What causes "failed to get public key: %w" in slackhq/nebula?

Run Test() with the correct hsm slot, pin, id, and label in config

failed to get public key: %w

Error message

failed to get public key: %w

What it means

Test() failed to fetch the public key from the HSM via GetPubKey(); the underlying error (PKCS#11 attribute read, key lookup, or unsupported key type) is wrapped with %w. The library throws it so callers of Test can see the HSM operation failed without losing the cause.

Source

Thrown at pkclient/pkclient.go:77

}

func formatPubkeyFromPublicKeyInfoAttr(d []byte) ([]byte, error) {
	e, err := x509.ParsePKIXPublicKey(d)
	if err != nil {
		return nil, err
	}
	switch t := e.(type) {
	case *ecdsa.PublicKey:
		return ecKeyToArray(e.(*ecdsa.PublicKey)), nil
	default:
		return nil, fmt.Errorf("unknown public key type: %T", t)
	}
}

func (c *PKClient) Test() error {
	pub, err := c.GetPubKey()
	if err != nil {
		return fmt.Errorf("failed to get public key: %w", err)
	}
	out, err := c.DeriveNoise(pub) //do an ECDH with ourselves as a quick test
	if err != nil {
		return err
	}
	if len(out) != NoiseKeySize {
		return fmt.Errorf("got a key of %d bytes, expected %d", len(out), NoiseKeySize)
	}
	return nil
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Run Test() with the correct hsm slot, pin, id, and label in config
Verify the EC key exists on the slot (pkcs11-tool --list-objects)
Check the wrapped error for the underlying PKCS#11 return code
Confirm the session login succeeded (no pin needed/needed as appropriate)
Re-provision the key if EC attributes are missing

Defensive patterns

Strategy: try-catch

Validate before calling

// before Test(): confirm a derive-capable EC key exists
objs, err := session.FindObjectsInit([]*pkcs11.Attribute{
    pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
    pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, 0x0017), // CKK_EC
})
if err != nil || len(objs) == 0 { return errors.New("no EC private key on slot") }

Try / catch

if err := client.Test(); err != nil {
    if strings.Contains(err.Error(), "failed to get public key") {
        // inspect wrapped %w cause (lookup/attribute failure) before retrying
    }
    return err
}

Prevention

Validate slot/pin/id/label config before connecting
Run pkcs11-tool --list-objects to confirm the key exists
Check the wrapped error's PKCS#11 code for the real cause
Keep the token logged-in/unblocked during tests

When it happens

Trigger: Calling Test() when GetPubKey() errors: the derive key object was not found on the slot, CKA_EC_POINT/CKA_EC_PARAMS attributes are unreadable, or the key type is unsupported (see the 'unknown public key type' error).

Common situations: Wrong slot/pin in config; key object missing or deleted; token not logged in for attribute reads; HSM returns the key in an unexpected format.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/c31037f12f596a25. Report an issue: GitHub.