semaphoreui/semaphore · error

parsing private key

Error message

parsing private key: %w

What it means

Returned by Agent.Listen in pkg/ssh/agent.go when golang.org/x/crypto/ssh fails to parse one of the configured private keys. ParseRawPrivateKey (or the WithPassphrase variant when a passphrase is present) rejects the key bytes, meaning the PEM/OpenSSH blob is malformed, truncated, in an unsupported format, or the passphrase is wrong. The %w wraps the underlying x/crypto error which carries the precise cause.

Solutions

1. Verify the key material is a complete, unmodified PEM or OpenSSH private key block (check BEGIN/END lines and base64 body)
2. If the key is encrypted, confirm the passphrase stored with the access key matches the one used to encrypt it
3. Re-export the key in OpenSSH or PKCS#1/PKCS#8 PEM format that x/crypto/ssh supports and update the stored key
4. Inspect the wrapped error string (ssh: this private key is passphrase protected / no key found / decode error) to pinpoint whether it is a format or passphrase problem

When it happens

Trigger: Thrown at pkg/ssh/agent.go:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/f8a3d9447490d26f. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ssh/agent.go:52

}

func (a *Agent) Listen() error {
	keyring := agent.NewKeyring()

	for _, k := range a.Keys {
		var (
			key any
			err error
		)

		if len(k.Passphrase) == 0 {
			key, err = ssh.ParseRawPrivateKey(k.Key)
		} else {
			key, err = ssh.ParseRawPrivateKeyWithPassphrase(k.Key, k.Passphrase)
		}

		if err != nil {
			return fmt.Errorf("parsing private key: %w", err)
		}

		if err := keyring.Add(agent.AddedKey{
			PrivateKey: key,
		}); err != nil {
			return fmt.Errorf("adding private key: %w", err)
		}
	}

	if err := os.MkdirAll(path.Dir(a.SocketFile), 0o755); err != nil {
		return fmt.Errorf("creating socket directory: %w", err)
	}

	l, err := net.ListenUnix(
		"unix",
		&net.UnixAddr{
			Net:  "unix",
			Name: a.SocketFile,

View on GitHub (pinned to 1774ccb71a)