Bug 21036

Summary: gnupg2 states that it is a development version not suitable for use with production keys
Product: Mageia Reporter: Buchan Milne <bgmilne>
Component: RPM PackagesAssignee: All Packagers <pkg-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: release_blocker CC: cae, marja11, ngompa13, pterjan
Version: Cauldron   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: gnupg2-2.1.21-1.mga6.src.rpm CVE:
Status comment:

Description Buchan Milne 2017-06-06 22:14:22 CEST
Description of problem:

Run any gpg2 command, and you get a warning as follows:

NOTE: THIS IS A DEVELOPMENT VERSION!
It is only intended for test purposes and should NOT be
used in a production environment or with production keys!

This doesn't put confidence in the security of the distribution (e.g. if the first thing I do after installation is verify the signatures of the hashes of the ISOs I just installed from).

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Install
2. Log in
3. Start terminal emulator
4. Run gpg2 --version (or any other gpg2 command)


See https://dev.gnupg.org/rG39e551985d74d6ee9a87bde1c32ecdd1433c00cf for when this was introduced.

We are triggering it by running ./autogen.sh in a non-git checkout which is resulting in the configure script using a version string indicating it is a beta release.

We should either:
- Not run ./autogen.sh if not necessary
- Patch autogen.sh to indicate it was stable and use the RPM release as the additional version information.

Patch coming ....
Comment 1 Buchan Milne 2017-06-06 22:20:58 CEST
With this patch:

--- gnupg-2.1.21/autogen.sh.orig        2017-03-17 10:34:37.000000000 +0200
+++ gnupg-2.1.21/autogen.sh     2017-06-06 21:24:21.624726814 +0200
@@ -245,8 +245,8 @@ if [ "$myhost" = "find-version" ]; then
       rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
     else
       ingit=no
-      beta=yes
-      tmp="-unknown"
+      beta=no
+      tmp="-${RPM_PACKAGE_RELEASE:-unknown}"
       rev="0000000"
       rvd="0"
     fi


Building the package with running autogen.sh gives:
[root@localhost ~]# gpg2 --version
gpg (GnuPG) 2.1.21-1.mga6
libgcrypt 1.7.6
Copyright (C) 2017 Free Software Foundation, Inc.
....


Building the package without running autogen.sh gives:
[root@localhost ~]# gpg2 --version
gpg (GnuPG) 2.1.21
libgcrypt 1.7.6
Copyright (C) 2017 Free Software Foundation, Inc.
Comment 2 Marja Van Waes 2017-06-07 21:56:45 CEST
Assigning to all packagers collectively, since there is no registered maintainer for this package.

Priority: Normal => release_blocker
CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

Comment 3 Neal Gompa 2017-06-18 23:53:02 CEST
It looks like a fix was committed but we haven't pushed it? Is there a reason for this?

CC: (none) => ngompa13

Comment 4 Charles Edwards 2017-06-19 00:32:04 CEST
The pkg was submitted but failed on the buildsystem in %check

Makefile:928: recipe for target 'xcheck' failed
make[2]: *** [xcheck] Error 28
make[2]: Leaving directory '/home/iurt/rpmbuild/BUILD/gnupg-2.1.21/tests/openpgp'
Makefile:533: recipe for target 'check-recursive' failed
make[1]: *** [check-recursive] Error 1
make[1]: Leaving directory '/home/iurt/rpmbuild/BUILD/gnupg-2.1.21/tests'
Makefile:588: recipe for target 'check-recursive' failed
make: *** [check-recursive] Error 1
error: Bad exit status from /home/iurt/rpmbuild/tmp/rpm-tmp.lFgYcu (%check)


It did pass all test when Buchan built it locally and also built for me locally.

CC: (none) => cae

Comment 5 Neal Gompa 2017-06-19 00:33:59 CEST
The package fails to build in the buildsystem occasionally (Pascal posited that it might have to do with entropy requirements). Usually resubmitting fixes it. :/
Comment 6 Pascal Terjan 2017-06-19 20:11:59 CEST
For the entropy problems I ended up running rngd on arm build nodes (which had 100% failure) 


# Else some tests fail due to lack of entropy
rpm -q rng-utils || urpmi rng-utils
rngd -r /dev/urandom

Here the package fails with that error even on arm so it's unlikely to be the problem.

CC: (none) => pterjan

Comment 7 Pascal Terjan 2017-06-19 20:12:54 CEST
I just tried building locally in iurt and get the same failure
Comment 8 Pascal Terjan 2017-06-19 20:47:59 CEST
Disabling the patch, I get 100% success in iurt, enabling the patch I get 100% failure but no idea why.

The way to start a gpg-agent in %check is probably broken

++ ./agent/gpg-agent --use-standard-socket --daemon --write-env-file gpg-agent-info
gpg-agent[4488]: WARNING: "--use-standard-socket" is an obsolete option - it has no effect
gpg-agent[4488]: WARNING: "--write-env-file" is an obsolete option - it has no effect
gpg-agent[4488]: directory '/home/pterjan/.gnupg' created
gpg-agent[4488]: directory '/home/pterjan/.gnupg/private-keys-v1.d' created
gpg-agent[4489]: gpg-agent (GnuPG) 2.1.21-2.mga6 started
+ eval

modern way would probably be /agent/gpg-agent || ./agent/gpg-agent --daemon
Comment 9 Neal Gompa 2017-06-19 21:38:35 CEST
I just committed a patch from Fedora that fixes the build for me locally with mock and all the tests passing.
Comment 10 Neal Gompa 2017-06-20 04:56:00 CEST
This is now fixed with gnupg2-2.1.21-2.mga6.

Resolution: (none) => FIXED
Status: NEW => RESOLVED