netbirdio/netbird · error

failed to parse artifact public key: %w

Error message

failed to parse artifact public key: %w

What it means

reposign.ParseArtifactPubKey failed in verify-artifact. It pem.Decodes the input and requires block type "ARTIFACT PUBLIC KEY" with a JSON body containing a 32-byte Ed25519 public key (reposign/key.go:99-124). Wrong PEM type (e.g. a root public key or the private key file), undecodable PEM, corrupt JSON, or wrong key length all fail. Note it parses only the first block; extra concatenated keys are silently ignored.

Source

Thrown at client/cmd/signer/artifactsign.go:170

	}

	cmd.Printf("✅ Artifact signed successfully.\n")
	cmd.Printf("Signature file: %s\n", sigFile)
	return nil
}

func handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {
	cmd.Println("🔍 Verifying artifact...")

	// Read artifact public key
	pubKeyPEM, err := os.ReadFile(pubKeyFile)
	if err != nil {
		return fmt.Errorf("read public key file: %w", err)
	}

	publicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse artifact public key: %w", err)
	}

	// Read artifact data
	artifactData, err := os.ReadFile(artifactFile)
	if err != nil {
		return fmt.Errorf("read artifact file: %w", err)
	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

	signature, err := reposign.ParseSignature(sigBytes)
	if err != nil {
		return fmt.Errorf("failed to parse signature: %w", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use the public half produced by `signer generate-artifact-key` (-----BEGIN ARTIFACT PUBLIC KEY-----)
2. Check you did not pass the root key or a private key: head -1 <file> must read -----BEGIN ARTIFACT PUBLIC KEY-----
3. If verifying against a bundle, confirm the first PEM block is an artifact public key

Example fix

// before
./signer verify-artifact --artifact-public-key-file root-key-pub.pem ...

// after
./signer verify-artifact --artifact-public-key-file artifact-key-pub.pem ...

func isArtifactPublicKeyPEM(data []byte) bool {
    block, _ := pem.Decode(data)
    return block != nil && block.Type == "ARTIFACT PUBLIC KEY"
}

When it happens

Trigger: Passing the ROOT PUBLIC KEY file to --artifact-public-key-file; passing the artifact private key PEM; passing a standard OpenSSH/PEM public key; a bundle whose first block is corrupt.

Common situations: Key naming confusion in the release vault (root vs artifact, public vs private); reusing an openssl-generated key instead of the one from generate-artifact-key.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to parse artifact private key: %w
• failed to parse root public key(s): %w
• failed to parse private root key: %w
• sign artifact: %w
• artifact verification failed: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/2e73e35a3296da43. Report an issue: GitHub.