Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 941770 - Failure to verify just-signed binpkgs should be more verbose
Summary: Failure to verify just-signed binpkgs should be more verbose
Status: CONFIRMED
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Binary packages support (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 945384
  Show dependency tree
 
Reported: 2024-10-18 15:43 UTC by Sam James
Modified: 2024-11-29 23:59 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-10-18 15:43:38 UTC
Failure to verify just-signed binpkgs gives pretty poor output:
```
make[1]: Leaving directory '/var/tmp/portage/net-libs/libtirpc-1.3.5/work/libtirpc-1.3.5-abi_x86_64.amd64'
 * Final size of build directory: 5040 KiB (4.9 MiB)
 * Final size of installed tree:   796 KiB
!!! Invalid binary package: '/data/binpkgs/net-libs/libtirpc/libtirpc-1.3.5-2.gpkg.tar.15655', GPG verify failed
```

We should make this more verbose. It's also confusing for people because this is the scenario where we *just* made a binpkg, seemingly signed it fine, but are using another keyring to verify it and then falling over.

(This usually happens when the keyring in /etc/portage/gnupg - used for verification - doesn't have ultimate trust for the signing keyring that is usually in /root/.gnupg).
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-10-18 15:47:24 UTC
We should also add some output indicating that we successfully made a signature.