Incomplete key comparison in clone
Author: 14mRh4X0rCreated Jan 3, 2025Updated Jun 3, 2026
Labelsbuggpg
Summary
On gopass clone with GPG, gopass checks whether we already have access to the cloned repository by comparing our usable keys to the keys listed in .gpg-id. However, this is a string comparison. While .gpg-id allows for any GPG-approved way to specify a key, gopass will use short form keys (e.g. 0x17F3ED51DADD9393) to compare.
Steps To Reproduce
- Have a repository with one of your keys in a non-short form in
.gpg-id gopass clonethe repository- gopass will reply with "Please ask the owner of the password store to add one of your keys"
Expected behavior
In step 3: gopass will reply with "Found valid decryption keys. You can now decrypt your passwords."
Environment
- OS: Arch Linux
- OS version: Linux vischium 6.11.5-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue, 22 Oct 2024 18:31:38 +0000 x86_64 GNU/Linux
- gopass Version: gopass 1.15.15 go1.23.3 linux amd64
- Installation method: pacman
Source: gopasspw/gopass