netbirdio/netbird · error

read revocation file: %w

Error message

read revocation file: %w

What it means

os.ReadFile on the optional --revocation-file path failed during verify-artifact-key. The flag is optional: omitting it skips revocation checking entirely, but once provided the file must be readable, otherwise the command aborts before ValidateArtifactKeys runs.

Source

Thrown at client/cmd/signer/artifactsign.go:238

	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

	signature, err := reposign.ParseSignature(sigBytes)
	if err != nil {
		return fmt.Errorf("failed to parse signature: %w", err)
	}

	// Read optional revocation list
	var revocationList *reposign.RevocationList
	if revocationFile != "" {
		revData, err := os.ReadFile(revocationFile)
		if err != nil {
			return fmt.Errorf("read revocation file: %w", err)
		}

		revocationList, err = reposign.ParseRevocationList(revData)
		if err != nil {
			return fmt.Errorf("failed to parse revocation list: %w", err)
		}
	}

	// Validate artifact key(s)
	validKeys, err := reposign.ValidateArtifactKeys(rootPublicKeys, artifactKeyData, *signature, revocationList)
	if err != nil {
		return fmt.Errorf("artifact key verification failed: %w", err)
	}

	cmd.Println("✅ Artifact key(s) verified successfully")
	cmd.Printf("Signed by root key: %s\n", signature.KeyID)
	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
	cmd.Printf("\nValid artifact keys (%d):\n", len(validKeys))

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. ls -l the exact --revocation-file value and fix the path
2. Download the published revocation-list.json before verifying
3. If revocation checking is not needed for this run, omit the flag

Example fix

// before
--revocation-file revocation-list.json.sig

// after
--revocation-file revocation-list.json

if revocationFile != "" {
    if _, err := os.Stat(revocationFile); err != nil {
        log.Fatalf("revocation file %s not readable: %v", revocationFile, err)
    }
}

When it happens

Trigger: Revocation list JSON not yet downloaded when the flag is set; typo in the path; passing the .sig of the revocation list instead of the list itself.

Common situations: Verification scripts always pass --revocation-file even on hosts where the list has not been provisioned; the list exists only on the update-key CDN.

Related errors

• read artifact file: %w
• write signature file (%s): %w
• read public key file: %w
• read signature file: %w
• read artifact key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/f32950c90e19586e. Report an issue: GitHub.