{"record":{"id":"91d9f53773f5f790","repo":"arduino/Arduino","slug":"can-t-find-encryption-key-in-key-ring","errorCode":null,"errorMessage":"Can't find encryption key in key ring.","messagePattern":"Can't find encryption key in key ring\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"arduino-core/src/cc/arduino/contributions/GPGDetachedSignatureVerifier.java","lineNumber":115,"sourceCode":"\n  private PGPPublicKey readPublicKey(InputStream input, String id) throws IOException, PGPException {\n    PGPPublicKeyRingCollection pgpPub = new PGPPublicKeyRingCollection(PGPUtil.getDecoderStream(input), new BcKeyFingerprintCalculator());\n\n    Iterator<PGPPublicKeyRing> keyRingIter = pgpPub.getKeyRings();\n    while (keyRingIter.hasNext()) {\n      PGPPublicKeyRing keyRing = keyRingIter.next();\n\n      Iterator<PGPPublicKey> keyIter = keyRing.getPublicKeys();\n      while (keyIter.hasNext()) {\n        PGPPublicKey key = keyIter.next();\n\n        if (Long.toHexString(key.getKeyID()).toUpperCase().endsWith(id)) {\n          return key;\n        }\n      }\n    }\n\n    throw new IllegalArgumentException(\"Can't find encryption key in key ring.\");\n  }\n\n}\n","sourceCodeStart":97,"sourceCodeEnd":119,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/cc/arduino/contributions/GPGDetachedSignatureVerifier.java#L97-L119","documentation":"GPGDetachedSignatureVerifier.readPublicKey() scans a BouncyCastle key ring for a public key whose key ID (hex, upper-case) ends with the requested id suffix. If no key matches, it throws an IllegalArgumentException saying the encryption (verification) key is absent from the key ring.","triggerScenarios":"readPublicKey (invoked during signature verification of package indexes) is asked for key id 'id' but no key in the loaded key ring's long key id hex ends with that suffix — e.g. an outdated bundled key ring missing the signer's key, or an id lookup that assumes a suffix match on a rotated key.","commonSituations":"Package index signed with a newer Arduino signing key while the local key ring only contains the old key; manually replaced or stale Arduino.cgx/keyring resources; verifying indexes signed by third parties whose keys were never imported.","solutions":["Update to a version of arduino-core/IDE that bundles the current Arduino signing key ring.","Import the signer's public key into the key ring used by GPGDetachedSignatureVerifier.","Check that the requested key id suffix is correct and refers to a key actually in the ring (note the suffix, not full id, matching rule).","If the index is third-party, add its key to the trusted key ring or skip signature verification consciously."],"exampleFix":"// before\nverifier.verify(indexFile, signatureFile, verifier.readPublicKey(\"OLDKEYID\"));\n// after\nString keyId = \"NEWKEYIDSUFFIX\"; // from the updated bundled keyring\nPublicKey key = verifier.readPublicKey(keyId); // throws if ring outdated -> refresh keys first","handlingStrategy":"validation","validationCode":"// Ensure the key ring contains a key with the requested id before verifying\nPGPPublicKey k = findKeyByIdSuffix(keyRing, keyIdSuffix);\nif (k == null) { throw new IllegalStateException(\"Key \" + keyIdSuffix + \" missing from ring; update signing keys first\"); }","typeGuard":null,"tryCatchPattern":"try { verify(index, sig, key); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"Can't find encryption key\")) { refreshTrustedKeyRing(); } else { throw e; } }","preventionTips":["Ship/import updated Arduino signing keys when upgrading the IDE.","Do not prune the bundled key ring when customizing installs.","For third-party indexes, import their public keys up front."],"tags":["arduino","gpg","signatures","keyring"],"backgroundTag":"missing-api-key","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}