netbirdio/netbird · error

read artifact key file: %w

Error message

read artifact key file: %w

What it means

os.ReadFile on the --artifact-key-file path failed during verify-artifact-key. This flag takes the artifact public key (or root-signed bundle) file whose chain of trust is being checked. Standard *fs.PathError causes: missing path, permission denied, directory.

Source

Thrown at client/cmd/signer/artifactsign.go:208

	// Validate artifact
	if err := reposign.ValidateArtifact([]reposign.PublicKey{publicKey}, artifactData, *signature); err != nil {
		return fmt.Errorf("artifact verification failed: %w", err)
	}

	cmd.Println("✅ Artifact signature is valid")
	cmd.Printf("Artifact: %s\n", artifactFile)
	cmd.Printf("Signed by key: %s\n", signature.KeyID)
	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
	return nil
}

func handleVerifyArtifactKey(cmd *cobra.Command, artifactKeyFile, rootKeyFile, signatureFile, revocationFile string) error {
	cmd.Println("🔍 Verifying artifact key...")

	// Read artifact key data
	artifactKeyData, err := os.ReadFile(artifactKeyFile)
	if err != nil {
		return fmt.Errorf("read artifact key file: %w", err)
	}

	// Read root public key(s)
	rootKeyData, err := os.ReadFile(rootKeyFile)
	if err != nil {
		return fmt.Errorf("read root key file: %w", err)
	}

	rootPublicKeys, err := parseRootPublicKeys(rootKeyData)
	if err != nil {
		return fmt.Errorf("failed to parse root public key(s): %w", err)
	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. ls -l the exact --artifact-key-file value and fix the path
2. Download the published artifact-key-pub.pem (and its .sig) from the key store before verifying
3. Check the file is the PEM bundle, not the JSON .sig

Example fix

// before
return fmt.Errorf("read artifact key file: %w", err)

// after
return fmt.Errorf("read artifact key file %s: %w", artifactKeyFile, err)

if _, err := os.Stat(artifactKeyFile); err != nil {
    log.Fatalf("artifact key bundle %s not readable: %v", artifactKeyFile, err)
}

When it happens

Trigger: Bundle file not copied to the verifier machine; relative path from wrong cwd; the flag was given the .sig file path instead of the key PEM.

Common situations: Verifying the published key bundle but pointing at a local path that was never fetched; flag confusion between --artifact-key-file and --signature-file.

Related errors

• read artifact file: %w
• write signature file (%s): %w
• read public key file: %w
• read signature file: %w
• read root key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/862d5b3294d8ebda. Report an issue: GitHub.