{"record":{"id":"88d9722ce3312e4d","repo":"passbolt/passbolt_api","slug":"500-exceptionmessage-the-metadata-could-not-be-encrypted","errorCode":"500","errorMessage":"{exceptionMessage} The metadata could not be encrypted with the metadata key id: {0}.","messagePattern":"(.+?) The metadata could not be encrypted with the metadata key id: (.+?)\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/Tags/src/Service/Metadata/MigrateAllV4TagsToV5Service.php","lineNumber":177,"sourceCode":"     * @return void\n     * @throws \\Cake\\Datasource\\Exception\\RecordNotFoundException When there is no metadata key record.\n     */\n    private function migrateShared(MetadataTagDto $dto, Tag $tag): void\n    {\n        $metadataArray = $dto->getClearTextMetadata();\n        $metadataKey = $this->getMetadataKeyForEncryption();\n\n        try {\n            $gpg = OpenPGPBackendFactory::get();\n            $gpg->clearKeys();\n            $gpg = $this->setSignKeyWithServerKey($gpg);\n            $gpg = $this->setEncryptKeyWithMetadataKey($gpg, $metadataKey);\n            $metadataClearText = json_encode($metadataArray, JSON_THROW_ON_ERROR);\n            $metadataEncrypted = $gpg->encrypt($metadataClearText, true);\n        } catch (Exception $exception) {\n            $msg = $exception->getMessage() . ' ';\n            $msg .= __('The metadata could not be encrypted with the metadata key id: {0}.', $metadataKey->id);\n            throw new InternalErrorException($msg, 500, $exception);\n        }\n\n        $this->updateTag($tag, [\n            'slug' => null,\n            'metadata' => $metadataEncrypted,\n            'metadata_key_id' => $metadataKey->id,\n            'metadata_key_type' => MetadataKey::TYPE_SHARED_KEY,\n            'is_shared' => true,\n        ]);\n    }\n\n    /**\n     * @param \\Passbolt\\Tags\\Model\\Dto\\MetadataTagDto $dto DTO.\n     * @param \\Passbolt\\Tags\\Model\\Entity\\Tag $tag Tag entity.\n     * @return void\n     */\n    private function migratePersonal(MetadataTagDto $dto, Tag $tag): void\n    {","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Tags/src/Service/Metadata/MigrateAllV4TagsToV5Service.php#L159-L195","documentation":"When migrating a shared tag, the service encrypts the cleartext metadata with the metadata key. Any failure inside the encryption block (GPG operation error, missing/unusable metadata key, JSON encoding failure) is wrapped into an InternalErrorException whose message prefixes the original exception message and names the metadata key id.","triggerScenarios":"Metadata key missing, deleted, expired, or its private key material unavailable on the server during shared-tag migration; GnuPG backend failure while encrypting; json_encode throwing on malformed metadata arrays.","commonSituations":"Server without the metadata private key passphrase configured; metadata key rotated and old key revoked before migration; GnuPG keyring/agent issues in containerized environments.","solutions":["Verify a valid metadata key exists and the server can decrypt/sign with it (check metadata_keys table and key storage).","Confirm GnuPG works server-side (gnupg home directory permissions, agent running).","Inspect the wrapped original exception message (prefixed in the error) for the root cause.","Re-run the migration after restoring the key; the failing tag remains V4 and can be retried."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"$metadataKey = $this->MetadataKeys->getLatestNonExpiredKey();\nif (!$metadataKey || !$metadataKey->hasValidPrivateKey()) {\n    throw new \\RuntimeException('No usable metadata key; abort migration');\n}","typeGuard":"function canEncryptWithKey(?MetadataKey $key): bool {\n    return $key !== null && !$key->expired && $key->deleted === null;\n}","tryCatchPattern":"try {\n    $service->migrate($uac, $batch);\n} catch (InternalErrorException $e) {\n    $this->log('Shared tag encryption failed: ' . $e->getMessage(), 'error');\n    // resume batch after key/GPG repair; failed tags remain V4\n}","preventionTips":["Verify metadata key availability and passphrase before running migration","Monitor GnuPG health (keyring perms, agent) in the deployment","Rotate keys before revoking old ones","Dry-run encryption on one tag before batch runs"],"tags":["encryption","gpg","migration","metadata-key"],"backgroundTag":"missing-credentials","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}