netbirdio/netbird · error

failed to verify artifact key: %w

Error message

failed to verify artifact key: %w

What it means

Generic wrapper from the verify-artifact-key RunE around handleVerifyArtifactKey, which validates the chain of trust from a root public key to an artifact key (or key bundle). It wraps root public key parsing, artifact key/bundle parsing, signature reading/decoding, and ValidateArtifactKeys failures such as 'failed to verify signature of artifact keys' or 'all N artifact keys are revoked' when a revocation list is supplied.

Source

Thrown at client/cmd/signer/artifactsign.go:65

	Long:         `Verify a software artifact signature using the artifact's public key.`,
	SilenceUsage: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if err := handleVerifyArtifact(cmd, verifyArtifactPubKeyFile, verifyArtifactFile, verifyArtifactSignatureFile); err != nil {
			return fmt.Errorf("failed to verify artifact: %w", err)
		}
		return nil
	},
}

var verifyArtifactKeyCmd = &cobra.Command{
	Use:   "verify-artifact-key",
	Short: "Verify an artifact public key was signed by a root key",
	Long: `Verify that an artifact public key (or bundle) was properly signed by a root key.
This validates the chain of trust from the root key to the artifact key.`,
	SilenceUsage: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if err := handleVerifyArtifactKey(cmd, verifyArtifactKeyPubKeyFile, verifyArtifactKeyRootPubKeyFile, verifyArtifactKeySignatureFile, verifyArtifactKeyRevocationFile); err != nil {
			return fmt.Errorf("failed to verify artifact key: %w", err)
		}
		return nil
	},
}

func init() {
	rootCmd.AddCommand(signArtifactCmd)
	rootCmd.AddCommand(verifyArtifactCmd)
	rootCmd.AddCommand(verifyArtifactKeyCmd)

	signArtifactCmd.Flags().StringVar(&signArtifactPrivKeyFile, "artifact-key-file", "", fmt.Sprintf("Path to the artifact private key file used for signing (or set %s env var)", envArtifactPrivateKey))
	signArtifactCmd.Flags().StringVar(&signArtifactArtifactFile, "artifact-file", "", "Path to the artifact to be signed")

	// artifact-file is required, but artifact-key-file can come from env var
	if err := signArtifactCmd.MarkFlagRequired("artifact-file"); err != nil {
		panic(fmt.Errorf("mark artifact-file as required: %w", err))
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Match the root public key with the root that actually signed the artifact key (check provenance of both)
2. If 'all artifact keys are revoked', mint new artifact keys or verify without superseded keys
3. Confirm the signature file is the one produced alongside the key/bundle
4. After root rotation, re-bundle artifact keys with the new root before verification

// After any root rotation, verify old artifact keys against the old root once,
// then re-bundle them under the new root before wide distribution

err := verifyArtifactKeyCmd.Execute()
if err != nil {
    msg := err.Error()
    switch {
    case strings.Contains(msg, "failed to verify signature"):
        // trust break: key not signed by this root — do not trust the key
    case strings.Contains(msg, "revoked"):
        // key set revoked: obtain freshly issued artifact keys
    default:
        return err
    }
}

When it happens

Trigger: Verifying an artifact key signed by a different root; a tampered key or bundle; a revoked key set checked against a revocation list; supplying the wrong .sig file; key/bundle that fails PEM or key-size checks.

Common situations: Root key rotation where old artifact keys are checked against the new root; distributing a key bundle signed by a stale root; passing a revocation list from a newer rotation than the keys being verified.

Related errors

• failed to verify artifact: %w
• --expiration must be a positive duration (e.g., 720h, 365d,
• failed to create artifact key: %w
• at least one --artifact-pub-key-file must be provided
• failed to bundle public keys: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/8cb78130485c52db. Report an issue: GitHub.