Encryption failed since using gnupg 2.4.6

[tgahlx]

Since updating gnupg to version 2.4.6 im running into issues encrypting files:

sops -config <(echo '') -p "2D9C02C141E431440967DC2FCFD3CFB204DFE3A4,AFBF1D117711A320237188E01BAD6AF828FAD313,BE4C9994FBDEDCBD1DC86B131F6A002C95B97600,25990EFEC2C2F3921DC6B9CF5DF43EAF02617DD3,C8245450FD461ED8FB027650B5C3F797130957A4,62BECF87673CD34B8076E48835201C980537683E" -e environment/dev/secrets.sops-dec.env > environment/dev/secrets.enc.env
Could not generate data key: [failed to encrypt new data key with master key "AFBF1D117711A320237188E01BAD6AF828FAD313": could not encrypt data key with PGP key: github.com/ProtonMail/go-crypto/openpgp error: key with fingerprint 'AFBF1D117711A320237188E01BAD6AF828FAD313' is not available in keyring; GnuPG binary error: failed to encrypt sops data key with pgp

changing the order of keys shows a different message:

sops -config <(echo '') -p "AFBF1D117711A320237188E01BAD6AF828FAD313,BE4C9994FBDEDCBD1DC86B131F6A002C95B97600,25990EFEC2C2F3921DC6B9CF5DF43EAF02617DD3,C8245450FD461ED8FB027650B5C3F797130957A4,62BECF87673CD34B8076E48835201C980537683E,2D9C02C141E431440967DC2FCFD3CFB204DFE3A4" -e environment/dev/secrets.sops-dec.env > environment/dev/secrets.enc.env
Could not generate data key: [failed to encrypt new data key with master key "2D9C02C141E431440967DC2FCFD3CFB204DFE3A4": could not encrypt data key with PGP key: github.com/ProtonMail/go-crypto/openpgp error: key with fingerprint '2D9C02C141E431440967DC2FCFD3CFB204DFE3A4' is not available in keyring; GnuPG binary error: failed to encrypt sops data key with pgp

I've tested with sops versions 2.8.1 and 2.9.1.

I'm not sure whats causing this issue.

Downgrading gnupg to 2.4.6 mitigates the issue.

[tgahlx]

seems to be fixed with gnupg 2.4.7

https://dev.gnupg.org/source/gnupg/browse/STABLE-BRANCH-2-4/NEWS

might be the interesting change:

• gpg: Avoid a failure exit code for expired ultimately trusted keys. [T7351]

[felixfontein]

Ah, good to know. I took a quick look at this issue some days ago, but I already had gnupg 2.4.7 installed, and couldn't reproduce the issue. I didn't had time yet to try out 2.4.6... I'm glad this is now resolved.