netbirdio/netbird · error

write private key file (%s): %w

Error message

write private key file (%s): %w

What it means

os.WriteFile failed while writing the newly generated artifact private key to --artifact-priv-key-file with mode 0600. The wrapped *fs.PathError names the target path: typically 'no such file or directory' (missing parent directory) or 'permission denied'.

Source

Thrown at client/cmd/signer/artifactkey.go:116

	cmd.Println("Creating new artifact signing key...")

	privKeyPEM, err := os.ReadFile(rootPrivKeyFile)
	if err != nil {
		return fmt.Errorf("read root private key file: %w", err)
	}

	privateRootKey, err := reposign.ParseRootKey(privKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse private root key: %w", err)
	}

	artifactKey, privPEM, pubPEM, signature, err := reposign.GenerateArtifactKey(privateRootKey, expiration)
	if err != nil {
		return fmt.Errorf("generate artifact key: %w", err)
	}

	if err := os.WriteFile(artifactPrivKeyFile, privPEM, 0o600); err != nil {
		return fmt.Errorf("write private key file (%s): %w", artifactPrivKeyFile, err)
	}

	if err := os.WriteFile(artifactPubKeyFile, pubPEM, 0o600); err != nil {
		return fmt.Errorf("write public key file (%s): %w", artifactPubKeyFile, err)
	}

	signatureFile := artifactPubKeyFile + ".sig"
	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
	}

	cmd.Printf("✅ Artifact key created successfully.\n")
	cmd.Printf("%s\n", artifactKey.String())
	return nil
}

func handleBundlePubKeys(cmd *cobra.Command, rootPrivKeyFile string, artifactPubKeyFiles []string, bundlePubKeysFile string) error {
	cmd.Println("📦 Bundling public keys into signed package...")

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Create the parent directory first (mkdir -p) or point to an existing writable directory
2. Run with write permission on the target directory, or write to a user-writable path and move the file with correct ownership
3. Check df/free space if the error is a write/ENOSPC failure

Example fix

// before
create-artifact-key --artifact-priv-key-file keys/artifact.key ...
// after (mkdir -p keys first)
mkdir -p keys && create-artifact-key --artifact-priv-key-file keys/artifact.key ...

outDir := filepath.Dir(artifactPrivKeyFile)
if err := os.MkdirAll(outDir, 0o700); err != nil { ... }
if err := unix.Access(outDir, unix.W_OK); err != nil { ... } // or simply attempt a temp file write

When it happens

Trigger: create-artifact-key with an output path whose parent directory does not exist, or into a directory the user cannot write (e.g. /etc without root); a read-only filesystem or full disk.

Common situations: Output paths like keys/artifact.key where keys/ was never created; running unprivileged against root-owned directories; disk quota exhausted on a CI runner.

Related errors

• write public key file (%s): %w
• write public keys file (%s): %w
• failed to write output files: %w
• failed to write revocation list file: %w
• failed to write signature file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/ff23ee244c7f5bb9. Report an issue: GitHub.