What causes "$e->getMessage()" in passbolt/passbolt_api?

Read the printed exception message to identify the underlying failure (usually encryption or missing users).

$e->getMessage()

Error message

$e->getMessage()

What it means

GenerateDummyMetadataKeyCommand is a CakePHP console command that generates a dummy metadata key and encrypts it for all users via GenerateDummyMetadataKeyService::generate(). When generate() throws any Exception, the command prints the raw exception message to stderr and exits with a non-zero error code. The message shown to the user is whatever the underlying service threw, e.g. key generation or encryption failures.

Solutions

Read the printed exception message to identify the underlying failure (usually encryption or missing users).
Ensure at least one active user exists so the key can be encrypted for them.
Verify GnuPG/OpenPGP server configuration (gnupg keyring, passbolt server key) works: `ddev exec gpg --list-keys`.
Fix the underlying issue (users/config), then re-run the command with `--verbose` for detail.
If only investigating, run unit tests for GenerateDummyMetadataKeyService to reproduce.

Example fix

// before
$io->err($e->getMessage());
// after
$io->err('Failed to generate dummy metadata key: ' . $e->getMessage());
$io->err('Check that active users exist and GnuPG is configured.');

Defensive patterns

Strategy: try-catch

Validate before calling

// before running the command
$usersTable = \Cake\ORM\TableRegistry::getTableLocator()->get('Users');
if ($usersTable->find()->where(['deleted' => false])->count() === 0) {
    throw new \RuntimeException('No active users found; dummy metadata key cannot be encrypted for anyone.');
}

Type guard

function hasActiveUsers(): bool {
    return \Cake\ORM\TableRegistry::getTableLocator()->get('Users')
        ->find()->where(['deleted' => false])->count() > 0;
}

Try / catch

try {
    $key = (new GenerateDummyMetadataKeyService())->generate($verbose);
} catch (\Exception $e) {
    $io->err('Dummy metadata key generation failed: ' . $e->getMessage());
    return $this->errorCode();
}

Prevention

Ensure active users exist before generating dummy keys.
Validate GnuPG keyring and server key configuration regularly.
Use --verbose to capture diagnostics on failure.
Run the command only on dev/test instances, as intended.

When it happens

Trigger: Running `passbolt generate_dummy_metadata_key` (or the command class directly) when GenerateDummyMetadataKeyService::generate() fails — e.g. no users exist to encrypt the key for, OpenPGP key generation/encryption failure, or metadata plugin settings in an inconsistent state.

Common situations: Developers running the dummy-key command on a fresh instance with no users; environments with broken GnuPG/OpenPGP configuration; running against an org settings state that forbids metadata key generation.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/cc571f912059ccd0. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Command/GenerateDummyMetadataKeyCommand.php:60

    public function execute(Arguments $args, ConsoleIo $io): ?int
    {
        parent::execute($args, $io);

        if (!Configure::read('debug') || !Configure::read('passbolt.selenium.active')) {
            $io->out('Please enable DEBUG and PASSBOLT_SELENIUM_ACTIVE flags.');

            return $this->errorCode();
        }

        $verbose = false;
        if ($args->getOption('verbose')) {
            $verbose = true;
        }
        try {
            $key = (new GenerateDummyMetadataKeyService())->generate($verbose);
            $io->out('New key generated and encrypted for users: ' . $key->fingerprint);
        } catch (Exception $e) {
            $io->err($e->getMessage());

            return $this->errorCode();
        }

        return $this->successCode();
    }
}

View on GitHub (pinned to 31c1bbc10f)