From 88fd2124ff0a410d3cbca1780954e499d1f94f7f Mon Sep 17 00:00:00 2001 From: Michael Kriese Date: Wed, 15 May 2024 13:43:49 +0200 Subject: [PATCH] docs(config): add note about GnuPG v2.4 usage (#29067) Co-authored-by: Rhys Arkins Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> --- docs/usage/self-hosted-configuration.md | 26 +++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md index b96039d95cb794..297be8da6eb406 100644 --- a/docs/usage/self-hosted-configuration.md +++ b/docs/usage/self-hosted-configuration.md @@ -929,6 +929,32 @@ uid Renovate Bot sub rsa4096 2021-09-10 [E] ``` + +!!! note + If you use GnuPG `v2.4` (or newer) to generate the key, then you must disable `AEAD` preferences. + This is needed to allow Renovate to decrypt the encrypted values. + +```bash +❯ gpg --edit-key renovate@whitesourcesoftware.com +gpg> showpref +[ultimate] (1). Renovate Bot + Cipher: AES256, AES192, AES, 3DES + AEAD: OCB, EAX + Digest: SHA512, SHA384, SHA256, SHA224, SHA1 + Compression: ZLIB, BZIP2, ZIP, Uncompressed + Features: MDC, AEAD, Keyserver no-modify + +gpg> setpref AES256 AES192 AES 3DES SHA512 SHA384 SHA256 SHA224 SHA1 ZLIB BZIP2 ZIP +Set preference list to: + Cipher: AES256, AES192, AES, 3DES + AEAD: + Digest: SHA512, SHA384, SHA256, SHA224, SHA1 + Compression: ZLIB, BZIP2, ZIP, Uncompressed + Features: MDC, Keyserver no-modify +Really update the preferences? (y/N) y +gpg> save +``` + - Copy the key ID from the output (`794B820F34B34A8DF32AADB20649CEXAMPLEONLY` in the above example) or run `gpg --list-secret-keys` if you forgot to take a copy