What causes "error while writing out-pub: %s" in slackhq/nebula?

Create the target directory for --out-pub (mkdir -p) and check file permissions

error while writing out-pub: %s

Error message

error while writing out-pub: %s

What it means

keygen wraps any failure from writeOutput (which persists the marshalled public key to the --out-pub path, or emits it on stdout in stdio mode) with this message. It means the public key PEM could not be written to the requested destination. It is thrown after the private key was already written successfully, so the run is partially complete.

Source

Thrown at cmd/nebula-cert/keygen.go:107

		if err != nil {
			return fmt.Errorf("error while creating PKCS#11 client: %w", err)
		}
		defer func(client *pkclient.PKClient) {
			_ = client.Close()
		}(p11Client)
		pub, err = p11Client.GetPubKey()
		if err != nil {
			return fmt.Errorf("error while getting public key: %w", err)
		}
	} else {
		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-key: %s", err)
		}
	}
	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-pub: %s", err)
	}

	return nil
}

func keygenSummary() string {
	return "keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`"
}

func keygenHelp(out io.Writer) {
	cf := newKeygenFlags()
	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + keygenSummary() + "\n"))
	_, _ = out.Write([]byte(stdioHelpText))
	cf.set.SetOutput(out)
	cf.set.PrintDefaults()
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Create the target directory for --out-pub (mkdir -p) and check file permissions
Run with write permission to the output path (correct user, chmod/chown)
Verify --out-pub points to a file, not a directory, and the filesystem is not read-only
Check disk space (ENOSPC) via df
Use stdio mode (--out-pub/stdout behavior) if filesystem writes are unavailable

Example fix

// before
nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/missing-dir/host.pub
// after
mkdir -p /etc/nebula && nebula-cert keygen -out-key /etc/nebula/host.key -out-pub /etc/nebula/host.pub

Defensive patterns

Strategy: validation

Validate before calling

pubPath := *cf.outPubPath
if dir := filepath.Dir(pubPath); dir != "" {
    if st, err := os.Stat(dir); err != nil || !st.IsDir() {
        return fmt.Errorf("out-pub directory %q missing", dir)
    }
}
if f, err := os.OpenFile(pubPath, os.O_WRONLY|os.O_CREATE, 0600); err == nil { f.Close() }

Try / catch

if err := keygen(args, out); err != nil {
    var pe *fs.PathError
    if errors.As(err, &pe) && strings.Contains(err.Error(), "writing out-pub") {
        log.Printf("cannot write public key to %s: %v", pe.Path, pe.Err)
    }
}

Prevention

mkdir -p the output directory before running keygen
Verify write permission on the output directory for the executing user
Prefer absolute paths for --out-pub
Check disk space before batch key generation

When it happens

Trigger: calling `nebula-cert keygen` when the --out-pub path is unwritable (missing directory, permission denied, disk full) or the parent function keygen returns non-nil from writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)

Common situations: running keygen as a non-root user against a root-owned output directory; --out-pub pointing at a nonexistent directory; a path that is actually a directory rather than a file; read-only filesystems in containers

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ab47afada58f8a28. Report an issue: GitHub.