slackhq/nebula · error

error while reading in-pub: %s

Error message

error while reading in-pub: %s

What it means

Wraps an error from readInput when the -in-pub option is set and its public-key file cannot be read during nebula-cert sign. It only fires when inPubPath was explicitly provided (signing a certificate for a supplied public key); the underlying error is an OS read failure (missing file, bad permissions, empty input). Signing of that certificate aborts before the public key is unmarshaled.

Source

Thrown at cmd/nebula-cert/sign.go:280

		curve = cert.Curve_P256
		p11Client, err = pkclient.FromUrl(*sf.p11url)
		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
	}

	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
	}

	if *sf.inPubPath != "" {
		var pubCurve cert.Curve
		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
		if err != nil {
			return fmt.Errorf("error while reading in-pub: %s", err)
		}

		pub, _, pubCurve, err = cert.UnmarshalPublicKeyFromPEM(rawPub)
		if err != nil {
			return fmt.Errorf("error while parsing in-pub: %s", err)
		}
		if pubCurve != curve {
			return fmt.Errorf("curve of in-pub does not match ca")
		}
	} else if isP11 {
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key with PKCS#11: %w", err)
		}
	} else {
		pub, rawPriv = newKeypair(curve)
	}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify the -in-pub path exists and is readable
2. Omit -in-pub if a new keypair should be generated instead

When it happens

Trigger: Thrown at cmd/nebula-cert/sign.go:280 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/0b3593669650863e. Report an issue: GitHub.