{"record":{"id":"787f783448ce5b79","repo":"passbolt/passbolt_api","slug":"exceptionmessage-the-metadata-could-not-be-encrypted-with","errorCode":null,"errorMessage":"{exceptionMessage} The metadata could not be encrypted with the user id: {0}.","messagePattern":"(.+?) The metadata could not be encrypted with the user id: (.+?)\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/Migration/MigrateAllV4FoldersToV5Service.php","lineNumber":171,"sourceCode":"            throw new InternalErrorException($msg);\n        }\n        if (is_null($user->gpgkey)) {\n            $msg = __('No OpenPGP key found for the user.') . ' ';\n            $msg .= __('The metadata could not be encrypted with the user id: {0}.', $user->id);\n            throw new InternalErrorException($msg);\n        }\n\n        try {\n            $gpg = OpenPGPBackendFactory::get();\n            $gpg->clearKeys();\n            $gpg = $this->setSignKeyWithServerKey($gpg);\n            $gpg = $this->setEncryptKeyWithUserKey($gpg, $user->gpgkey);\n            $metadataClearText = json_encode($metadataArray, JSON_THROW_ON_ERROR);\n            $metadataEncrypted = $gpg->encrypt($metadataClearText, true);\n        } catch (Exception $exception) {\n            $msg = $exception->getMessage() . ' ';\n            $msg .= __('The metadata could not be encrypted with the user id: {0}.', $user->id);\n            throw new InternalErrorException($msg, 500, $exception);\n        }\n\n        $this->updateFolder($folder, [\n            'name' => null,\n            'metadata' => $metadataEncrypted,\n            'metadata_key_id' => $user->gpgkey->id,\n            'metadata_key_type' => 'user_key',\n        ]);\n    }\n\n    /**\n     * @param \\Passbolt\\Metadata\\Model\\Dto\\MetadataFolderDto $dto DTO.\n     * @param \\Passbolt\\Folders\\Model\\Entity\\Folder $folder Entity.\n     * @return void\n     * @throws \\Cake\\Datasource\\Exception\\RecordNotFoundException When there is no metadata key record.\n     */\n    private function migrateShared(MetadataFolderDto $dto, Folder $folder): void\n    {","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/Migration/MigrateAllV4FoldersToV5Service.php#L153-L189","documentation":"The actual OpenPGP encryption step of migratePersonal failed: any exception from OpenPGPBackendFactory setup, key loading, JSON encoding, or gpg->encrypt() is re-thrown as an InternalErrorException prefixed with the original exception message and suffixed with the user ID. It wraps the previous exception for the logs.","triggerScenarios":"Calling migrate → migratePersonal when the GnuPG backend fails: server key not loaded/found, user's public key corrupt or unsupported algorithm, gpg binary missing, or json_encode throwing (JSON_THROW_ON_ERROR) on malformed metadata.","commonSituations":"GNUPGHOME misconfigured or not writable by web user; gnupg extension absent; expired/revoked user key; server OpenPGP key missing from keyring; non-UTF8 folder names breaking JSON encoding.","solutions":["Read the chained exception / the prefixed exceptionMessage to identify the actual GPG failure.","Verify the server OpenPGP key is present and loadable (setSignKeyWithServerKey) and GNUPGHOME permissions are correct.","Check the user's public key is valid, not expired/revoked, and supported by the gpg binary version.","Confirm the php gnupg/openpgp backend is installed and the gpg binary is available to the PHP process."],"exampleFix":"// before\n$metadataEncrypted = $gpg->encrypt($metadataClearText, true);\n// after: harden against missing server key\n$gpg = OpenPGPBackendFactory::get();\n$gpg->clearKeys();\n$serverKeyInfo = Configure::read('passbolt.gpg.serverKey');\nif (!file_exists($serverKeyInfo['fingerprint'] ? $serverKeyInfo['public'] : '')) {\n    throw new InternalErrorException('Server OpenPGP key not found.');\n}\n$gpg = $this->setSignKeyWithServerKey($gpg);\n$metadataEncrypted = $gpg->encrypt($metadataClearText, true);","handlingStrategy":"try-catch","validationCode":"// preflight the GPG environment before migrating\n$gpg = OpenPGPBackendFactory::get();\n$gpg->clearKeys();\n$gpg->importKeyIntoKeyring(Filesystem::read(Configure::read('passbolt.gpg.serverKey.public')));\n// and confirm each target user's key is present, non-expired, non-revoked","typeGuard":null,"tryCatchPattern":"try {\n    $service->migrate($uac);\n} catch (\\Cake\\Http\\Exception\\InternalErrorException $e) {\n    error_log($e->getPrevious()?->getMessage() ?? $e->getMessage());\n    // fix gnupg keyring / server key / user key per root cause, then retry\n}","preventionTips":["Verify GNUPGHOME exists and is writable by the PHP user before migrations","Ensure the server OpenPGP key pair is configured and importable","Keep the gpg binary and PHP gnupg extension installed and version-compatible","Test encryption with one folder before batch-migrating"],"tags":["openpgp","encryption","gnupg","migration"],"backgroundTag":"http-request-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}