{"record":{"id":"b2da8eb9efb0fecf","repo":"getsops/sops","slug":"github-com-protonmail-go-crypto-openpgp-error-w","errorCode":null,"errorMessage":"github.com/ProtonMail/go-crypto/openpgp error: %w","messagePattern":"github\\.com/ProtonMail/go-crypto/openpgp error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgp/keysource.go","lineNumber":284,"sourceCode":"// fingerprint as the MasterKey.\n//\n// Consider using EncryptContext instead.\nfunc (key *MasterKey) Encrypt(dataKey []byte) error {\n\treturn key.EncryptContext(context.Background(), dataKey)\n}\n\n// EncryptContext encrypts the data key with the PGP key with the same\n// fingerprint as the MasterKey.\nfunc (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error {\n\tvar errs errSet\n\n\tif !key.disableOpenPGP {\n\t\topenpgpErr := key.encryptWithOpenPGP(dataKey)\n\t\tif openpgpErr == nil {\n\t\t\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption succeeded\")\n\t\t\treturn nil\n\t\t}\n\t\terrs = append(errs, fmt.Errorf(\"github.com/ProtonMail/go-crypto/openpgp error: %w\", openpgpErr))\n\t}\n\n\tbinaryErr := key.encryptWithGnuPG(ctx, dataKey)\n\tif binaryErr == nil {\n\t\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption succeeded\")\n\t\treturn nil\n\t}\n\terrs = append(errs, fmt.Errorf(\"GnuPG binary error: %w\", binaryErr))\n\n\tlog.WithField(\"fingerprint\", key.Fingerprint).Info(\"Encryption failed\")\n\treturn fmt.Errorf(\"could not encrypt data key with PGP key: %w\", errs)\n}\n\n// encryptWithOpenPGP attempts to encrypt the data key using OpenPGP with the\n// PGP key that belongs to Fingerprint. It sets EncryptedDataKey, or returns\n// an error.\nfunc (key *MasterKey) encryptWithOpenPGP(dataKey []byte) error {\n\tentity, err := key.retrievePubKey()","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/pgp/keysource.go#L266-L302","documentation":"EncryptContext tries key.encryptWithOpenPGP (github.com/ProtonMail/go-crypto/openpgp) first; if it fails and OpenPGP is not disabled, the error is appended as 'github.com/ProtonMail/go-crypto/openpgp error: %w'. This is one of two attempts collected before the aggregate failure; it means the pure-Go OpenPGP path could not encrypt the data key to the key's fingerprint (missing key in keyring, unreadable pubring, malformed key, etc.).","triggerScenarios":"Calling EncryptContext when the public keyring (pubRing or default pubring.gpg in the GnuPG home) cannot be read/parsed, or does not contain a usable public key for key.Fingerprint.","commonSituations":"Fingerprint in .sops.yaml never imported into the local keyring; GnuPG 2.1+ kbx format that go-crypto cannot read; GNUPGHOME pointing at an empty temp dir; expired/revoked recipient key.","solutions":["Import the recipient public key: gpg --import <pubkey-file> (into the GNUPGHOME sops uses)","Export to a legacy-format keyring readable by go-crypto, or set SOPS_GPG_EXEC and rely on the gpg-binary fallback","Verify the fingerprint matches an existing key: gpg --list-keys <fingerprint>","If you intend to use only the gpg binary, ensure the binary path is valid so the fallback succeeds"],"exampleFix":"// before\nsops -e file.yaml  # fails: fingerprint not in keyring\n// after\ngpg --import teammate.pub.asc && sops -e file.yaml","handlingStrategy":"validation","validationCode":"fp := strings.ReplaceAll(fingerprint, \" \", \"\")\nout, err := exec.Command(\"gpg\", \"--homedir\", gnupgHome, \"--list-keys\", fp).CombinedOutput()\nif err != nil || !strings.Contains(string(out), fp) {\n    return fmt.Errorf(\"public key %s not present; run gpg --import first: %s\", fp, out)\n}","typeGuard":null,"tryCatchPattern":"if err := key.EncryptContext(ctx, dataKey); err != nil {\n    var agg interface{ Unwrap() []error }\n    if errors.As(err, &agg) || strings.Contains(err.Error(), \"go-crypto/openpgp error\") {\n        log.Warn(\"OpenPGP path failed; check keyring or rely on gpg fallback\")\n    }\n    return err\n}","preventionTips":["Import all fingerprints listed in .sops.yaml into the used GNUPGHOME before encrypting","Remember GnuPG 2.1+ kbx keyrings may be unreadable by go-crypto; export legacy pubring.gpg if needed","Check gpg --list-keys <fingerprint> in setup scripts","Replace expired/revoked recipient keys promptly"],"tags":["gnupg","openpgp","encryption","keyring"],"backgroundTag":"pgp-key-not-found","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}