netbirdio/netbird · error

failed to read public root key file: %w

Error message

failed to read public root key file: %w

What it means

os.ReadFile on the --public-root-key path failed in verify-revocation-list. This is a pure IO error raised before ParseRootPublicKey runs; the PathError text separates a missing file, a permission problem, or a directory path.

Source

Thrown at client/cmd/signer/revocation.go:175

}

func handleVerifyRevocationList(cmd *cobra.Command, revocationListFile, signatureFile, publicRootKeyFile string) error {
	// Read revocation list file
	rlBytes, err := os.ReadFile(revocationListFile)
	if err != nil {
		return fmt.Errorf("failed to read revocation list file: %w", err)
	}

	// Read signature file
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("failed to read signature file: %w", err)
	}

	// Read public root key file
	pubKeyPEM, err := os.ReadFile(publicRootKeyFile)
	if err != nil {
		return fmt.Errorf("failed to read public root key file: %w", err)
	}

	// Parse public root key
	publicKey, err := reposign.ParseRootPublicKey(pubKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse public root key: %w", err)
	}

	// Parse signature
	signature, err := reposign.ParseSignature(sigBytes)
	if err != nil {
		return fmt.Errorf("failed to parse signature: %w", err)
	}

	// Validate revocation list
	rl, err := reposign.ValidateRevocationList([]reposign.PublicKey{publicKey}, rlBytes, *signature)
	if err != nil {
		return fmt.Errorf("failed to validate revocation list: %w", err)

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Check the file exists and is readable: ls -l <path>
2. Ensure you pass the PUBLIC root key PEM (type ROOT PUBLIC KEY), not the private one
3. Mount or copy the public key to the verify host and re-run
4. Confirm the path after rotations — old and new keys often live side by side

// verify flow: check the public key file before invoking the command
if err := checkReadableFile(publicRootKeyFile); err != nil {
    log.Fatalf("public root key unreadable: %v", err)
}

When it happens

Trigger: verify-revocation-list with a --public-root-key path that does not exist, is unreadable, or is a directory; also triggered by passing the private key's path when only the public PEM was deployed to the verify host.

Common situations: The public key shipped with the verifier but installed under a different name; verifying in a container where the key was not mounted; a path typo after key rotation renamed files.

Related errors

• failed to generate root key: %w
• failed to create artifact key: %w
• read root private key file: %w
• write private key file (%s): %w
• write public key file (%s): %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/0c7badb13283d5dd. Report an issue: GitHub.