Bug 13749 - locked baskets suffer from multiple repeats of password dialogs (works ok when downgrading libgpgme11 to mga3 version)
Summary: locked baskets suffer from multiple repeats of password dialogs (works ok whe...
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL: https://bugs.kde.org/show_bug.cgi?id=...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-15 23:38 CEST by Dieter Rogiest
Modified: 2015-10-27 06:55 CET (History)
2 users (show)

See Also:
Source RPM: basket
CVE:
Status comment:


Attachments

Description Dieter Rogiest 2014-07-15 23:38:34 CEST
Description of problem:
For me the most used/useful function of Basket Note Pads is to be able to lock a basket with a password/passphrase (where I can put personal items, secrets, some login credentials, etc.).
After upgrading my Mageia 3 to Mageia 4 I could not open in Basket Note Pads a locked basket (luckily before upgrading I had exported its contents after having similar problems from Mag2 to Mag3) and I also could not remove that locked basket. Then I found the solution to remove it in the source code (I had to remove the hidden file /home/vatbier/kde4/share/apps/basket/baskets/basket20/.basket).
But then I noticed that in Mageia 4 entering the password/passphrase and confirming it has to happen for every file that's in the directory of the basket:so for each notexx.html, .basket and the eventual .basket~ (left behind from editing .basket with vi).
Also when unlocking an encrypted basket the passphrase was also asked for all files of the directory of the basket.
The source of Basket Note Pads hadn't changed since Mageia 3 and the dialog to enter the passphrase is called pinentry-qt4 (in Mageia 3 I remembered that dialog was something else).
I noticed that every time when I clicked on a note of an encrypted basket that I had to re-enter the passphrase for all files of the directory of the basket.
And if I then clicked on another basket then again I had to enter passphrase for all files of the encrypted basket so I guessed that everytime you touch or leave an encrypted basket everything of it gets re-saved.
I downloaded basket-1.81-5.mga4.src.rpm and extracted it with mc.
With vi(m) I looked/stumbled through the source files (most of it I can not understand):
I went from bnpview.cpp at BNPView::password() to 
password.cpp at PasswordDlg::type() to 
PasswordEncryption in basketview.cpp at BasketView::setProtection 
from where I went to BasketView::saveAgain() where I found "Re-encrypt basket file" and "Re-encrypt every note files recursively" 
which led to BasketView::save() where a QDomDocument with basket and notes gets written to disk 
which led to BasketView::saveToFile
where I saw
m_gpg->setText(i18n("Please assign a password to the basket <b>%1</b>:", basketName()), true); // Used when defining a new password
success = m_gpg->encrypt(array, length, &tmp, key)
(but that "Please assign a password..." you don't see in the pinentry-qt4 dialog)
and from there I found
m_gpg = new KGpgMe();
which led to kgpgme.cpp at KGpgMe::encrypt where I saw several "gpgme" commando's like gpgme_op_encrypt
Then searching in rpmdrake for "gpgme" I found two installed packages:
libgpgme++2
libgpgme11
I then downloaded the Mageia 3 versions for these packages
When trying "urpme libgpgme++2" I saw in the warning list of dependable packages also dependency libqgpgme.so.1 so I also downloaded the Mageia 3 version for libqgpgme1.
Then i uninstalled one of them:
rpm -e --nodeps libgpgme++2
and installed the Mag3 version:
urpmi libgpgme++2-4.10.2-4.mga3.i586.rpm
Basket Note Pads still had multiple passphrase bug
so I re-installed the Mag4 version again by:
rpm -e --nodeps libgpgme++2
urpmi libgpgme++2
Then I tried to uninstall another:
urpme libqgpgme1 (to look at the dependencies)
rpm -e --nodeps libqgpgme1
urpmi libqgpgme1-4.10.2-4.mga3.i586.rpm
Also here in Basket Note Pads still the bug
rpm -e --nodeps libqgpgme1
urpmi libqgpgme1
Then I tried the last one:
urpme libgpgme11
this one has 41 dependencies: akregator, basket, kaddressbook, kalarm, kdepim4, kjots, kleopatra, kmail, knode, knotes, kontact, korganizer, ktimetracker, seahorse, ...
rpm -e --nodeps libgpgme11
urpmi libgpgme11-1.3.2-2.mga3.i586.rpm
AND SUCCESS: 
Basket Note Pads now shows a different dialog to add a password to a basket called "Please enter a password" with "Please assign a password to the basket ttt"
and it doesnt ask to re-enter again as a confirmation and it only ask it once for the whole basket!
And at unlocking the basket also only once the password is asked!
Since Mageia 3 I do not longer use kmail but use the webmail of my ISP. But what other programs might break now that I'm using an older version of libgpgme11 ?
And every time there are updates I have to unselect libgpgme11-1.4.3-2.mga4 or it would install over the mga3 version.
So the newer version of libgpgme11 of Mag4 (together with its use of pinentry-qt4) breaks usage of encrypted baskets.
I've made a bug report at bugs.kde.org https://bugs.kde.org/show_bug.cgi?id=337481 (I created this bug report as I cannot re-open bug 155079).
I'll also create a bug report at the site of libgpgme11.

