{"record":{"id":"00e9e5bb86ac9831","repo":"passbolt/passbolt_api","slug":"the-openpgp-public-key-file-publickeyfilename-is-not","errorCode":null,"errorMessage":"The OpenPGP public key file '$publicKeyFileName' is not readable.","messagePattern":"The OpenPGP public key file '\\$publicKeyFileName' is not readable\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Controller/Auth/AuthVerifyController.php","lineNumber":56,"sourceCode":"     *\n     * @return void\n     */\n    public function verifyGet()\n    {\n        $this->assertJson();\n\n        $configMissing = (Configure::read('passbolt.gpg.serverKey.public') === null);\n        $configMissing = ($configMissing || Configure::read('passbolt.gpg.serverKey.public') === null);\n        if ($configMissing) {\n            $msg = __('The OpenPGP public key information was not found in config.');\n            throw new InternalErrorException($msg);\n        }\n        $publicKeyFileName = Configure::read('passbolt.gpg.serverKey.public');\n        if (!file_exists($publicKeyFileName)) {\n            throw new InternalErrorException('The OpenPGP public key for this passbolt instance was not found.');\n        }\n        if (!is_readable($publicKeyFileName)) {\n            throw new InternalErrorException(\"The OpenPGP public key file '$publicKeyFileName' is not readable.\");\n        }\n        $key = [\n            'fingerprint' => Configure::read('passbolt.gpg.serverKey.fingerprint'),\n            'keydata' => file_get_contents($publicKeyFileName),\n        ];\n        $this->success(__('The operation was successful.'), $key);\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":65,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Auth/AuthVerifyController.php#L38-L65","documentation":"verifyGet performs an is_readable() check on the configured public key file. When the file exists but the web-server process lacks read permission, an InternalErrorException stating the key file is not readable is thrown, since GPGAuth clients cannot be served the key.","triggerScenarios":"GET /auth/verify.json where serverkey.asc exists but is owned by root (or another user) with permissions denying read access to the PHP-FPM/www-data process; SELinux/AppArmor blocking read; directory missing execute permission.","commonSituations":"Manually copying keys as root without chown/chmod; container images where the key was COPY'd with restrictive modes; hardened hosts with SELinux contexts not updated for the new key location.","solutions":["chown the key file to the web-server user (e.g. chown www-data:www-data serverkey.asc) and chmod 640/644","Verify readability as the runtime user: sudo -u www-data cat <path-to-serverkey.asc>","Fix SELinux/AppArmor contexts (e.g. restorecon / chcon) if a MAC policy blocks the read"],"exampleFix":"// before\n-rw------- root root /etc/passbolt/gpg/serverkey.asc\n// after\nchown www-data:www-data /etc/passbolt/gpg/serverkey.asc\nchmod 640 /etc/passbolt/gpg/serverkey.asc","handlingStrategy":"validation","validationCode":"// deploy-time pre-check (run as the web user)\nsudo -u www-data test -r /path/to/serverkey.asc || echo 'NOT READABLE';","typeGuard":"const keyFileReadable = (p?: string): p is string => typeof p === 'string' && fs.accessSync(p, fs.constants.R_OK) === undefined;","tryCatchPattern":"try { await fetch('/auth/verify.json'); } catch (e) {\n  if (e.status === 500 && /is not readable/.test(e.message)) { fixOwnershipAndPermissions(); }\n}","preventionTips":["chown key files to the PHP-FPM user at deploy time","Check readability as the runtime user, not root","Update SELinux/AppArmor contexts when relocating keys","Include a permissions check in healthcheck/CI scripts"],"tags":["openpgp","gpg","permissions","file-read","server-key"],"backgroundTag":"file-read-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}