{"record":{"id":"128611111a0dcb28","repo":"getsops/sops","slug":"could-not-encrypt-data-key-with-pgp-key-w","errorCode":null,"errorMessage":"could not encrypt data key with PGP key: %w","messagePattern":"could not encrypt data key with PGP key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgp/keysource.go","lineNumber":295,"sourceCode":"\n\tif !key.disableOpenPGP {\n\t\topenpgpErr := key.encryptWithOpenPGP(dataKey)\n\t\tif openpgpErr == nil {\n\t\t\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption succeeded\")\n\t\t\treturn nil\n\t\t}\n\t\terrs = append(errs, fmt.Errorf(\"github.com/ProtonMail/go-crypto/openpgp error: %w\", openpgpErr))\n\t}\n\n\tbinaryErr := key.encryptWithGnuPG(ctx, dataKey)\n\tif binaryErr == nil {\n\t\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption succeeded\")\n\t\treturn nil\n\t}\n\terrs = append(errs, fmt.Errorf(\"GnuPG binary error: %w\", binaryErr))\n\n\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption failed\")\n\treturn fmt.Errorf(\"could not encrypt data key with PGP key: %w\", errs)\n}\n\n// encryptWithOpenPGP attempts to encrypt the data key using OpenPGP with the\n// PGP key that belongs to Fingerprint. It sets EncryptedDataKey, or returns\n// an error.\nfunc (key *MasterKey) encryptWithOpenPGP(dataKey []byte) error {\n\tentity, err := key.retrievePubKey()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tencBuf := new(bytes.Buffer)\n\tarmorBuf, err := armor.Encode(encBuf, \"PGP MESSAGE\", nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\tplainBuf, err := openpgp.Encrypt(armorBuf, []*openpgp.Entity{&entity}, nil, &openpgp.FileHints{IsBinary: true}, nil)\n\tif err != nil {","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/pgp/keysource.go#L277-L313","documentation":"This is the aggregate error returned by EncryptContext after both the go-crypto OpenPGP attempt and the gpg-binary fallback failed. It wraps a multi-error list containing the openpgp error and the 'GnuPG binary error'. Seeing it means sops could not encrypt the data key to this PGP master key by any available method.","triggerScenarios":"Calling EncryptContext (directly or via sops encrypt) when the fingerprint is unknown to both the Go keyring and the gpg binary, or both mechanisms fail (bad GNUPGHOME, missing gpg, unusable key).","commonSituations":"Fresh machine/CI container without imported keys; typo'ed fingerprint in .sops.yaml; gpg not installed; empty injected GnuPGHome.","solutions":["Read both wrapped causes and fix the more specific one (usually 'No public key')","Import the public key for the fingerprint and verify with gpg --list-keys <fingerprint>","Confirm the fingerprint in .sops.yaml matches a real key (no typos, no spaces issues)","Ensure a working gpg binary exists (or SOPS_GPG_EXEC points to it) and GNUPGHOME is valid (0700 dir)"],"exampleFix":"// before\npgp: 'C6A0...BEEF'  # key never imported\n// after\ngpg --import team-keys.asc && gpg --list-keys C6A0...BEEF  # then re-run sops -e","handlingStrategy":"try-catch","validationCode":"fp := fingerprint\nfor _, args := range [][]string{\n    {\"--homedir\", gnupgHome, \"--list-keys\", fp},\n    {\"--homedir\", gnupgHome, \"--list-secret-keys\", fp},\n} {\n    if out, err := exec.Command(\"gpg\", args...).CombinedOutput(); err != nil {\n        return fmt.Errorf(\"key %s unavailable (%v): %s\", fp, err, out)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    var errs []error\n    if errors.As(err, &errs) { // aggregate wraps both openpgp and gpg errors\n        for _, e := range errs { log.Errorf(\"pgp encrypt: %v\", e) }\n    }\n    return fmt.Errorf(\"encrypt to %s failed; run 'gpg --import' and retry: %w\", key.Fingerprint, err)\n}","preventionTips":["Pre-flight: verify every .sops.yaml pgp fingerprint exists in the local keyring before encrypting","Bootstrap fresh environments (laptops, CI) with a key-import step","Keep gpg installed and SOPS_GPG_EXEC/GNUPGHOME correct","Handle the wrapped aggregate errors individually to find the root cause"],"tags":["gnupg","openpgp","encryption","aggregate-error"],"backgroundTag":"pgp-key-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}