Multiline keygen doesn't appear to work with GnuPG 2.4.1
Generating keys per these instructions fails in deployment with the following error reconciling the BB template kustomization:
- lastTransitionTime: "2023-06-14T20:13:24Z"
message: |-
decryption failed for 'common-bb-htt5fdf727': failed to decrypt and format 'bigbang/common-bb-htt5fdf727' Secret data: cannot get sops data key: Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
BFCE24471D057189431051F46C2B2C3650B9A7D2: FAILED
- | failed to decrypt sops data key with pgp: gpg: encrypted
| with RSA key, ID 4E78D0864A4EF31F
| gpg: decryption failed: No secret key
This key works with sops on host (macOS, brew'd sops 3.7.3 and gnupg 2.4.1).
When exec'd in kustomize-controller, it's possible to watch the sops environment build, and catch the keyfile in private-keys-v1.d; it gets created with the correct keygrip:
> gpg -K --with-keygrip bigbang-dev-environment
sec rsa4096 2023-06-14 [SCEAR]
BFCE24471D057189431051F46C2B2C3650B9A7D2
Keygrip = 71B318C5184F2672D9C32929447F810A817F0E8C
uid [ultimate] bigbang-dev-environment (bigbang-dev-environment)
ssb rsa4096 2023-06-14 [SEAR]
Keygrip = DBA8A5C3AD40E3AEAEFA421F8125D8B161045540
./sops-gnupghome-2283077354/private-keys-v1.d/71B318C5184F2672D9C32929447F810A817F0E8C.key
Re-keying with a new key generated with the same keyparams on GnuPG 2.2.20 works.