secret unlocker add pgp without --keyid fails when gpg.conf sets a default-key, because gpgconf prefixes the value with a quote #141

New Issue

2026-10-13T00:30:19+02:00

clawbot commented

2026-10-13 00:30:19 +02:00

Severity: major. The documented default ("uses default key if not specified") fails for every user with default-key in gpg.conf.

What happens. getDefaultGPGKey runs gpgconf --list-options gpg and takes field 10 of the default-key line as the key ID. gpgconf encodes a string value with a leading " and percent-escaping (gpgconf(1), the "value" field), so the ID is "ABCD... and gpg rejects it.

# gpg.conf holds the line: default-key 56163D7F3FAFF709608855BEC1A360216D007F41
SB_UNLOCK_PASSPHRASE=x secret unlocker add pgp
# Using default GPG key: "56163D7F3FAFF709608855BEC1A360216D007F41
# Error: failed to resolve GPG key fingerprint: invalid GPG key ID: invalid GPG key ID format: "56163D7F...

Without default-key in gpg.conf the fallback (first secret key) works, and --keyid works.

Where.

		secret/internal/cli/unlockers.go
		Lines 76 to 78 in ef0ae90768
	
							if len(fields) > 9 && fields[0] == "default-key" && fields[9] != "" {

								// The default key is in field 10 (index 9)

								return fields[9], nil

.

Correct behaviour. --help and the README say the default GPG key is used when --keyid is not given. Decode the value as gpgconf documents it: drop the leading " and percent-decode.

Definition of done

With default-key set in gpg.conf, secret unlocker add pgp uses that key.
A unit test feeds a default-key:...:"KEYID line through the parser and fails before the fix.

Model: fable-5-1

Severity: major. The documented default ("uses default key if not specified") fails for every user with `default-key` in `gpg.conf`. **What happens.** `getDefaultGPGKey` runs `gpgconf --list-options gpg` and takes field 10 of the `default-key` line as the key ID. gpgconf encodes a string value with a leading `"` and percent-escaping (gpgconf(1), the "value" field), so the ID is `"ABCD...` and gpg rejects it. ``` # gpg.conf holds the line: default-key 56163D7F3FAFF709608855BEC1A360216D007F41 SB_UNLOCK_PASSPHRASE=x secret unlocker add pgp # Using default GPG key: "56163D7F3FAFF709608855BEC1A360216D007F41 # Error: failed to resolve GPG key fingerprint: invalid GPG key ID: invalid GPG key ID format: "56163D7F... ``` Without `default-key` in `gpg.conf` the fallback (first secret key) works, and `--keyid` works. **Where.** https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/unlockers.go#L76-L78. **Correct behaviour.** `--help` and the README say the default GPG key is used when `--keyid` is not given. Decode the value as gpgconf documents it: drop the leading `"` and percent-decode. **Definition of done** - With `default-key` set in `gpg.conf`, `secret unlocker add pgp` uses that key. - A unit test feeds a `default-key:...:"KEYID` line through the parser and fails before the fix. Model: fable-5-1

sneak was assigned by clawbot

2026-10-13 00:30:19 +02:00

clawbot referenced this issue

2026-10-13 01:17:13 +02:00

Finish 1.0 and tag it; after that, bugfixes only #131

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/secret#141

	if len(fields) > 9 && fields[0] == "default-key" && fields[9] != "" {
	// The default key is in field 10 (index 9)
	return fields[9], nil

secret unlocker add pgp without --keyid fails when gpg.conf sets a default-key, because gpgconf prefixes the value with a quote #141

`secret unlocker add pgp` without `--keyid` fails when gpg.conf sets a default-key, because gpgconf prefixes the value with a quote #141