{"record":{"id":"dc6b204f350b21f5","repo":"cloudflare/cloudflared","slug":"could-not-find-imported-key-with-fingerprint-impo","errorCode":null,"errorMessage":"Could not find imported key with fingerprint {imported_fingerprint}","messagePattern":"Could not find imported key with fingerprint (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"release_pkgs.py","lineNumber":207,"sourceCode":"    def import_gpg_keys(self, private_key, public_key):\n        gpg = gnupg.GPG()\n        private_key = base64.b64decode(private_key)\n        import_result = gpg.import_keys(private_key)\n        if not import_result.fingerprints:\n            raise Exception(\"Failed to import private key\")\n\n        public_key = base64.b64decode(public_key)\n        gpg.import_keys(public_key)\n\n        imported_fingerprint = import_result.fingerprints[0]\n        data = gpg.list_keys(secret=True)\n\n        # Find the specific key we just imported by comparing fingerprints\n        for key in data:\n            if key[\"fingerprint\"] == imported_fingerprint:\n                return (key[\"fingerprint\"], key[\"uids\"][0])\n\n        raise Exception(f\"Could not find imported key with fingerprint {imported_fingerprint}\")\n\n    def import_multiple_gpg_keys(self, primary_private_key, primary_public_key, secondary_private_key=None, secondary_public_key=None):\n        \"\"\"\n        Import one or two GPG keypairs. Returns a list of (fingerprint, uid) with the primary first.\n        \"\"\"\n        results = []\n        if primary_private_key and primary_public_key:\n            results.append(self.import_gpg_keys(primary_private_key, primary_public_key))\n        if secondary_private_key and secondary_public_key:\n            # Ensure secondary is imported and appended\n            results.append(self.import_gpg_keys(secondary_private_key, secondary_public_key))\n        return results\n\n    \"\"\"\n        basically rpm --import <key_file>\n        This enables us to sign rpms.\n    \"\"\"\n","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/release_pkgs.py#L189-L225","documentation":"After successfully importing the private key, the code lists secret keys (gpg.list_keys(secret=True)) and searches for the fingerprint reported by the import; if no secret key with that fingerprint is present, it raises this f-string exception. This is a post-import consistency check: the key claimed to import but is not visible in the keyring as a secret key.","triggerScenarios":"The import partially succeeded (fingerprint reported) but the secret key is not in the current GNUPGHOME; multiple GPG homes between import and listing; the imported key lacks a secret part; gpg agent keyring caching/timing issues.","commonSituations":"GNUPGHOME pointing elsewhere in the CI container (e.g. /root/.gnupg vs the running user's home); ephemeral containers wiping the keyring between steps; importing a public-only key that still reports a fingerprint.","solutions":["Set and export GNUPGHOME consistently (or pass gnupg.GPG(gnupghome=...)) so import and listing use the same keyring.","Check 'gpg --list-secret-keys' in the same environment to confirm the key exists.","Verify the imported key actually contains secret (private) key material.","Use import_result status fields instead of a second listing, or retry the listing after a short delay."],"exampleFix":"// before\ngpg = gnupg.GPG()\n// after\ngpg = gnupg.GPG(gnupghome=os.environ.get(\"GNUPGHOME\", str(Path.home() / \".gnupg\")))","handlingStrategy":"validation","validationCode":"import os\nos.environ.setdefault(\"GNUPGHOME\", os.path.expanduser(\"~/.gnupg\"))\ngpg = gnupg.GPG(gnupghome=os.environ[\"GNUPGHOME\"])\n# import and list_keys must use this same gpg handle","typeGuard":null,"tryCatchPattern":"try:\n    fp, uid = import_gpg_keys(priv, pub)\nexcept Exception as e:\n    logging.error(\"key lookup failed: %s; GNUPGHOME=%s\", e, os.environ.get(\"GNUPGHOME\"))\n    raise SystemExit(1)","preventionTips":["Pin GNUPGHOME explicitly so import and listing share one keyring","Use the same gnupg.GPG() handle for import and verification","Verify secret keys exist with gpg --list-secret-keys in the same container step"],"tags":["gpg","keyring","signing","ci"],"backgroundTag":"resource-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}