Bug 18748 - Some ssh-askpass packages don't purge invalid old paths.
Summary: Some ssh-askpass packages don't purge invalid old paths.
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: All Packagers
QA Contact:
URL:
Whiteboard:
Keywords:
: 18458 (view as bug list)
Depends on: 18458
Blocks:
  Show dependency treegraph
 
Reported: 2016-06-21 06:50 CEST by Raphael Gertz
Modified: 2020-08-23 15:21 CEST (History)
8 users (show)

See Also:
Source RPM: seahorse, openssh-askpass-qt4-1.0.1-9.mga6.src.rpm
CVE:
Status comment:


Attachments
Installation paths and scripts in Mageia 6 (2.43 KB, text/plain)
2017-08-11 11:09 CEST, Hartmut Goebel
Details

Description Raphael Gertz 2016-06-21 06:50:17 CEST
Description of problem:
In package openssh-askpass-common-7.2p2-2.mga6 these files set SSH_ASKPASS :
/etc/profile.d/90ssh-askpass.csh:setenv SSH_ASKPASS /usr/libexec/openssh/ssh-askpass
/etc/profile.d/90ssh-askpass.sh:export SSH_ASKPASS=/usr/libexec/openssh/ssh-askpass

But the path to alternative file is invalid.

It should be :
/usr/lib64/ssh/ssh-askpass

$ sudo urpmi openssh-askpass-7.2p2-2.mga6.x86_64
    http://mirrors.mageia.org/api/mageia.cauldron.x86_64.list: media/core/release/openssh-askpass-7.2p2-2.mga6.x86_64.rpm
installation de openssh-askpass-7.2p2-2.mga6.x86_64.rpm depuis /var/cache/urpmi/rpms                                                                                                                                                                                                                                                
Préparation...                   ###############################################
      1/1: openssh-askpass       ###############################################
le lien primaire pour ssh-askpass doit être /usr/lib64/ssh/ssh-askpass

Then if u try to use git for example it fail to start ask-pass :
# LC_ALL=C git push
error: cannot run /usr/libexec/openssh/ssh-askpass: No such file or directory
Password for 'http://user@git.example.com':

Version-Release number of selected component (if applicable):
openssh-askpass-common-7.2p2-2.mga6

How reproducible:
Always

Steps to Reproduce:
1. Install git-core
2. Install openssh-askpass-qt4|openssh-askpass-gnome|openssh-askpass
3. Try to push to a auth basic repository
4. Error instead of ssh-askpass spawning
Comment 1 Raphael Gertz 2016-06-21 07:01:41 CEST
The other way would be to move the files of openssh-askpass-qt4 :
/usr/lib64/ssh/ssh-askpass
/usr/lib64/ssh/qt4-ssh-askpass

To /usr/libexec/openssh/

As well as the alternative.

As it seems to be only openssh-askpass-qt4 that puts files in there.

openssh-askpass puts it in :
/usr/libexec/openssh/x11-ssh-askpass

openssh-askpass-gnome puts it in :
/usr/libexec/openssh/gnome-ssh-askpass

Well confirmed it's a bug with openssh-askpass-qt4 which put the files in the wrong directory if installed alone.
Raphael Gertz 2016-06-21 07:02:33 CEST

Source RPM: openssh-7.2p2-2.mga6.src.rpm => openssh-askpass-qt4-1.0.1-9.mga6.src.rpm

Comment 2 Marja Van Waes 2016-06-21 10:12:36 CEST
(In reply to Raphael Gertz from comment #1)

> 
> Well confirmed it's a bug with openssh-askpass-qt4 which put the files in
> the wrong directory if installed alone.

Thanks.

So I assigned this issue to the wrong package in bug 18458.

Therefore not closing this bug report as duplicate of that one, since this report is better.

