netbirdio/netbird · error

read root key file: %w

Error message

read root key file: %w

What it means

os.ReadFile on the --root-key-file path failed during verify-artifact-key. This flag takes the root public key PEM used to validate the artifact key's root signature. Same *fs.PathError causes as other reads: missing file, permission, directory.

Source

Thrown at client/cmd/signer/artifactsign.go:214

	cmd.Printf("Artifact: %s\n", artifactFile)
	cmd.Printf("Signed by key: %s\n", signature.KeyID)
	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
	return nil
}

func handleVerifyArtifactKey(cmd *cobra.Command, artifactKeyFile, rootKeyFile, signatureFile, revocationFile string) error {
	cmd.Println("🔍 Verifying artifact key...")

	// Read artifact key data
	artifactKeyData, err := os.ReadFile(artifactKeyFile)
	if err != nil {
		return fmt.Errorf("read artifact key file: %w", err)
	}

	// Read root public key(s)
	rootKeyData, err := os.ReadFile(rootKeyFile)
	if err != nil {
		return fmt.Errorf("read root key file: %w", err)
	}

	rootPublicKeys, err := parseRootPublicKeys(rootKeyData)
	if err != nil {
		return fmt.Errorf("failed to parse root public key(s): %w", err)
	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

	signature, err := reposign.ParseSignature(sigBytes)
	if err != nil {
		return fmt.Errorf("failed to parse signature: %w", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. ls -l the exact --root-key-file value; use the ROOT PUBLIC KEY PEM from generate-root-key
2. Copy the root public key from the trusted key store before running verify-artifact-key
3. Check read permissions on the file

Example fix

// before
return fmt.Errorf("read root key file: %w", err)

// after
return fmt.Errorf("read root key file %s: %w", rootKeyFile, err)

if _, err := os.Stat(rootKeyFile); err != nil {
    log.Fatalf("root public key %s not readable: %v", rootKeyFile, err)
}

When it happens

Trigger: Root public key not provisioned on the verifying machine; wrong path in the CI config; passing the private root key path when only the public one exists locally.

Common situations: Root public keys live in the embedded certs directory in production; verifiers forget to fetch them; path differs between environments.

Related errors

• read artifact file: %w
• write signature file (%s): %w
• read public key file: %w
• read signature file: %w
• read artifact key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/53af7c30e861f7b9. Report an issue: GitHub.