netbirdio/netbird · error

read public key file: %w

Error message

read public key file: %w

What it means

os.ReadFile on the --artifact-public-key-file path failed during verify-artifact. The wrapped *fs.PathError names the cause (missing file, permission denied, is a directory). The path is required by the command, so this is purely a bad path or permissions.

Source

Thrown at client/cmd/signer/artifactsign.go:165

	}

	sigFile := artifactFile + ".sig"
	if err := os.WriteFile(artifactFile+".sig", signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", sigFile, err)
	}

	cmd.Printf("✅ Artifact signed successfully.\n")
	cmd.Printf("Signature file: %s\n", sigFile)
	return nil
}

func handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {
	cmd.Println("🔍 Verifying artifact...")

	// Read artifact public key
	pubKeyPEM, err := os.ReadFile(pubKeyFile)
	if err != nil {
		return fmt.Errorf("read public key file: %w", err)
	}

	publicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse artifact public key: %w", err)
	}

	// Read artifact data
	artifactData, err := os.ReadFile(artifactFile)
	if err != nil {
		return fmt.Errorf("read artifact file: %w", err)
	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. ls -l the exact --artifact-public-key-file value and fix the path (prefer absolute paths)
2. Re-download or copy the artifact public key from the release key store
3. Check read permission on the file and parent directories

Example fix

// before
return fmt.Errorf("read public key file: %w", err)

// after
return fmt.Errorf("read public key file %s: %w", pubKeyFile, err)

if _, err := os.Stat(pubKeyFile); err != nil {
    log.Fatalf("public key %s not readable: %v", pubKeyFile, err)
}

When it happens

Trigger: Typo in the flag value; relative path resolved from the wrong cwd; the public key file was not fetched from the release key store; directory passed instead of the PEM file.

Common situations: Verifier machine has a stale copy of the keys directory; CI checkout path differs from the one hard-coded in the script.

Related errors

• read artifact file: %w
• write signature file (%s): %w
• read signature file: %w
• read artifact key file: %w
• read root key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/3037ac8473356a27. Report an issue: GitHub.