Assigning to all packagers collectively, since there is no maintainer for openssh-askpass-qt4

Blocks: (none) => 18458
Assignee: bugsquad => pkg-bugs
CC: (none) => marja11

Johnny A. Solbu 2016-06-22 02:07:00 CEST

CC: (none) => cooker

Marja Van Waes 2016-06-22 10:10:12 CEST

Depends on: (none) => 18458
Blocks: 18458 => (none)

Comment 3 Raphael Gertz 2016-06-28 02:45:45 CEST
*** Bug 18458 has been marked as a duplicate of this bug. ***
Comment 4 Raphael Gertz 2016-06-28 03:25:06 CEST
I fixed the package, if you don't remove it add an errata that openssh-askpass-qt4 package should be installed / reinstalled if it was installed before.
Comment 5 Raphael Gertz 2016-06-28 03:26:00 CEST
I fixed the package, if you don't remove it add an errata that openssh-askpass-qt4 package should be installed / reinstalled if it was installed before.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 6 Bit Twister 2016-06-28 22:53:40 CEST
(In reply to Raphael Gertz from comment #5)
> I fixed the package, if you don't remove it add an errata that
> openssh-askpass-qt4 package should be installed / reinstalled if it was
> installed before.

Seems the package might need some more fixing, see bug 18812.

CC: (none) => bittwister2

Comment 7 Johnny A. Solbu 2016-06-29 15:30:38 CEST
The problem seems to be resolved by Uninstalling openssh-askpass-common which will remove openssh-askpass-qt4 and reinstalling openssh-askpass-qt4. That fixed it for me.
Comment 8 Johnny A. Solbu 2017-07-20 18:41:33 CEST
And it's back.
THis time reinstalling it did not help.

$ ssh solbu@kodi 
Last login: Thu Jul 20 18:01:23 2017 from X.X
 * Error: Problem adding; giving up

cat /etc/profile.d/90ssh-askpass.sh 
export SSH_ASKPASS=/usr/libexec/openssh/ssh-askpass

LC_ALL=C ls -lh /usr/libexec/openssh/ssh-askpass
ls: cannot access '/usr/libexec/openssh/ssh-askpass': No such file or directory

Version: Cauldron => 6
Resolution: FIXED => (none)
Status: RESOLVED => REOPENED

Comment 9 Charles Edwards 2017-07-20 22:25:46 CEST
Are you sure that you did not attempt the login Before you reinstalled
openssh-askpass-qt4?

I've tried on my system and I cannot duplicate 

Install openssh-askpass-qt4, set it as default using alternatives.
/usr/libexec/openssh/ssh-askpass is created|linked to /usr/libexec/openssh/qt4-ssh-askpass

rpm -e openssh-askpass-qt4 and the link /usr/libexec/openssh/ssh-askpass is deleted.

Reinstall openssh-askpass-qt4 and /usr/libexec/openssh/ssh-askpass is created
linking to /usr/libexec/openssh/qt4-ssh-askpass


During the short period when /usr/libexec/openssh/ssh-askpass was deleted none of the other ssh-askpass agents I have would function unless I 1st ran alternatives which would create the /usr/libexec/openssh/ssh-askpass link.

CC: (none) => cae

Comment 10 Johnny A. Solbu 2017-07-21 00:47:44 CEST
(In reply to Charles Edwards from comment #9)
> Are you sure that you did not attempt the login Before you reinstalled
> openssh-askpass-qt4?

Yes. I uninstalled and reinstalled it twice, and logged in again. It still did not work.

Somehow doing it again now works. I have no idea why.

> rpm -e openssh-askpass-qt4 and the link /usr/libexec/openssh/ssh-askpass is
> deleted.
> 
> Reinstall openssh-askpass-qt4 and /usr/libexec/openssh/ssh-askpass is created
> linking to /usr/libexec/openssh/qt4-ssh-askpass

But this should allready be done as part of upgrading Mageia.
I should not need to uninstall and reinstall it after upgrading. I had to do the same dance when I upgraded all my systems to Mageia 5, two years ago.
Comment 11 Charles Edwards 2017-07-21 01:32:34 CEST
I've still got my original Mga5 drive that I cloned and used to test Mga6 upgrades.
I'll make another clone and set it up to use askpass and then upgrade it to Mga6
and see what happens.

