What causes "Can not verify without a key. Set a verification key first." in passbolt/passbolt_api?

Call setVerifyKey() with the sender's public key fingerprint before verifying.

passbolt/passbolt_api · error · Cake\Core\Exception\CakeException

Can not verify without a key. Set a verification key first.

Error message

Can not verify without a key. Set a verification key first.

What it means

assertVerifyKey() is a precondition check for signature verification in OpenPGPCommonAssertsTrait. It throws a CakeException when _verifyKeyFingerprint is empty, since GnuPG needs to know which public key to verify a signature against.

Solutions

Call setVerifyKey() with the sender's public key fingerprint before verifying.
Make sure the corresponding public key is also imported into the keyring.
Check the bootstrap/config path that should populate the verification key actually runs in this context.

Example fix

// before
$isValid = $gpg->verify($signedMessage); // throws: no verify key
// after
$gpg->setVerifyKey($senderFingerprint);
$isValid = $gpg->verify($signedMessage);

Defensive patterns

Strategy: type-guard

Validate before calling

if (empty($gpg->getVerifyKeyFingerprint())) {
    $gpg->setVerifyKey($senderFingerprint);
}

Type guard

function canVerify($gpg): bool {
    return isset($gpg) && !empty($gpg->getVerifyKeyFingerprint());
}

Try / catch

try {
    $ok = $gpg->verify($message);
} catch (\Cake\Core\Exception\CakeException $e) {
    if (str_contains($e->getMessage(), 'verify without a key')) {
        $gpg->setVerifyKey($senderFingerprint);
        $ok = $gpg->verify($message);
    } else { throw $e; }
}

Prevention

Set verification keys in the same bootstrap that handles decryption/signing.
Keep sender fingerprints in configuration or the database, never hardcode in call sites.
Write an integration test that verifies a signed fixture in CI.

When it happens

Trigger: Calling verify() (or code that invokes assertVerifyKey) on an instance where setVerifyKey() was never called or was passed an empty value, leaving _verifyKeyFingerprint empty.

Common situations: Verifying incoming signed payloads (e.g. server-signed responses) without first setting the sender's public key fingerprint; test setups skipping key initialization; wiring a new verification path that bypasses the shared key-setup helper.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/21ebc00b10a404d1. Report an issue: GitHub.

Appendix: source

Thrown at src/Utility/OpenPGP/Traits/OpenPGPCommonAssertsTrait.php:81

     * @return void
     */
    public function assertSignKey(): void
    {
        if (empty($this->_signKeyFingerprint)) {
            throw new CakeException('Can not sign without a key. Set a sign key first.');
        }
    }

    /**
     * Assert the verification key is set
     *
     * @throws \Cake\Core\Exception\CakeException if not signature key is set
     * @return void
     */
    public function assertVerifyKey(): void
    {
        if (empty($this->_verifyKeyFingerprint)) {
            throw new CakeException('Can not verify without a key. Set a verification key first.');
        }
    }

    /**
     * Check if an encryption key is set
     *
     * @throws \Cake\Core\Exception\CakeException if no encryption key is set
     * @return void
     */
    public function assertEncryptKey(): void
    {
        if (empty($this->_encryptKeyFingerprint)) {
            throw new CakeException('Can not encrypt without a key. Set a public key first.');
        }
    }

    /**
     * Check if a decrypt key is set

View on GitHub (pinned to 31c1bbc10f)