#3028·gopass

Incomplete key comparison in clone

Author: 14mRh4X0rCreated Jan 3, 2025Updated Jun 3, 2026
Labelsbuggpg

Summary

On gopass clone with GPG, gopass checks whether we already have access to the cloned repository by comparing our usable keys to the keys listed in .gpg-id. However, this is a string comparison. While .gpg-id allows for any GPG-approved way to specify a key, gopass will use short form keys (e.g. 0x17F3ED51DADD9393) to compare.

Steps To Reproduce

  1. Have a repository with one of your keys in a non-short form in .gpg-id
  2. gopass clone the repository
  3. gopass will reply with "Please ask the owner of the password store to add one of your keys"

Expected behavior

In step 3: gopass will reply with "Found valid decryption keys. You can now decrypt your passwords."

Environment

  • OS: Arch Linux
  • OS version: Linux vischium 6.11.5-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue, 22 Oct 2024 18:31:38 +0000 x86_64 GNU/Linux
  • gopass Version: gopass 1.15.15 go1.23.3 linux amd64
  • Installation method: pacman