netbirdio/netbird · error

read signature file: %w

Error message

read signature file: %w

What it means

os.ReadFile on the --signature-file path failed during verify-artifact. The expected file is the JSON signature bundle written by sign-artifact as <artifact>.sig next to the artifact. Missing file, permission denied, or a directory produces this error.

Source

Thrown at client/cmd/signer/artifactsign.go:182

	if err != nil {
		return fmt.Errorf("read public key file: %w", err)
	}

	publicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse artifact public key: %w", err)
	}

	// Read artifact data
	artifactData, err := os.ReadFile(artifactFile)
	if err != nil {
		return fmt.Errorf("read artifact file: %w", err)
	}

	// Read signature
	sigBytes, err := os.ReadFile(signatureFile)
	if err != nil {
		return fmt.Errorf("read signature file: %w", err)
	}

	signature, err := reposign.ParseSignature(sigBytes)
	if err != nil {
		return fmt.Errorf("failed to parse signature: %w", err)
	}

	// Validate artifact
	if err := reposign.ValidateArtifact([]reposign.PublicKey{publicKey}, artifactData, *signature); err != nil {
		return fmt.Errorf("artifact verification failed: %w", err)
	}

	cmd.Println("✅ Artifact signature is valid")
	cmd.Printf("Artifact: %s\n", artifactFile)
	cmd.Printf("Signed by key: %s\n", signature.KeyID)
	cmd.Printf("Signature timestamp: %s\n", signature.Timestamp.Format("2006-01-02 15:04:05 MST"))
	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. ls the expected <artifact>.sig and pass its exact path
2. Regenerate the pair with sign-artifact if the .sig was lost, or re-download it from the release store
3. Check read permission on the .sig file

Example fix

// before
return fmt.Errorf("read signature file: %w", err)

// after
return fmt.Errorf("read signature file %s: %w", signatureFile, err)

if _, err := os.Stat(signatureFile); err != nil {
    log.Fatalf("signature %s not readable: %v", signatureFile, err)
}

When it happens

Trigger: The .sig was not downloaded/published alongside the artifact; wrong filename (e.g. .asc or .sig.txt); relative path resolved from wrong cwd.

Common situations: Release upload step skipped the .sig file; verifier points at a directory listing rather than the file; trailing whitespace in the flag value.

Related errors

• read artifact file: %w
• write signature file (%s): %w
• read public key file: %w
• read artifact key file: %w
• read root key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/9939e27f378bd591. Report an issue: GitHub.