The check for 'BAD' in the output of gpg can lead to wrong results. There is at least one dev key containing BAD in the fingerprint. ,-- | if output.find("BAD") != -1: '-- ,-- | gpg: Good signature from "Gustavo Zacarias (Ebuild Signing) <gustavoz@gentoo.org>" | Primary key fingerprint: D51B E7C5 5499 0363 50E3 5D68 291C BAD1 7184 7092 '-- ^^^
Created attachment 76433 [details, diff] Hopefully a search that won't catch valid keys :) Runnings strings on the binary gives you 'BAD signature from "%s"' So we change the find("BAD") to find(" BAD ") which won't hit a valid key ( all keys are split into 4 character pieces ). Alternatively, find a better way to do this because parsing output sucks, but this should work for now assuming there is a " " in front of BAD like there is in the Good Signature message.
For output parsing have a look at the status-fd option and /usr/share/doc/gnupg-*/DETAILS.gz (also better than using exit status) For example good signature from the 'BAD' key and a good signature from an expired key: gpg --status-fd 1 --verify /usr/portage/portage/app-admin/denyhosts/Manifest gpg: Signature made Fr 06 Jan 2006 15:54:13 CET using DSA key ID 71847092 [GNUPG:] SIG_ID lamZorAiSpTS55Fnl/+QaGk/enM 2006-01-06 1136559253 [GNUPG:] GOODSIG 291CBAD171847092 Gustavo Zacarias (Ebuild Signing) <gustavoz@gentoo.org> gpg: Good signature from "Gustavo Zacarias (Ebuild Signing) <gustavoz@gentoo.org>" [GNUPG:] VALIDSIG D51BE7C55499036350E35D68291CBAD171847092 2006-01-06 1136559253 0 3 0 17 2 01 D51BE7C55499036350E35D68291CBAD171847092 [GNUPG:] TRUST_UNDEFINED gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: D51B E7C5 5499 0363 50E3 5D68 291C BAD1 7184 7092 gpg --status-fd 1 -verify /usr/portage/portage/sci-calculators/equate/Manifest gpg: Signature made Do 03 Nov 2005 02:31:44 CET using DSA key ID 4BB5F4CA [GNUPG:] KEYEXPIRED 1134607289 [GNUPG:] SIGEXPIRED deprecated-use-keyexpired-instead [GNUPG:] KEYEXPIRED 1134607289 [GNUPG:] SIGEXPIRED deprecated-use-keyexpired-instead [GNUPG:] SIG_ID HNhhuP6d8AcGtswkhgFzK0f8vrE 2005-11-03 1130981504 [GNUPG:] KEYEXPIRED 1134607289 [GNUPG:] SIGEXPIRED deprecated-use-keyexpired-instead [GNUPG:] EXPKEYSIG 8082A5F14BB5F4CA Mike Frysinger (Key for signing Gentoo related stuff) <vapier@gentoo.org> gpg: Good signature from "Mike Frysinger (Key for signing Gentoo related stuff) <vapier@gentoo.org>" [GNUPG:] VALIDSIG 69CE126AFD19DC7669A19E118082A5F14BB5F4CA 2005-11-03 1130981504 0 3 0 17 2 01 69CE126AFD19DC7669A19E118082A5F14BB5F4CA gpg: Note: This key has expired! Primary key fingerprint: 69CE 126A FD19 DC76 69A1 9E11 8082 A5F1 4BB5 F4CA
tove, you game for attempting the mod? The portage_gpg code is a bit icky, would like to see it refactored a bit. Cleanup would rock; the "BAD"->" BAD " solves the issue, but it still is possible to get false positives.
I agree with torsten that we should be checking status-fd. I'll revisit this code soon.
FEATURES="gpg" was completely removed from Portage SVN recently, so I guess this bug can be closed.
The old FEATURES=gpg support has been removed in svn r11698 and r11699. In the future we will implement the function differently, as mentioned here: http://archives.gentoo.org/gentoo-portage-dev/msg_8d867c110b99e3562736907fa0864877.xml
