netbirdio/netbird · error

read private key file: %w

Error message

read private key file: %w

What it means

os.ReadFile failed for --artifact-key-file during sign-artifact, in the branch where the NB_ARTIFACT_PRIV_KEY environment variable is empty and the flag path is used. The wrapped *fs.PathError identifies ENOENT, EACCES, or EISDIR on the key file.

Source

Thrown at client/cmd/signer/artifactsign.go:128

		panic(fmt.Errorf("mark signature-file as required: %w", err))
	}
}

func handleSignArtifact(cmd *cobra.Command, privKeyFile, artifactFile string) error {
	cmd.Println("🖋️  Signing artifact...")

	// Load private key from env var or file
	var privKeyPEM []byte
	var err error

	if envKey := os.Getenv(envArtifactPrivateKey); envKey != "" {
		// Use key from environment variable
		privKeyPEM = []byte(envKey)
	} else if privKeyFile != "" {
		// Fall back to file
		privKeyPEM, err = os.ReadFile(privKeyFile)
		if err != nil {
			return fmt.Errorf("read private key file: %w", err)
		}
	} else {
		return fmt.Errorf("artifact private key must be provided via %s environment variable or --artifact-key-file flag", envArtifactPrivateKey)
	}

	privateKey, err := reposign.ParseArtifactKey(privKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse artifact private key: %w", err)
	}

	artifactData, err := os.ReadFile(artifactFile)
	if err != nil {
		return fmt.Errorf("read artifact file: %w", err)
	}

	signature, err := reposign.SignData(privateKey, artifactData)
	if err != nil {
		return fmt.Errorf("sign artifact: %w", err)

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify the path exists and is readable; prefer an absolute path
2. Alternatively export the key PEM in NB_ARTIFACT_PRIV_KEY (CI secret) to avoid file plumbing
3. Fix the CI step to fetch/mount the key before signing

if os.Getenv(envArtifactPrivateKey) == "" {
    if _, err := os.Stat(privKeyFile); err != nil {
        log.Fatalf("signing key unavailable via flag or %s", envArtifactPrivateKey)
    }
}

When it happens

Trigger: sign-artifact with --artifact-key-file pointing at a missing or unreadable file while NB_ARTIFACT_PRIV_KEY is unset; relative key path from a different working directory.

Common situations: CI job expects the key from a secret mount that was not attached; local run from the repo root while the key sits elsewhere; key file permissioned 0600 to another user.

Related errors

• failed to create artifact key: %w
• read root private key file: %w
• write signature file (%s): %w
• read public key file: %w
• artifact private key must be provided via %s environment var

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/1bb0981ac5fab335. Report an issue: GitHub.