Will try it this weekend and hope it gives me more clues.
Comment 12 Raphael Gertz 2017-07-21 12:33:21 CEST
Last time I debugged this problem, it was caused by 3rd party package that placed the ask-pass symlink in an other path than /usr/libexec/openssh/

Please list all relevant symlink and destination in /etc/alternatives/*(ssh|askpass)*

Same for /usr/libexec/openssh/, /usr/lib/ssh/ and /usr/lib64/ssh/.

Package versions before (rpm -qa)

And listing after.

If package didn't changed there should still be a upgrade trigger that try to fix the paths as best as possible.

Please make sure you did all mga5 update before upgrading.

It's unlikely it comes from this package, but if you can provide me a mga5 package list + file state + mga6 package list we can make sure it don't comes from here.
Comment 13 Johnny A. Solbu 2017-07-21 15:09:32 CEST
(In reply to Raphael Gertz from comment #12)
> Last time I debugged this problem, it was caused by 3rd party package that
> placed the ask-pass symlink in an other path than /usr/libexec/openssh/
> 
> Please list all relevant symlink and destination in
> /etc/alternatives/*(ssh|askpass)*

On the upgraded mga6 system
==
ls -lh /etc/alternatives/*{ssh,askpass}*
lrwxrwxrwx 1 root root 36 juli  21 00:42 /etc/alternatives/bssh-askpass -> /usr/libexec/openssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 36 juli  21 00:42 /etc/alternatives/bssh-askpass -> /usr/libexec/openssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 36 juli  21 00:42 /etc/alternatives/ssh-askpass -> /usr/libexec/openssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 36 juli  21 00:42 /etc/alternatives/ssh-askpass -> /usr/libexec/openssh/qt4-ssh-askpass*
==

On my main mga5 system:
==
ls -lh /etc/alternatives/*{ssh,askpass}*
lrwxrwxrwx 1 root root 30 aug.   1  2015 /etc/alternatives/bssh-askpass -> /usr/lib64/ssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 30 aug.   1  2015 /etc/alternatives/bssh-askpass -> /usr/lib64/ssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 30 aug.   1  2015 /etc/alternatives/ssh-askpass -> /usr/lib64/ssh/qt4-ssh-askpass*
lrwxrwxrwx 1 root root 30 aug.   1  2015 /etc/alternatives/ssh-askpass -> /usr/lib64/ssh/qt4-ssh-askpass
==

> Same for /usr/libexec/openssh/, /usr/lib/ssh/ and /usr/lib64/ssh/.

On the upgraded mga6 system:
==
LC_ALL=C ls -lh {/usr/libexec/openssh/,/usr/lib/ssh/,/usr/lib64/ssh/}
ls: cannot access '/usr/lib/ssh/': No such file or directory
/usr/lib64/ssh/:
total 0

/usr/libexec/openssh/:
total 928K
-rwxr-xr-x 1 root root  25K Jun 29  2016 qt4-ssh-askpass*
-rwxr-xr-x 1 root root  99K Apr  2 16:26 sftp-server*
lrwxrwxrwx 1 root root   29 Jul 21 00:42 ssh-askpass -> /etc/alternatives/ssh-askpass*
-rws--x--x 1 root root 443K Apr  2 16:26 ssh-keysign*
-rwxr-xr-x 1 root root 353K Apr  2 16:26 ssh-pkcs11-helper*
==

