What causes "The message cannot be verified." in passbolt/passbolt_api?

Check the message actually contains a PGP SIGNATURE / SIGNED MESSAGE block

passbolt/passbolt_api · error · Cake\Core\Exception\CakeException

The message cannot be verified.

Error message

The message cannot be verified.

What it means

Thrown when verify($signedText, $plainText) finds no signature or one whose fingerprint does not match the configured verify key ($this->_verifyKeyFingerprint set via setVerifyKey). It asserts the signed message was produced by the expected key.

Solutions

Check the message actually contains a PGP SIGNATURE / SIGNED MESSAGE block
Set the verify key to the fingerprint of the key that actually signed: setVerifyKey($signerFingerprint)
If the server key rotated, keep the old public key in the keyring and use its fingerprint for legacy verification
Inspect $signature[0]['fingerprint'] in a debug run to see who really signed

Example fix

// before
$gpg->setVerifyKey($serverFingerprint);
$sig = $gpg->verify($userSignedMessage); // fingerprint mismatch -> CakeException
// after
$gpg->setVerifyKey($userFingerprint);
$sig = $gpg->verify($userSignedMessage);

Defensive patterns

Strategy: try-catch

Validate before calling

if (!str_contains($signedText, '-----BEGIN PGP SIGNATURE-----') && !str_contains($signedText, '-----BEGIN PGP SIGNED MESSAGE-----')) {
    throw new InvalidArgumentException('Input is not a signed message');
}

Try / catch

try {
    $signature = $gpg->verify($signedText, $plainText);
} catch (CakeException $e) {
    $this->log('Verify failed: ' . $e->getMessage());
    throw new VerificationException('Message signature could not be validated.', 0, $e);
}

Prevention

Set the verify key to the actual signer's fingerprint before calling verify
Ensure signer public keys are imported in the keyring
Sanitize transport encoding so armored text is not corrupted
Keep previous server public keys when rotating for legacy verification

When it happens

Trigger: verify($signedText) where $this->_gpg->verify() returns empty, or $signature[0]['fingerprint'] !== $this->_verifyKeyFingerprint — message signed by another key, unsigned payload, or malformed signed text.

Common situations: Verifying a user-signed message against the server verify key; server key rotated so old signatures no longer match; passing an encrypted (not signed) message to verify.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/30608b3f03b5db0b. Report an issue: GitHub.

Appendix: source

Thrown at src/Utility/OpenPGP/Backends/Gnupg.php:432

    }

    /**
     * Verify a signed message.
     *
     * @param string $signedText The signed message to verify.
     * @param string|null $plainText (optional) if this parameter is passed, it will be filled with the plain text.
     * @return array signature information
     * @throws \Cake\Core\Exception\CakeException If the armored signed message cannot be verified.
     */
    public function verify(string $signedText, ?string &$plainText = null): array
    {
        $this->assertVerifyKey();
        $msg = __('The message cannot be verified.');
        try {
            /** @psalm-suppress InvalidArgument */
            $signature = $this->_gpg->verify($signedText, false, $plainText);
            if (empty($signature) || $signature[0]['fingerprint'] !== $this->_verifyKeyFingerprint) {
                throw new CakeException($msg);
            }

            return $signature;
        } catch (Exception $e) {
            throw new CakeException($msg . ' ' . $e->getMessage(), null, $e);
        }
    }

    /**
     * Sign a text.
     *
     * @param string $text plain text to be signed.
     * @throws \Cake\Core\Exception\CakeException if no key was set to sign
     * @throws \Cake\Core\Exception\CakeException if there is an issue with the key to sign
     * @return string signed text
     */
    public function sign(string $text): string
    {

View on GitHub (pinned to 31c1bbc10f)