{"record":{"id":"b93216227b21695c","repo":"git-ecosystem/git-credential-manager","slug":"failed-to-decrypt-file-0-with-gpg-exit-1-o","errorCode":null,"errorMessage":"Failed to decrypt file '{0}' with gpg. exit={1}, out={2}, err={3}","messagePattern":"Failed to decrypt file '(.+?)' with gpg\\. exit=(.+?), out=(.+?), err=(.+?)","errorType":"exception","errorClass":"Trace2Exception","httpStatus":null,"severity":"error","filePath":"src/Core/Gpg.cs","lineNumber":60,"sourceCode":"\n            PrepareEnvironment(psi);\n\n            using (var gpg = _processManager.CreateProcess(psi))\n            {\n                if (!gpg.Start(Trace2ProcessClass.Other))\n                {\n                    throw new Trace2Exception(_trace2, \"Failed to start gpg.\");\n                }\n\n                gpg.WaitForExit();\n\n                if (gpg.ExitCode != 0)\n                {\n                    string stdout = gpg.StandardOutput.ReadToEnd();\n                    string stderr = gpg.StandardError.ReadToEnd();\n                    var format = \"Failed to decrypt file '{0}' with gpg. exit={1}, out={2}, err={3}\";\n                    var message = string.Format(format, path, gpg.ExitCode, stdout, stderr);\n                    throw new Trace2Exception(_trace2, message, format);\n                }\n\n                return gpg.StandardOutput.ReadToEnd();\n            }\n        }\n\n        public void EncryptFile(string path, string gpgId, string contents)\n        {\n            var psi = new ProcessStartInfo(_gpgPath, $\"--encrypt --batch --recipient \\\"{gpgId}\\\" --output \\\"{path}\\\"\")\n            {\n                UseShellExecute = false,\n                RedirectStandardInput = true,\n                RedirectStandardOutput = true,\n                RedirectStandardError = true, // Ok to redirect stderr for non-git-related processes\n            };\n\n            PrepareEnvironment(psi);\n","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Gpg.cs#L42-L78","documentation":"After gpg runs during DecryptFile, a non-zero exit code means decryption failed. The library captures stdout/stderr, formats them into this message, and throws Trace2Exception — so the exception text contains the gpg exit code and gpg's own diagnostic output explaining why decryption failed.","triggerScenarios":"DecryptFile invoked on a file that gpg cannot decrypt: wrong/missing secret key, corrupted or non-GPG file, bad passphrase, untrusted key, or wrong recipient.","commonSituations":"Credentials file encrypted with a key not present in the current keyring (new machine, regenerated keys); file re-encrypted for a different recipient; truncated downloads.","solutions":["Read the exception message's err= portion for gpg's actual reason (e.g. 'No secret key').","Import the correct secret key: gpg --import <keyfile>, and verify with gpg --list-secret-keys.","Re-encrypt the file for a key available in this environment, or copy the keyring from the original machine.","Confirm the file is a valid GPG-encrypted file (file <path>) and not corrupted; restore from backup if needed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// before decrypting, check the file is plausibly GPG data\nbyte[] head = File.ReadAllBytes(path)[..4];\nbool looksGpg = head[0] == 0x85 || head[0] == 0x80; // OpenPGP packet tags","typeGuard":null,"tryCatchPattern":"try { plaintext = gpg.DecryptFile(path); }\ncatch (Trace2Exception ex) when (ex.Message.StartsWith(\"Failed to decrypt file\"))\n{ // parse err= from ex.Message; e.g. 'No secret key' -> instruct key import\n  throw new InvalidOperationException(\"Decryption failed; ensure the correct secret key is imported into the keyring.\", ex); }","preventionTips":["Ensure the encrypting key's secret half exists in the target environment's keyring.","Re-encrypt credential files when moving machines or rotating keys.","Verify file integrity (non-zero size, GPG header) before decrypting."],"tags":["gpg","decryption","exit-code","keyring"],"backgroundTag":"git-command-failed","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}