sipeed/picoclaw · error

credential: keygen: marshal public key: %w

Error message

credential: keygen: marshal public key: %w

What it means

ssh.NewPublicKey(pubRaw) converts the generated Ed25519 public key to an ssh.PublicKey for the authorized_keys line. It only errors for unsupported public key algorithms; Ed25519 support is built into every modern x/crypto/ssh, so with a key from ed25519.GenerateKey this branch is defensive and effectively unreachable.

Source

Thrown at pkg/credential/keygen.go:52

	if err != nil {
		return fmt.Errorf("credential: keygen: ed25519 key generation failed: %w", err)
	}

	// Marshal private key as OpenSSH PEM.
	block, err := ssh.MarshalPrivateKey(privRaw, "")
	if err != nil {
		return fmt.Errorf("credential: keygen: marshal private key: %w", err)
	}
	privPEM := pem.EncodeToMemory(block)

	if err = os.WriteFile(path, privPEM, 0o600); err != nil {
		return fmt.Errorf("credential: keygen: write private key %q: %w", path, err)
	}

	// Marshal public key as authorized_keys line.
	sshPub, err := ssh.NewPublicKey(pubRaw)
	if err != nil {
		return fmt.Errorf("credential: keygen: marshal public key: %w", err)
	}
	pubLine := ssh.MarshalAuthorizedKey(sshPub)

	pubPath := path + ".pub"
	if err := os.WriteFile(pubPath, pubLine, 0o644); err != nil {
		return fmt.Errorf("credential: keygen: write public key %q: %w", pubPath, err)
	}

	return nil
}

View on GitHub (pinned to 49183d7e8d)

Solutions

1. Report the failure and abort - retrying cannot help
2. Run `go mod verify` and pin the upstream x/crypto version in go.mod
3. Check whether a vendored copy of x/crypto/ssh was locally modified

if err := credential.GenerateSSHKey(path); err != nil {
    if strings.Contains(err.Error(), "marshal public key") {
        return fmt.Errorf("internal keygen invariant violated, report upstream: %w", err)
    }
    return err
}

When it happens

Trigger: No realistic runtime trigger with the current code path. Would require a stripped-down or modified x/crypto/ssh build lacking ed25519 support, or GenerateSSHKey changed to accept arbitrary external public keys.

Common situations: Practically never; treat occurrences as a corrupted/patched dependency rather than an operational issue.

Related errors

• credential: keygen: marshal private key: %w
• credential: HKDF expand failed: %w
• config is nil
• credential: keygen: cannot create directory %q: %w
• credential: keygen: ed25519 key generation failed: %w

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/08191870b5809544. Report an issue: GitHub.