{"record":{"id":"03f67f4fa7a67c4c","repo":"passbolt/passbolt_api","slug":"could-not-import-the-user-openpgp-key","errorCode":null,"errorMessage":"Could not import the user OpenPGP key.","messagePattern":"Could not import the user OpenPGP key\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltCe/JwtAuthentication/src/Authenticator/GpgJwtAuthenticator.php","lineNumber":245,"sourceCode":"     *\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user data is not valid\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the user key cannot be loaded\n     * @return void\n     */\n    public function setUserKey(): void\n    {\n        try {\n            $this->gpg->setVerifyKeyFromFingerprint($this->user->gpgkey->fingerprint);\n            $this->gpg->setEncryptKeyFromFingerprint($this->user->gpgkey->fingerprint);\n        } catch (Exception $exception) {\n            // Try to import the key in keyring again\n            try {\n                $this->gpg->importKeyIntoKeyring($this->user->gpgkey->armored_key);\n                $this->gpg->setVerifyKeyFromFingerprint($this->user->gpgkey->fingerprint);\n                $this->gpg->setEncryptKeyFromFingerprint($this->user->gpgkey->fingerprint);\n            } catch (Exception $exception) {\n                $msg = __('Could not import the user OpenPGP key.');\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n    }\n\n    /**\n     * Load user data including OpenPGP key in $user props\n     *\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user id is missing in the request\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user cannot be found, is deleted, is not active\n     * @return void\n     * @access private\n     */\n    public function loadUserData(): void\n    {\n        $userId = $this->request->getData('user_id');\n        $this->assertUserId($userId);\n        $userData = $this->findUser($userId);\n        $this->assertUserData($userData);","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Authenticator/GpgJwtAuthenticator.php#L227-L263","documentation":"setUserKey imports the authenticated user's armored OpenPGP key into the keyring and sets it as verify/encrypt key for the JWT flow. If import or key-setting fails, 'Could not import the user OpenPGP key.' is thrown as InternalErrorException with the original exception chained. The API cannot encrypt/verify tokens for the user without a valid key.","triggerScenarios":"JWT authentication when the user's gpgkey record contains a corrupted, truncated, or malformed armored key; the key was deleted from the keyring; or the gnupg extension rejects the key material during importKeyIntoKeyring / setVerifyKeyFromFingerprint / setEncryptKeyFromFingerprint.","commonSituations":"Users imported broken armored keys (wrong line endings, missing headers); key revoked or expired on the server; keyring corrupted or recreated without user keys; fingerprints in DB not matching the armored key.","solutions":["Check the chained exception in logs for the precise gnupg import error.","Have the user re-upload a valid armored public key (account settings > OpenPGP key) and retry login.","Validate the stored armored key integrity (armored block headers/footers, fingerprint matches key body).","Clear and rebuild the GnuPG keyring for the web-server user if it is corrupted.","Verify the gpg/gnupg PHP extension version compatibility with the key algorithm (e.g. very old keys vs new GnuPG)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function isValidArmoredKey(key) { return typeof key === 'string' && key.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----') && key.includes('-----END PGP PUBLIC KEY BLOCK-----'); }","typeGuard":null,"tryCatchPattern":"try { await jwtLogin(); } catch (e) { if (e.message.includes('Could not import the user OpenPGP key')) promptKeyReupload(); else throw e; }","preventionTips":["Validate armored key format client-side before uploading user keys.","Ensure fingerprint stored in DB matches the armored key body.","Avoid editing key files with tools that mangle line endings.","Rebuild the keyring cleanly if gnupg import errors accumulate."],"tags":["gpg","jwt","user-key","authentication"],"backgroundTag":"invalid-key-material","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}