cloudflare/cloudflared · error · Exception

Could not find imported key with fingerprint {imported_finge

Error message

Could not find imported key with fingerprint {imported_fingerprint}

What it means

After successfully importing the private key, the code lists secret keys (gpg.list_keys(secret=True)) and searches for the fingerprint reported by the import; if no secret key with that fingerprint is present, it raises this f-string exception. This is a post-import consistency check: the key claimed to import but is not visible in the keyring as a secret key.

Source

Thrown at release_pkgs.py:207

    def import_gpg_keys(self, private_key, public_key):
        gpg = gnupg.GPG()
        private_key = base64.b64decode(private_key)
        import_result = gpg.import_keys(private_key)
        if not import_result.fingerprints:
            raise Exception("Failed to import private key")

        public_key = base64.b64decode(public_key)
        gpg.import_keys(public_key)

        imported_fingerprint = import_result.fingerprints[0]
        data = gpg.list_keys(secret=True)

        # Find the specific key we just imported by comparing fingerprints
        for key in data:
            if key["fingerprint"] == imported_fingerprint:
                return (key["fingerprint"], key["uids"][0])

        raise Exception(f"Could not find imported key with fingerprint {imported_fingerprint}")

    def import_multiple_gpg_keys(self, primary_private_key, primary_public_key, secondary_private_key=None, secondary_public_key=None):
        """
        Import one or two GPG keypairs. Returns a list of (fingerprint, uid) with the primary first.
        """
        results = []
        if primary_private_key and primary_public_key:
            results.append(self.import_gpg_keys(primary_private_key, primary_public_key))
        if secondary_private_key and secondary_public_key:
            # Ensure secondary is imported and appended
            results.append(self.import_gpg_keys(secondary_private_key, secondary_public_key))
        return results

    """
        basically rpm --import <key_file>
        This enables us to sign rpms.
    """

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Set and export GNUPGHOME consistently (or pass gnupg.GPG(gnupghome=...)) so import and listing use the same keyring.
2. Check 'gpg --list-secret-keys' in the same environment to confirm the key exists.
3. Verify the imported key actually contains secret (private) key material.
4. Use import_result status fields instead of a second listing, or retry the listing after a short delay.

Example fix

// before
gpg = gnupg.GPG()
// after
gpg = gnupg.GPG(gnupghome=os.environ.get("GNUPGHOME", str(Path.home() / ".gnupg")))

import os
os.environ.setdefault("GNUPGHOME", os.path.expanduser("~/.gnupg"))
gpg = gnupg.GPG(gnupghome=os.environ["GNUPGHOME"])
# import and list_keys must use this same gpg handle

try:
    fp, uid = import_gpg_keys(priv, pub)
except Exception as e:
    logging.error("key lookup failed: %s; GNUPGHOME=%s", e, os.environ.get("GNUPGHOME"))
    raise SystemExit(1)

When it happens

Trigger: The import partially succeeded (fingerprint reported) but the secret key is not in the current GNUPGHOME; multiple GPG homes between import and listing; the imported key lacks a secret part; gpg agent keyring caching/timing issues.

Common situations: GNUPGHOME pointing elsewhere in the CI container (e.g. /root/.gnupg vs the running user's home); ephemeral containers wiping the keyring between steps; importing a public-only key that still reports a fingerprint.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Failed to import private key
• No GPG keys were provided for signing

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/dc6b204f350b21f5. Report an issue: GitHub.