On a mga5 system:
==
LC_ALL=C ls -lh {/usr/libexec/openssh/,/usr/lib/ssh/,/usr/lib64/ssh/}
ls: cannot access /usr/libexec/openssh/: No such file or directory
ls: cannot access /usr/lib/ssh/: No such file or directory
/usr/lib64/ssh/:
total 832K
-rwxr-xr-x 1 root root  25K Oct 16  2014 qt4-ssh-askpass*
-rwxr-xr-x 1 root root  83K Aug 11  2016 sftp-server*
lrwxrwxrwx 1 root root   29 Aug 15  2015 ssh-askpass -> /etc/alternatives/ssh-askpass*
-rws--x--x 1 root root 443K Aug 11  2016 ssh-keysign*
-rwxr-xr-x 1 root root 275K Aug 11  2016 ssh-pkcs11-helper
==

> Package versions before (rpm -qa)
> 
> And listing after.
> 
> If package didn't changed there should still be a upgrade trigger that try
> to fix the paths as best as possible.
> 
> Please make sure you did all mga5 update before upgrading.
> 
> It's unlikely it comes from this package, but if you can provide me a mga5
> package list + file state + mga6 package list we can make sure it don't
> comes from here.

Here is the RPM transaction from the log during the upgrade, which lists the relevant package versions before and after install.
(The upgrade was done in the terminal, using «urpmi --auto-update», and completed at about 14:27:05.)

==
journalctl --since yesterday|grep askpass
juli 20 14:01:12 kodi [RPM][28329]: erase openssh-askpass-qt4-1.0.1-8.mga5.x86_64: success
juli 20 14:01:12 kodi [RPM][28329]: erase openssh-askpass-common-6.6p1-5.9.mga5.x86_64: success
juli 20 14:01:16 kodi [RPM][28329]: install openssh-askpass-common-7.5p1-2.mga6.x86_64: success
juli 20 14:01:24 kodi [RPM][28329]: install openssh-askpass-qt4-1.0.1-12.mga6.x86_64: success
juli 20 14:01:33 kodi [RPM][28329]: erase openssh-askpass-qt4-1.0.1-8.mga5.x86_64: success
juli 20 14:01:34 kodi [RPM][28329]: erase openssh-askpass-common-6.6p1-5.9.mga5.x86_64: success
juli 20 14:01:42 kodi [RPM][28329]: install openssh-askpass-common-7.5p1-2.mga6.x86_64: success
juli 20 14:01:42 kodi [RPM][28329]: install openssh-askpass-qt4-1.0.1-12.mga6.x86_64: success
juli 20 14:09:55 kodi [RPM][28329]: install openssh-askpass-qt5-2.0.3-1.mga6.x86_64: success
juli 20 14:10:08 kodi [RPM][28329]: install openssh-askpass-qt5-2.0.3-1.mga6.x86_64: success
==
Comment 14 Raphael Gertz 2017-07-21 17:46:43 CEST
It seems everything went well with your upgrade, is there still a problem ?
Comment 15 Johnny A. Solbu 2017-07-22 02:40:38 CEST
(In reply to Raphael Gertz from comment #14)
> It seems everything went well with your upgrade, is there still a problem ?

Not as of now, but that is /Not/ the point. 
The problem was that it did not work after upgrade. I had to reinstall openssh-askpass several times to get it working. The upgrade broke it.

It is the upgrade that breaks it. The installation completes just fine, it just does a bad job configuring alternatives, or writing the script files, which is owned by openssh-askpass-common, which again comes from the openssh Source package.

The profile scripts /etc/profile.d/90ssh-askpass.{sh,csh} points to the wrong location after upgrade.

