semaphoreui/semaphore · error

adding private key

Error message

adding private key: %w

What it means

Returned by Agent.Listen in pkg/ssh/agent.go when the parsed private key is accepted by x/crypto/ssh but the in-memory agent keyring rejects it in keyring.Add. This is a runtime guard around agent.AddedKey insertion: it typically fires when the key type is not usable as an agent signing key or the AddedKey struct is otherwise invalid for the keyring, and the %w carries the x/crypto/agent rejection reason.

Solutions

1. Check the wrapped error for the keyring's rejection reason (e.g. unsupported key type for signing)
2. Confirm the key is a usable signing key (ed25519, RSA, ECDSA) and not a certificate-only or public-key blob
3. Try loading the same key with ssh-add locally to confirm it is agent-compatible, then re-store the key material in Semaphore

When it happens

Trigger: Thrown at pkg/ssh/agent.go:58 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/3b2b8814556bd6a2. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ssh/agent.go:58

		var (
			key any
			err error
		)

		if len(k.Passphrase) == 0 {
			key, err = ssh.ParseRawPrivateKey(k.Key)
		} else {
			key, err = ssh.ParseRawPrivateKeyWithPassphrase(k.Key, k.Passphrase)
		}

		if err != nil {
			return fmt.Errorf("parsing private key: %w", err)
		}

		if err := keyring.Add(agent.AddedKey{
			PrivateKey: key,
		}); err != nil {
			return fmt.Errorf("adding private key: %w", err)
		}
	}

	if err := os.MkdirAll(path.Dir(a.SocketFile), 0o755); err != nil {
		return fmt.Errorf("creating socket directory: %w", err)
	}

	l, err := net.ListenUnix(
		"unix",
		&net.UnixAddr{
			Net:  "unix",
			Name: a.SocketFile,
		},
	)
	if err != nil {
		return fmt.Errorf("listening on socket %q: %w", a.SocketFile, err)
	}

View on GitHub (pinned to 1774ccb71a)