What causes "error while writing out-qr: %s" in slackhq/nebula?

Create the output directory (mkdir -p) and ensure permissions allow writing

error while writing out-qr: %s

Error message

error while writing out-qr: %s

What it means

After the QR image is generated, printCert writes the PNG bytes via writeOutput(*pf.outQRPath, b, 0600, out); failure is wrapped as "error while writing out-qr". It means the QR PNG could not be persisted to the -out-qr destination (or written to stdout when -out-qr is stdio). The QR was generated fine; only the write failed.

Source

Thrown at cmd/nebula-cert/print.go:110

		part++
	}

	if *pf.json && !qrToStdout {
		b, _ := json.Marshal(jsonCerts)
		_, _ = out.Write(b)
		_, _ = out.Write([]byte("\n"))
	}

	if *pf.outQRPath != "" {
		b, err := qrcode.Encode(string(qrBytes), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*pf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func printSummary() string {
	return "print <flags>: prints details about a certificate"
}

func printHelp(out io.Writer) {
	pf := newPrintFlags()
	out.Write([]byte("Usage of " + os.Args[0] + " " + printSummary() + "\n"))
	out.Write([]byte(stdioHelpText))
	pf.set.SetOutput(out)
	pf.set.PrintDefaults()
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Create the output directory (mkdir -p) and ensure permissions allow writing
Verify -out-qr is a file path, not an existing directory
Free disk space if the write failed with ENOSPC
Redirect stdout properly when using stdio mode (e.g. `> qr.png`) and avoid closed pipes

Example fix

// before
nebula-cert print -path host.crt -out-qr /etc/nebula/nope/qr.png
// after
mkdir -p /etc/nebula && nebula-cert print -path host.crt -out-qr /etc/nebula/qr.png

Defensive patterns

Strategy: validation

Validate before calling

qrPath := *pf.outQRPath
if st, err := os.Stat(filepath.Dir(qrPath)); err != nil || !st.IsDir() {
    return fmt.Errorf("out-qr directory %q missing", filepath.Dir(qrPath))
}
if st, err := os.Stat(qrPath); err == nil && st.IsDir() {
    return fmt.Errorf("out-qr path %q is a directory", qrPath)
}

Try / catch

if err := printCert(args, out, errOut); err != nil {
    if strings.Contains(err.Error(), "error while writing out-qr") {
        log.Printf("cannot write QR to %s: %v", *pf.outQRPath, err)
    }
}

Prevention

mkdir -p the QR output directory beforehand
Ensure -out-qr is a file path with a writable parent
In stdio mode, redirect stdout to a file and keep the pipe open
Check free disk space before generating QR images

When it happens

Trigger: `nebula-cert print -path cert.crt -out-qr /dir/qr.png` where /dir does not exist, is unwritable, is a directory itself, or the filesystem is full; stdio mode where stdout cannot be written (closed pipe)

Common situations: --out-qr pointing into a nonexistent directory; running as a user without write access to the output location; redirecting binary stdout into a closed pipe; read-only container filesystem

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e669d7bae647e707. Report an issue: GitHub.