Se comment #8 and the initial bug post.
Comment 16 Hartmut Goebel 2017-08-09 11:43:35 CEST
I strongly assume this is *not* an update-issue – even if it worked in Mag5 and does not work in Mag6. Instead I assume some packages are not packaged consistently, esp. the alternatives mechanism

Installed on my system are:
- openssh-askpass-common-7.5p1-2.mga6
- openssh-askpass-7.5p1-2.mga6
- seahorse-3.20.0-3.mga6

/etc/profile.d/90ssh-askpass.sh (from openssh-askpass-common) unconditionally sets
   SSH_ASKPASS=/usr/libexec/openssh/ssh-askpass

The installed packages include (relevant files only):
- openssh-askpass: /usr/libexec/openssh/x11-ssh-askpass
- seahorse: /usr/lib64/seahorse/seahorse-ssh-askpass

Differences between Mageia 5 and Magaia 6:
* seahorse postinstall scriptlet:
  - Mageia 5:
     update-alternatives --install /usr/lib64/ssh/ssh-askpass ssh-askpass …
  - Mageia 6:
     update-alternatives --install /usr/libexec/openssh/ssh-askpass ssh-askpass …

On Mageia 6:
  $ urpme seahorse openssh-askpass  # on first try
  …
  /usr/lib64/seahorse/seahorse-ssh-askpass has not been configured as
  an alternative for ssh-askpass
  /usr/libexec/openssh/x11-ssh-askpass has not been configured as
  an alternative for ssh-askpass

  $ urpmi openssh-askpass seahorse
  …
  the primary link for ssh-askpass must be /usr/lib64/ssh/ssh-askpass
  …
  the primary link for ssh-askpass must be /usr/lib64/ssh/ssh-askpass

  $ urpme seahorse openssh-askpass  # on second try
  …
  failed to read link /usr/lib64/ssh/ssh-askpass: No such file or directory
  failed to read link /usr/lib64/ssh/ssh-askpass: No such file or directory

CC: (none) => h.goebel

Comment 17 Raphael Gertz 2017-08-09 12:55:35 CEST
Hi,

If I read right, the problem comes from seahorse package who miss the fix I did on upgrade in this package.

It create ssh-askpass alternative in the wrong directory :
/usr/lib64/ssh/

Instead of the correct :
/usr/libexec/openssh/ssh-askpass

Please duplicate my upgrade trigger in seahorse package so it fix the path on upgrade.

Summary : the problem is not with this package which fix what it can, it comes from seahorse package which require the same fix.

Best regards
Comment 18 Marja Van Waes 2017-08-09 13:28:11 CEST
In reply to comment #16 and comment #17 :

CC'ing Philippem, who last touched seahorse (which doesn't have a registered maintainer). He might be willing & have time to help.

Source RPM: openssh-askpass-qt4-1.0.1-9.mga6.src.rpm => seahorse, openssh-askpass-qt4-1.0.1-9.mga6.src.rpm
CC: (none) => makowski.mageia

Comment 19 Johnny A. Solbu 2017-08-11 07:42:40 CEST
(In reply to Raphael Gertz from comment #17)
> If I read right, the problem comes from seahorse package who miss the fix I
> did on upgrade in this package.
> 
> It create ssh-askpass alternative in the wrong directory :
> /usr/lib64/ssh/
> 
> Instead of the correct :
> /usr/libexec/openssh/ssh-askpass
> 
> Please duplicate my upgrade trigger in seahorse package so it fix the path
> on upgrade.
> 
> Summary : the problem is not with this package which fix what it can, it
> comes from seahorse package which require the same fix.

Please note that I have never had seahorse installed on any of my systems.
Comment 20 Hartmut Goebel 2017-08-11 11:09:56 CEST
Created attachment 9582 [details]
Installation paths and scripts in Mageia 6

Notable findings:

1. In mga5, openshh was build with --libexecdir=%{_libdir}/ssh [1], whereas
   in mga6 is is now build with    --libexecdir=%{_libexecdir}/openssh [2]

2. In mga6 all packages updating alternatives (so don't do this) run
   the proper commands for this.

3. Only openssh-askpass-qt4 contains a script to "Purge invalid path"
   on upgrade [3]. This script removes entries pointing to
   %{_libdir}/ssh. The other packages are missing this script.

