passbolt/passbolt_api · error · ValidationException

This is not a valid setting.

Error message

This is not a valid setting.

What it means

Thrown in Gnupg::encrypt when sign-and-encrypt mode fails: either assertSignKey finds no sign key set, or gnupg_encryptsign() throws/returns false. The gnupg error text is appended in the exception case; the bare message is used when encryptsign returns false.

Solutions

1. Call setSignKey (or setSignKeyFromFingerprint) with the private key before encryptSign.
2. Read the appended gnupg exception message for the underlying gnupg error.
3. Verify both the sign key and the recipient encrypt key are valid and not expired.
4. Check the passphrase given at setSignKey time is correct.
5. Retry key setup if clearSignKeys() was called earlier in the same process.

Example fix

// before
$cipher = $gpg->encryptSign($text); // no sign key set
// after
$gpg->setSignKey($privateKey, $passphrase);
$gpg->setEncryptKey($recipientPublicKey);
$cipher = $gpg->encryptSign($text);

// ensure keys are set before sign+encrypt
if (!$gpg->isSignKeySet()) { // or track in your wrapper
    $gpg->setSignKey($privateKey, $passphrase);
}
$gpg->setEncryptKey($recipientPublicKey);

function ensureKeysReady(Gnupg $gpg): bool {
    return $gpg->isEncryptKeySet() && $gpg->isSignKeySet();
}

try {
    $cipher = $gpg->encryptSign($text);
} catch (\Cake\Core\Exception\Exception $e) {
    $this->log('encryptsign failed: ' . $e->getMessage());
    throw new EncryptionException(previous: $e);
}

When it happens

Trigger: Calling encryptSign/encrypt with $sign=true without having called setSignKey/setSignKeyFromFingerprint first, or with a sign key that gnupg rejects during encryptsign (passphrase, missing secret), or gnupg returning false.

Common situations: Forgetting key setup in a long-lived worker after clearSignKeys(); expired signing key mid-operation; encryptsign failing because the encrypt key in keyring is invalid.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• A value for the theme should be provided.
• Could not sign the text.
• Could not use the key to encrypt.
• The metadata could not be encrypted with the user id: .
• The anonymous user id should be a UUID

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1b1c7761d91c139f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/AccountSettings/src/Model/Table/AccountSettingsTable.php:214

    {
        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user identifier should be a valid UUID.'));
        }

        $settingFinder = ['user_id' => $userId, 'property_id' => $this->propertyToPropertyId($property)];
        $settingValues = ['value' => $value, 'property' => $property];
        /** @var \Passbolt\AccountSettings\Model\Entity\AccountSetting|null $settingItem */
        $settingItem = $this->find()
            ->where($settingFinder)
            ->first();

        if ($settingItem) {
            $this->patchEntity($settingItem, $settingValues);
        } else {
            $settingItem = $this->newEntity(array_merge($settingFinder, $settingValues));
        }
        if ($settingItem->getErrors()) {
            throw new ValidationException(__('This is not a valid setting.'), $settingItem, $this);
        }
        if (!$this->save($settingItem)) {
            if ($settingItem->getErrors()) {
                throw new ValidationException(__('This is not a valid setting.'), $settingItem, $this);
            }
            throw new InternalErrorException('Could not save the setting, please try again later.');
        }

        return $settingItem;
    }

    /**
     * Delete an entry for a given user and property
     *
     * @param string $userId user uuid
     * @param string $property user property
     * @return bool
     */

View on GitHub (pinned to 31c1bbc10f)