cloudflare/cloudflared · error · SystemExit

No GPG keys were provided for signing

Error message

No GPG keys were provided for signing

What it means

The main flow calls import_multiple_gpg_keys and, if the returned list is empty, raises SystemExit('No GPG keys were provided for signing') to abort before any signing step. It indicates the CLI arguments for GPG keys resolved to nothing usable. Because it is SystemExit, it terminates the process with the message rather than a traceback.

Source

Thrown at release_pkgs.py:423

if __name__ == "__main__":
    try:
        args = parse_args()
    except Exception as e:
        logging.exception(e)
        exit(1)

    pkg_creator = PkgCreator()
    # Import one or two keypairs; primary first
    key_results = pkg_creator.import_multiple_gpg_keys(
        args.gpg_private_key,
        args.gpg_public_key,
        args.gpg_private_key_2,
        args.gpg_public_key_2,
    )
    if not key_results or len(key_results) == 0:
        raise SystemExit("No GPG keys were provided for signing")
    primary_gpg_key_id, primary_gpg_key_name = key_results[0]
    secondary_gpg_key_id = None
    secondary_gpg_key_name = None
    if len(key_results) > 1:
        secondary_gpg_key_id, secondary_gpg_key_name = key_results[1]

    if args.gpg_private_key_2:
        print(f"signing RPM with secondary gpg_key: {secondary_gpg_key_id}")
        pkg_creator.import_rpm_key(args.gpg_public_key_2)
    else:
        print(f"signing RPM with primary gpg_key: {primary_gpg_key_name}")
        pkg_creator.import_rpm_key(args.gpg_public_key)


    pkg_uploader = PkgUploader(args.account, args.bucket, args.id, args.secret)
    print(f"signing deb with primary gpg_key: {primary_gpg_key_id} and secondary gpg_key: {secondary_gpg_key_id}")
    create_deb_packaging(
        pkg_creator,

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Provide the primary GPG private/public key pair via --gpg-private-key and --gpg-public-key (base64-encoded).
2. Check that the CI secrets backing the flags are set and non-empty at runtime.
3. Fail earlier with an argparse-required argument or explicit validation so the message includes which flags are missing.
4. If signing is optional, add a flag to skip signing instead of passing empty key values.

Example fix

// before
parser.add_argument("--gpg-private-key")
// after
parser.add_argument("--gpg-private-key", required=True, help="base64-encoded GPG private key")

if not (args.gpg_private_key and args.gpg_public_key):
    parser.error("--gpg-private-key and --gpg-public-key are required for signing")

try:
    key_results = import_multiple_gpg_keys(priv, pub, priv2, pub2)
except SystemExit as e:
    logging.error("signing setup aborted: %s", e)
    raise

When it happens

Trigger: Running the script without any of --gpg-private-key/--gpg-public-key (and the optional secondary pair) so import_multiple_gpg_keys returns [], or all provided key values are empty strings filtered out upstream.

Common situations: CI workflows where the GPG key secrets were not injected (empty env vars), the argument parsing maps missing flags to None and the importer silently skips them, or a misconfigured job matrix omitting the signing inputs.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Failed to import private key
• Could not find imported key with fingerprint {imported_finge
• cloudflared tunnel rule expects a single argument, the URL t
• the argument path must be a directory
• empty application token

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/48941e8d33b2cd09. Report an issue: GitHub.