{"record":{"id":"1a6cf3d882911bda","repo":"passbolt/passbolt_api","slug":"the-subscription-key-cannot-be-verified-1a6cf3","errorCode":null,"errorMessage":"The subscription key cannot be verified.","messagePattern":"The subscription key cannot be verified\\.","errorType":"exception","errorClass":"SubscriptionSignatureException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/Subscription/src/Form/SubscriptionKeyAsciiForm.php","lineNumber":197,"sourceCode":"     */\n    protected function _verifySignature(string $subscriptionSigned): string\n    {\n        $msg = __('The subscription key cannot be verified.');\n        $subscription = '';\n        $filePublicKey = Configure::read('passbolt.plugins.edition.subscriptionKey.public');\n\n        if (!$filePublicKey || !file_exists($filePublicKey)) {\n            $msg .= ' ' . __('The passbolt OpenPGP public key could not be found.');\n            throw new SubscriptionSignatureException($subscriptionSigned, $msg);\n        }\n        $subscriptionPublicKey = file_get_contents($filePublicKey);\n        $fingerprint = $this->getGpg()->importKeyIntoKeyring($subscriptionPublicKey);\n        $this->getGpg()->setVerifyKeyFromFingerprint($fingerprint);\n        try {\n            $this->getGpg()->verify($subscriptionSigned, $subscription);\n        } catch (Exception $e) {\n            $msg .= ' ' . $e->getMessage();\n            throw new SubscriptionSignatureException($subscriptionSigned, $msg);\n        }\n\n        /** @psalm-suppress NullableReturnStatement this is always a string */\n        return $subscription;\n    }\n\n    /**\n     * @return \\App\\Utility\\OpenPGP\\OpenPGPBackend\n     */\n    private function getGpg(): OpenPGPBackend\n    {\n        if (is_null($this->_gpg)) {\n            $this->_gpg = OpenPGPBackendFactory::get();\n        }\n\n        return $this->_gpg;\n    }\n","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Subscription/src/Form/SubscriptionKeyAsciiForm.php#L179-L215","documentation":"_verifySignature() throws SubscriptionSignatureException when the OpenPGP verification of the subscription payload fails: the GnuPG/OpenPGP backend (import of the vendor public key succeeded, key fingerprint set) could not verify the signature over the armored message. The underlying GPG backend message is appended to the exception text.","triggerScenarios":"parse() calls _verifySignature() and $this->getGpg()->verify($subscriptionSigned, $subscription) throws — tampered payload, signature made by a key not matching the imported vendor public key, corrupted armored message, or the gpg keyring/OpenPGP backend malfunctioning (e.g. gnupg extension issue, stale keyring).","commonSituations":"Manually editing the subscription JSON then re-submitting; a key issued for a different passbolt product; mixed or corrupted Gnupg keyring under the web-server user (e.g. ~/.gnupg ownership problems); PHP gnupg/OpenPGP-PGP backend mismatch after server migration.","solutions":["Read the appended GPG message in the exception/log to see the concrete verification failure.","Do not alter the key: submit the exact base64 string from passbolt — any edit invalidates the signature.","Fix keyring health for the web user: `sudo chown -R www-data:www-data /var/lib/passbolt/.gnupg` and ensure the gnupg PHP extension works.","Confirm the key matches your edition/version and request a re-issued key from passbolt if verification still fails."],"exampleFix":"// before: edited key payload\n$key = str_replace('\"expires\":\"2020', '\"expires\":\"2099', $key);\ncreateOrUpdate($uac, $key); // signature check fails\n// after\ncreateOrUpdate($uac, $originalUnmodifiedKey);","handlingStrategy":"try-catch","validationCode":"// before submitting, verify locally:\n// base64 -d key.b64 | gpg --verify - 2>&1","typeGuard":null,"tryCatchPattern":"try {\n    $dto = $form->parse($key);\n} catch (SubscriptionSignatureException $e) {\n    Log::error($e->getMessage()); // includes underlying GPG verify error\n    // do not retry with a modified key; request a fresh key\n}","preventionTips":["Submit the key exactly as issued — any edit breaks the signature","Keep the gnupg extension and web-user keyring healthy (ownership of ~/.gnupg)","Match key edition/version to the installed passbolt release"],"tags":["openpgp","signature-verification","subscription-key","php"],"backgroundTag":"signature-verification-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}