{"record":{"id":"51533d7c12653546","repo":"basecamp/kamal","slug":"failed-to-login-to-passbolt","errorCode":null,"errorMessage":"Failed to login to Passbolt","messagePattern":"Failed to login to Passbolt","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"lib/kamal/secrets/adapters/passbolt.rb","lineNumber":10,"sourceCode":"class Kamal::Secrets::Adapters::Passbolt < Kamal::Secrets::Adapters::Base\n  def requires_account?\n    false\n  end\n\n  private\n\n    def login(*)\n      `passbolt verify`\n      raise RuntimeError, \"Failed to login to Passbolt\" unless $?.success?\n    end\n\n    def fetch_secrets(secrets, from:, **)\n      secrets = prefixed_secrets(secrets, from: from)\n      raise ArgumentError, \"No secrets given to fetch\" if secrets.empty?\n\n      secret_names = secrets.collect { |s| s.split(\"/\").last }\n      folders = secrets_get_folders(secrets)\n\n      # build filter conditions for each secret with its corresponding folder\n      filter_conditions = []\n      secrets.each do |secret|\n        parts = secret.split(\"/\")\n        secret_name = parts.last\n\n        if parts.size > 1\n          # get the folder path without the secret name\n          folder_path = parts[0..-2]","sourceCodeStart":1,"sourceCodeEnd":28,"githubUrl":"https://github.com/basecamp/kamal/blob/eee0083b38661c3707c6b6052cc89e85038a096c/lib/kamal/secrets/adapters/passbolt.rb#L1-L28","documentation":"Raised in Passbolt#login when `passbolt verify` exits non-zero. Unlike other adapters there is NO loggedin? short-circuit — every single fetch runs `passbolt verify` first, so any Passbolt CLI configuration problem (missing GPG key, wrong server URL, bad fingerprint, expired passphrase cache) turns every kamal secrets pull into this error. The adapter sets requires_account? false; authentication state lives entirely in the passbolt CLI's own config.","triggerScenarios":"adapter.fetch(...) whenever `passbolt verify` fails: passbolt CLI never configured (no server/user/GPG key set), GPG secret key for the Passbolt user missing from the local keyring, wrong fingerprint or server URL in the CLI config, or the server unreachable/SSL failing.","commonSituations":"New machine or CI container where the passbolt CLI was installed but `passbolt configure` was never run; GPG key not imported (gpg --import) after OS reinstall; Passbolt server hostname or self-signed cert changed; user account key rotated in Passbolt but local keyring still holds the old one.","solutions":["Run `passbolt verify` directly to see its error output, then fix what it complains about (usually configuration or GPG key).","Configure the CLI: `passbolt configure --url https://passbolt.example.com --userKey <fingerprint>` (exact flags per your passbolt CLI version) after importing the user's GPG secret key with `gpg --import`.","Verify server reachability and TLS (curl the URL) if configuration is correct but verify still fails.","Re-run `kamal secrets pull` only after `passbolt verify` exits 0 standalone."],"exampleFix":"# before: unconfigured passbolt CLI\n#   -> RuntimeError: Failed to login to Passbolt\n\n# after: import key + configure, verify standalone\ngpg --import passbolt-user-private.asc\npassbolt configure --url https://passbolt.example.com\npassbolt verify && kamal secrets pull","handlingStrategy":"try-catch","validationCode":"require \"open3\"\n\ndef passbolt_verified?\n  Open3.capture3(\"passbolt\", \"verify\")[2].success?\nend\n\nabort \"passbolt CLI not configured/verified: run `passbolt configure` and import your GPG key\" unless passbolt_verified?","typeGuard":null,"tryCatchPattern":"begin\n  secrets = adapter.fetch(names)\nrescue RuntimeError => e\n  if e.message == \"Failed to login to Passbolt\"\n    raise \"passbolt verify failed: check CLI config, GPG secret key, and server reachability before deploying\"\n  end\n  raise\nend","preventionTips":["Run `passbolt verify` in a preflight step — the adapter re-runs it on every fetch, so keep the CLI permanently configured.","Import the Passbolt user's GPG secret key and record the correct fingerprint in CLI config during provisioning.","Monitor Passbolt server cert/hostname changes; verify fails before kamal gives a clearer error."],"tags":["ruby","kamal","passbolt","authentication","secrets","gpg","cli-exit-code"],"backgroundTag":"cli-authentication-failed","analyzedSha":"eee0083b38661c3707c6b6052cc89e85038a096c","analyzedAt":"2026-08-21T15:17:22.045Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}