What causes "Failed to derive public key: {e}" in trailofbits/algo?

Re-run with -vvv to get the full exception text embedded in the message

Failed to derive public key: {e}

Error message

Failed to derive public key: {e}

What it means

A catch-all: any unexpected exception during public-key derivation or the surrounding logic (after the specific OSError branches) is converted to this message with the exception text. Common causes are failures inside cryptography's X25519PrivateKey.from_private_bytes or errors in the comparison/write logic not covered above.

Source

Thrown at library/x25519_pubkey.py:121

            try:
                with open(pub_path) as f:
                    existing = f.read().strip()
            except OSError:
                existing = None

            if existing != pub_b64:
                try:
                    with open(pub_path, "w") as f:
                        f.write(pub_b64)
                    result["changed"] = True
                except OSError as e:
                    module.fail_json(msg=f"Failed to write public key file: {e}")

            result["public_key_path"] = pub_path

    except Exception as e:
        module.fail_json(msg=f"Failed to derive public key: {e}")

    module.exit_json(**result)


def main():
    """Entry point when module is executed directly."""
    run_module()


if __name__ == "__main__":
    main()

View on GitHub (pinned to 20e22a8715)

Solutions

Re-run with -vvv to get the full exception text embedded in the message
Verify pub_path is a file path, not an existing directory
Confirm the cryptography package version supports X25519 (any modern version)
If it's an environment issue, regenerate the key pair in a clean environment

Defensive patterns

Strategy: try-catch

Try / catch

try:
    pub_b64 = derive(pub_path, priv_path)
except Exception as e:
    logger.error('derivation failed: %s', e)
    raise

Prevention

Run with -vvv to capture the embedded exception text
Validate inputs (32-byte key, writable paths) before calling the module
Pin the cryptography library version in the environment

When it happens

Trigger: A non-32-byte key slipping past earlier checks raising ValueError in from_private_bytes, a pub_path that points at a directory (IsADirectoryError in the existing-file comparison), or any bug in the derived-key handling code.

Common situations: Edge-case key material, unexpected filesystem entries at pub_path, or version mismatches in the cryptography library.

Related errors

AI-assisted analysis of trailofbits/algo@20e22a8715 (2026-08-28). Data as JSON: /api/errors/0afd206c7af7e41d. Report an issue: GitHub.