passbolt/passbolt_api · error · InternalErrorException

The anonymous user id should be a UUID

Error message

The anonymous user id should be a UUID

What it means

Thrown by Gnupg::setSignKey when gnupg_addsignkey() fails for the just-imported armored key. GnuPG refused to register the key as a signing key — usually the passphrase is wrong, or the key lacks a secret signing-capable primary/subkey. The gnupg exception message is appended.

Solutions

1. Verify the passphrase is correct.
2. Ensure the armored key is the private key and contains a signing-capable secret key/subkey.
3. Check key expiration/revocation with `gpg --list-keys`; extend or regenerate if expired.
4. Use gpg manually (`--sign` with the key) to isolate the gnupg-level cause.
5. Read the appended gnupg exception message for the exact error.

Example fix

// before
$gpg->setSignKey($publicArmoredKey, $pass); // cannot sign with public key
// after
$gpg->setSignKey($privateArmoredKey, $correctPass);

if (strpos($armoredKey, 'BEGIN PGP PRIVATE KEY BLOCK') === false) {
    throw new InvalidArgumentException('setSignKey requires a private (secret) key');
}

function isArmoredPrivateKey(string $s): bool {
    return is_string($s) && strpos($s, 'BEGIN PGP PRIVATE KEY BLOCK') !== false;
}

try {
    $gpg->setSignKey($key, $pass);
} catch (\Cake\Core\Exception\Exception $e) {
    $this->log('sign key rejected: ' . $e->getMessage());
    throw new ServerKeyConfigurationException(previous: $e);
}

When it happens

Trigger: Calling setSignKey($armoredKey, $passphrase) where import succeeds but addsignkey throws: wrong passphrase, public-only key, expired key, or key without signing capability.

Common situations: Configuring the server's public key instead of private for signing; passphrase mismatch after key rotation; expired/revoked server key; sign-only subkey stripped from an exported key.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• The OpenPGP server key defined in the config cannot be used…
• A value for the theme should be provided.
• Can not upgrade. Some tables are missing.
• Could not sign the text.
• The OpenPGP server key defined in the config cannot be used…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8f717b73d2571c02. Report an issue: GitHub.

Appendix: source

Thrown at config/Migrations/20200108135000_V2130DropLegacyAnonymousUser.php:34

use Migrations\AbstractMigration;
use Cake\Validation\Validation;
use Cake\Http\Exception\InternalErrorException;

class V2130DropLegacyAnonymousUser extends AbstractMigration
{
    /**
     * Up
     *
     * @return void
     */
    public function up()
    {
        // Some instances coming from v1 still have this unused user and should be dropped
        $user = $this->fetchRow("SELECT id from users where username='anonymous@passbolt.com'");
        if(isset($user['id'])) {
            $id = $user['id'];
            if (!Validation::uuid($id)) {
                throw new InternalErrorException('The anonymous user id should be a UUID');
            }
            $this->execute("DELETE from users where id='$id'");
            $this->execute("DELETE from gpgkeys where user_id='$id'");
            $this->execute("DELETE from profiles where user_id='$id'");
            $this->execute("DELETE from secrets where user_id='$id'");
            $this->execute("DELETE from authentication_tokens where user_id='$id'");
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)