   While I first thought, this is the key to the problem, I'm afraid
   it is not: When upgrading, the '%postun' script of the old package
   is run, removing the old entries, see [4]. But maybe there is some
   combination avoiding a correct cleanup (a 5. below)

4. On my system, after upgrade from mga5 to mga6, the alternative for
   "ssh-askpass" still expects 

     $ cat /var/lib/alternatives/ssh-askpass 
     auto
     /usr/lib64/ssh/ssh-askpass

     /usr/lib64/ssh/x11-ssh-askpass
     10

5. I uninstalled seahorse and openssh-askpass (which gave the errors
   mentioned in earlier comments). The alternatives are still here:

     $ cat /var/lib/alternatives/ssh-askpass 
     auto
     /usr/lib64/ssh/ssh-askpass

     /usr/lib64/ssh/x11-ssh-askpass
     10

   Now I tried to remove the whole entry, which failed:

     # LC_ALL=C update-alternatives --remove-all ssh-askpass
     failed to read link /usr/lib64/ssh/ssh-askpass: No such file or directory

   and /var/lib/alternatives/ssh-askpass still contains the outdated
   entries.

Proposed solution:

A. The packages missing the "Purge invalid path" script
   (openssh-askpass, openssh-askpass-gnome, seahorse), should be
   updated to purge teh ols paths. This might not completly solve the
   probelm, but help.

B. "update-alternatives --remove" and "update-alternatives
   --remove-all" should remove the entries even if the link is
   missing.


[1] http://svnweb.mageia.org/packages/updates/5/openssh/releases/6.6p1/5.mga5/SPECS/openssh.spec?revision=825510&view=markup#l360
[2] http://svnweb.mageia.org/packages/cauldron/openssh/releases/7.5p1/2.mga6/SPECS/openssh.spec?revision=1095663&view=markup#l435
[3] http://svnweb.mageia.org/packages/cauldron/openssh-askpass-qt4/releases/1.0.1/12.mga6/SPECS/openssh-askpass-qt4.spec?revision=1038103&view=markup#l38
[4] https://fedoraproject.org/wiki/Packaging:Scriptlets#Ordering
Comment 21 Hartmut Goebel 2017-08-11 11:20:49 CEST
Workaround – the hard way:

# uninstall all of you "askpass" packages:
urpme openssh-askpass openssh-askpass-qt seahorse
# Remove erroneous files
rm -f /usr/lib64/ssh/ssh-askpass /etc/alternatives/ssh-askpass /var/lib/alternatives/ssh-askpass
# reinstall your "askpass" packages
urpmi openssh-askpass openssh-askpass-qt seahorse
# Verify
ls -l /usr/libexec/openssh/ssh-askpass /etc/alternatives/ssh-askpass
cat /var/lib/alternatives/ssh-askpass

Maybe this workaround should go into https://wiki.mageia.org/en/Mageia_6_Errata
Hartmut Goebel 2017-08-11 11:22:14 CEST

Summary: SSH_ASKPASS incorrectly set to /usr/libexec/openssh/ssh-askpass in /etc/profile.d/90ssh-askpass.{sh,csh} instead of /usr/lib64/ssh/ssh-askpass => Some ssh-askpass packages don't purge invalid old paths.

Hartmut Goebel 2017-08-11 11:22:50 CEST

Attachment 9582 description: Installation paths and script in Mageia 6 => Installation paths and scripts in Mageia 6

Angelo Naselli 2017-09-01 09:03:59 CEST

CC: (none) => anaselli

papoteur 2019-07-10 13:32:57 CEST

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=25089

Comment 22 Aurelien Oudelet 2020-08-23 15:21:45 CEST
Hi, thanks for reporting this bug.
We are sorry, but we no longer maintains this version of Mageia. Please upgrade to the latest version and reopen this bug against that version if this bug exists there.
As a result we are setting this bug to CLOSED:OLD

Resolution: (none) => OLD
Status: REOPENED => RESOLVED
CC: (none) => ouaurelien


Note You need to log in before you can comment on or make changes to this bug.