM(data []byte) bool {
    block, _ := pem.Decode(data)
    return block != nil && block.Type == artifactPublicKeyPEMType
}

When it happens

Trigger: Feeding bundle-pub-keys an artifact private key, a root public/private key, or any PEM whose header is not the artifact public key type; truncated files; a bundle file fed back in as an input key.

Common situations: Confusing create-artifact-key's two output files; passing the bundle-pub-keys output as an input to itself; mixing keys from a different signer version or scheme.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to parse private root key: %w
• failed to decode PEM data
• generate artifact key: %w
• bundle artifact keys: %w
• failed to parse artifact private key: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d2e56d58601fe516. Report an issue: GitHub.