ruvnet/ruflo · error

[rvfa-signing] WARNING: Private key ${privPath} has open per

Error message

[rvfa-signing] WARNING: Private key ${privPath} has open permissions (${mode.toString(8)}). Consider running: chmod 600 ${privPath}

What it means

Log warning in loadKeyPair: the private key file's permission bits include group/other access (mode has 0o077 bits set); the key is still loaded but the operator is told to chmod 600 because the permissions are insecure.

Source

Thrown at v3/@claude-flow/cli/src/appliance/rvfa-signing.ts:122

 *
 * @param dir   Directory containing the key files.
 * @param name  Base name for the key files (default: 'rvfa-signing').
 */
export async function loadKeyPair(
  dir: string,
  name = 'rvfa-signing',
): Promise<RvfaKeyPair> {
  const pubPath = `${dir}/${name}.pub`;
  const privPath = `${dir}/${name}.key`;

  const publicKey = await readFile(pubPath);
  const privateKey = await readFile(privPath);

  // Warn if private key permissions are too open
  const privStat = await stat(privPath);
  const mode = privStat.mode & 0o777;
  if (mode & 0o077) {
    console.warn(
      `[rvfa-signing] WARNING: Private key ${privPath} has open permissions ` +
      `(${mode.toString(8)}). Consider running: chmod 600 ${privPath}`,
    );
  }

  const fingerprint = computeFingerprint(publicKey.toString('utf-8'));
  return { publicKey, privateKey, fingerprint };
}

/**
 * Load a public key from a single PEM file.
 */
export async function loadPublicKey(path: string): Promise<Buffer> {
  return readFile(path);
}

// ── Internal Helpers ─────────────────────────────────────────

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Run chmod 600 on the private key file so only the owner can read it.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/appliance/rvfa-signing.ts:122 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/eda3dca75e65ec14. Report an issue: GitHub.