netbirdio/netbird · error

write signature file (%s): %w

Error message

write signature file (%s): %w

What it means

os.WriteFile of artifactFile+".sig" with mode 0600 failed. The message helpfully includes the target path. Typical causes: the target directory is not writable, a stale .sig from a previous run is owned by another user (0600 blocks overwriting), a read-only mount, or a full disk.

Source

Thrown at client/cmd/signer/artifactsign.go:151

	privateKey, err := reposign.ParseArtifactKey(privKeyPEM)
	if err != nil {
		return fmt.Errorf("failed to parse artifact private key: %w", err)
	}

	artifactData, err := os.ReadFile(artifactFile)
	if err != nil {
		return fmt.Errorf("read artifact file: %w", err)
	}

	signature, err := reposign.SignData(privateKey, artifactData)
	if err != nil {
		return fmt.Errorf("sign artifact: %w", err)
	}

	sigFile := artifactFile + ".sig"
	if err := os.WriteFile(artifactFile+".sig", signature, 0o600); err != nil {
		return fmt.Errorf("write signature file (%s): %w", sigFile, err)
	}

	cmd.Printf("✅ Artifact signed successfully.\n")
	cmd.Printf("Signature file: %s\n", sigFile)
	return nil
}

func handleVerifyArtifact(cmd *cobra.Command, pubKeyFile, artifactFile, signatureFile string) error {
	cmd.Println("🔍 Verifying artifact...")

	// Read artifact public key
	pubKeyPEM, err := os.ReadFile(pubKeyFile)
	if err != nil {
		return fmt.Errorf("read public key file: %w", err)
	}

	publicKey, err := reposign.ParseArtifactPubKey(pubKeyPEM)
	if err != nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Remove or chown the stale .sig file: rm -f <artifact>.sig, then re-run
2. Confirm write permission on the directory that will hold the .sig (touch <dir>/.wtest)
3. Sign into a writable staging directory and move the pair into place afterwards
4. Check disk space with df -h .

dir := filepath.Dir(artifactFile)
if f, err := os.OpenFile(filepath.Join(dir, ".write-test"), os.O_CREATE|os.O_WRONLY, 0o600); err != nil {
    log.Fatalf("directory %s not writable: %v", dir, err)
} else {
    f.Close()
    os.Remove(f.Name())
}

When it happens

Trigger: Re-running sign-artifact as a different user where <artifact>.sig already exists with owner-only permissions; signing into a read-only dist/release directory; ENOSPC.

Common situations: CI job first ran as root, then re-run as non-root; release artifacts directory mounted read-only in a container.

Related errors

• read artifact file: %w
• read public key file: %w
• read signature file: %w
• read artifact key file: %w
• read root key file: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/25261564ac2efd1f. Report an issue: GitHub.