passbolt/passbolt_api · error · Cake\Core\Exception\CakeException

Could not sign the text.

Error message

Could not sign the text. 

What it means

GnuPG backend failure in Gnupg::sign: the gpg sign call threw or returned false after the sign-key assertion passed, meaning cleartext signing failed at the backend level (e.g. unusable sign key) and a CakeException is raised.

Solutions

1. Check the appended gnupg message for the exact agent/key error
2. Verify the secret key exists: gpg --list-secret-keys <signFingerprint>
3. Re-import a passphrase-less private key or ensure the same passphrase setup as when it was added
4. Fix GNUPGHOME ownership/permissions (700, owned by PHP user) and ensure gpg-agent is running

Example fix

// before
$gpg->setSignKey($fingerprintOfPublicOnlyKey);
$signed = $gpg->sign($text); // CakeException: Could not sign the text. ...
// after
$gpg->setSignKey($fingerprintWithSecretKeyInKeyring);
$signed = $gpg->sign($text);

$fp = $gpg->getSignKeyFingerprint();
$secretKeys = (string) shell_exec("gpg --homedir $homedir --list-secret-keys --with-colons $fp");
if (!str_contains($secretKeys, 'sec')) {
    throw new RuntimeException("Sign key $fp has no secret key in keyring");
}

try {
    $signed = $gpg->sign($text);
} catch (CakeException $e) {
    $this->log('Signing failed: ' . $e->getMessage());
    throw new SigningException('Server cannot sign with the configured key.', 0, $e);
}

When it happens

Trigger: sign($text) where $this->_gpg->sign($text) throws: sign key fingerprint not in keyring, private key passphrase-protected, or gpg-agent cannot access the secret key.

Common situations: Server private key re-imported with a passphrase; keyring homedir permissions wrong so gpg-agent can't read the secret key; sign fingerprint config points to a key only present as public; headless environment lacking gpg-agent socket.

Related errors

• A value for the theme should be provided.
• Decryption failed.
• The anonymous user id should be a UUID
• The OpenPGP server key defined in the config cannot be used…
• This is not a valid setting.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/92a044087f46c9a9. Report an issue: GitHub.

Appendix: source

Thrown at src/Utility/OpenPGP/Backends/Gnupg.php:459

    /**
     * Sign a text.
     *
     * @param string $text plain text to be signed.
     * @throws \Cake\Core\Exception\CakeException if no key was set to sign
     * @throws \Cake\Core\Exception\CakeException if there is an issue with the key to sign
     * @return string signed text
     */
    public function sign(string $text): string
    {
        $msg = __('Could not sign the text. ');
        $this->assertSignKey();
        try {
            /** @var string|false $signedText */
            $signedText = $this->_gpg->sign($text);
            $this->clearSignKeys();
        } catch (Exception $e) {
            $this->clearSignKeys();
            throw new CakeException($msg . ' ' . $e->getMessage(), null, $e);
        }
        if ($signedText === false) {
            throw new CakeException($msg);
        }

        return $signedText;
    }

    /**
     * Removes all keys which were set for decryption before
     *
     * @return void
     */
    public function clearDecryptKeys(): void
    {
        $this->_decryptKeyFingerprint = null;
        $this->_gpg->cleardecryptkeys();
    }

View on GitHub (pinned to 31c1bbc10f)