netbirdio/netbird · error

write public keys file (%s): %w

Error message

write public keys file (%s): %w

What it means

os.WriteFile failed for the signed bundle output at --bundle-pub-key-file with mode 0600. Standard *fs.PathError: missing parent directory, permission denied, read-only filesystem, or ENOSPC.

Source

Thrown at client/cmd/signer/artifactkey.go:166

		pubPem, err := os.ReadFile(pubFile)
		if err != nil {
			return fmt.Errorf("read public key file: %w", err)
		}

		pk, err := reposign.ParseArtifactPubKey(pubPem)
		if err != nil {
			return fmt.Errorf("failed to parse artifact key: %w", err)
		}
		publicKeys = append(publicKeys, pk)
	}

	parsedKeys, signature, err := reposign.BundleArtifactKeys(privateRootKey, publicKeys)
	if err != nil {
		return fmt.Errorf("bundle artifact keys: %w", err)
	}

	if err := os.WriteFile(bundlePubKeysFile, parsedKeys, 0o600); err != nil {
		return fmt.Errorf("write public keys file (%s): %w", bundlePubKeysFile, err)
	}

	signatureFile := bundlePubKeysFile + ".sig"
	if err := os.WriteFile(signatureFile, signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", signatureFile, err)
	}

	cmd.Printf("✅ Bundle created with %d public keys.\n", len(artifactPubKeyFiles))
	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. mkdir -p the output directory and confirm write permission
2. Remove or chown a stale bundle file from a previous run
3. Use an absolute output path to avoid working-directory surprises

os.MkdirAll(filepath.Dir(bundlePubKeysFile), 0o700)
if err := os.WriteFile(bundlePubKeysFile+".probe", []byte{}, 0o600); err != nil { ... }
os.Remove(bundlePubKeysFile + ".probe")

When it happens

Trigger: bundle-pub-keys writing to a path whose directory does not exist or is not writable; existing bundle file owned by another user.

Common situations: Output dir never created in the release pipeline; rerunning as a different user over an earlier root-owned bundle; read-only artifact mount.

Related errors

• write private key file (%s): %w
• write public key file (%s): %w
• failed to write output files: %w
• failed to write revocation list file: %w
• failed to write signature file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/8edf30092ded6c07. Report an issue: GitHub.