What causes "error while writing out-qr: %s" in slackhq/nebula?

Check the -out-qr path's directory exists and is writable

error while writing out-qr: %s

Error message

error while writing out-qr: %s

What it means

After the QR PNG bytes are generated, signCert writes them to the -out-qr path with writeOutput. A failure here (bad path, permissions, disk full) is wrapped as 'error while writing out-qr'; the certificate file itself has already been written successfully at this point.

Source

Thrown at cmd/nebula-cert/sign.go:421

			return fmt.Errorf("error while marshalling certificate: %s", err)
		}
		b = append(b, sb...)
	}

	err = writeOutput(*sf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *sf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*sf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func newKeypair(curve cert.Curve) ([]byte, []byte) {
	switch curve {
	case cert.Curve_CURVE25519:
		return x25519Keypair()
	case cert.Curve_P256:
		return p256Keypair()
	default:
		return nil, nil
	}
}

func x25519Keypair() ([]byte, []byte) {

View on GitHub (pinned to dd8f660c0a)

Solutions

Check the -out-qr path's directory exists and is writable
Free disk space or choose another output location
If not needed, omit -out-qr entirely — the cert file is already written

Example fix

// before
./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt host.crt -out-qr /read-only/qr.png
// after
./nebula-cert sign -ca ca.pem -key ca.key -name host -out-crt host.crt -out-qr ./qr.png

Defensive patterns

Strategy: validation

Validate before calling

import "os"
func ensureWritable(path string) error {
    dir := filepath.Dir(path)
    fi, err := os.Stat(dir)
    if err != nil || !fi.IsDir() {
        return fmt.Errorf("bad dir %s", dir)
    }
    f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0600)
    if err != nil { return err }
    return f.Close()
}

Try / catch

if err := cmd.Run(); err != nil {
    if strings.Contains(err.Error(), "error while writing out-qr") {
        log.Printf("QR write failed (cert already written): %v", err)
    }
}

Prevention

Check disk space before signing on small devices
Ensure -out-qr directory exists and is writable
Omit -out-qr when not needed

When it happens

Trigger: writeOutput(*sf.outQRPath, b, 0600, out) returns an error while writing the QR PNG — non-existent directory, unwritable path, or stdout writer failure.

Common situations: -out-qr path typo; destination directory missing; no write permission; disk full on embedded devices.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/cef89542dec4c8a7. Report an issue: GitHub.