Version-Release number of selected component (if applicable):
libgpgme11-1.4.3-2.mga4 triggers bug in Basket Note Pads
older version of Mageia 3 libgpgme11-1.3.2-2.mga3.i586.rpm makes Basket Note Pads work again in Mageia 4



Reproducible: 

Steps to Reproduce:
Thierry Vignaud 2014-07-17 15:43:41 CEST

CC: (none) => dmorganec
Source RPM: (none) => basket

Thierry Vignaud 2014-07-17 15:49:52 CEST

URL: (none) => https://bugs.kde.org/show_bug.cgi?id=337481
CC: (none) => thierry.vignaud
Summary: Basket Note Pads in Mag4: locked baskets suffer from multiple repeats of password dialogs - with workaround => locked baskets suffer from multiple repeats of password dialogs (works ok when downgrading libgpgme11 to mga3 version)

Comment 1 Samuel Verschelde 2015-09-21 13:18:25 CEST
Mageia 4 changed to end-of-life (EOL) status on 2015-09-19. It is is no longer 
maintained, which means that it will not receive any further security or bug 
fix updates.

Package Maintainer: If you wish for this bug to remain open because you plan to 
fix it in a currently maintained version, simply change the 'version' to a later 
Mageia version.

Bug Reporter: Thank you for reporting this issue and we are sorry that we weren't 
able to fix it before Mageia 4's end of life. If you are able to reproduce it 
against a later version of Mageia, you are encouraged to click on "Version" and 
change it against that version of Mageia. If it's valid in several versions, 
select the highest and add MGAxTOO in whiteboard for each other valid release.
Example: it's valid in cauldron and Mageia 5, set to cauldron and add MGA5TOO.

Although we aim to fix as many bugs as possible during every release's lifetime, 
sometimes those efforts are overtaken by events. Often a more recent Mageia 
release includes newer upstream software that fixes bugs or makes them obsolete.

If you would like to help fixing bugs in the future, don't hesitate to join the
packager team via our mentoring program [1] or join the teams that fit you 
most [2].

[1] https://wiki.mageia.org/en/Becoming_a_Mageia_Packager
[2] http://www.mageia.org/contribute/
Comment 2 Marja Van Waes 2015-10-27 06:55:53 CET
As announced over a month ago, Mageia 4 changed to end-of-life (EOL) status on 2015-09-19. It is is no longer maintained, which means that it will not receive any further security or bug fix updates.

This issue may have been fixed in a later Mageia release, so, if you still see it and didn't already do so: please upgrade to Mageia 5 (or, if you read this much later than this is written: make sure you run a currently maintained Mageia version)

If you are able to reproduce it against a maintained version of Mageia, you are encouraged to 
1. reopen this bug report, by changing the "Status" from "RESOLVED - OLD" to "REOPENED"
2. click on "Version" and change it against that version of Mageia. If you know it's valid in several versions, select the highest and add MGAxTOO in whiteboard for each other valid release.
Example: it's valid in cauldron and Mageia 5, set to cauldron and add MGA5TOO.
3. give as much relevant information as possible. If you're not an experienced bug reporter and have some time: please read this page:
https://wiki.mageia.org/en/How_to_report_a_bug_properly

If you see a similar issue, but are _not_sure_ it is the same, with the same cause, then please file a new bug report and mention this one in it (please include the bug number, too). 


If you would like to help fixing bugs in the future, don't hesitate to join the
packager team via our mentoring program [1] or join the teams that fit you 
most [2].
[1] https://wiki.mageia.org/en/Becoming_a_Mageia_Packager
[2] http://www.mageia.org/contribute/

Status: NEW => RESOLVED
Resolution: (none) => OLD


Note You need to log in before you can comment on or make changes to this bug.