What causes "error while writing out-qr: %s" in slackhq/nebula?

Verify the -out-qr directory exists and is writable (mkdir -p).

error while writing out-qr: %s

Error message

error while writing out-qr: %s

What it means

nebula-cert's `ca` subcommand failed while writing the generated QR code PNG to the path given via -out-qr. QR encoding succeeded but writeOutput to disk failed; the underlying error is embedded in the message.

Source

Thrown at cmd/nebula-cert/ca.go:372

	b, err = c.MarshalPEM()
	if err != nil {
		return fmt.Errorf("error while marshalling certificate: %s", err)
	}

	err = writeOutput(*cf.outCertPath, b, 0600, out)
	if err != nil {
		return fmt.Errorf("error while writing out-crt: %s", err)
	}

	if *cf.outQRPath != "" {
		b, err = qrcode.Encode(string(b), qrcode.Medium, -5)
		if err != nil {
			return fmt.Errorf("error while generating qr code: %s", err)
		}

		err = writeOutput(*cf.outQRPath, b, 0600, out)
		if err != nil {
			return fmt.Errorf("error while writing out-qr: %s", err)
		}
	}

	return nil
}

func caSummary() string {
	return "ca <flags>: create a self signed certificate authority"
}

func caHelp(out io.Writer) {
	cf := newCaFlags()
	out.Write([]byte("Usage of " + os.Args[0] + " " + caSummary() + "\n"))
	out.Write([]byte(stdioHelpText))
	cf.set.SetOutput(out)
	cf.set.PrintDefaults()
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Verify the -out-qr directory exists and is writable (mkdir -p).
Ensure the -out-qr path is a file path, not a directory.
Check disk space and filesystem mount options (read-only).
Rerun without -out-qr if the QR image is not needed.

Example fix

// before
nebula-cert ca -name org -out-qr /qr/ca-qr.png
// after
mkdir -p /qr && nebula-cert ca -name org -out-qr /qr/ca-qr.png

Defensive patterns

Strategy: try-catch

Validate before calling

#!/bin/sh
QR_DIR=$(dirname "$OUT_QR_PATH")
[ -d "$QR_DIR" ] || mkdir -p "$QR_DIR"
[ -w "$QR_DIR" ] || { echo "cannot write $QR_DIR" >&2; exit 1; }

Try / catch

err = writeOutput(*cf.outQRPath, b, 0600, out)
if err != nil {
    return fmt.Errorf("error while writing out-qr: %s", err)
}

Prevention

mkdir -p the QR output directory first.
Ensure the QR path is a file path.
Drop -out-qr when the QR image is unnecessary.

When it happens

Trigger: Running `nebula-cert ca -out-qr <path>` where writeOutput(*cf.outQRPath, b, 0600, out) fails: parent directory missing, permission denied, disk full, or path is a directory.

Common situations: Typo in -out-qr path; read-only output directory; non-root user lacking write access; the QR target path pointing at an existing directory.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/a48893572c3923fb. Report an issue: GitHub.