| Summary: | app-crypt/gnupg: --refresh-keys fails if ipv6 is not supported (was: app-portage/gemato, sys-apps/portage: emerge --sync fails on verification) | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Xavier Miller (RETIRED) <xaviermiller> |
| Component: | Current packages | Assignee: | Kristian Fiskerstrand (RETIRED) <k_f> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | alexander, anton.kochkov, bertrand, burcheri.massimo+bugs-gentoo, crypto+disabled, dev-portage, gentoo, herrtimson, mgorny, polynomial-c, rzubaly, sam, viklevin2 |
| Priority: | Normal | Keywords: | UPSTREAM |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: |
https://github.com/mgorny/gemato/issues/3 https://dev.gnupg.org/T3331 https://bugs.gentoo.org/show_bug.cgi?id=779766 |
||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 646934 | ||
| Bug Blocks: | |||
| Attachments: | 0001-dirmngr-Handle-failures-related-to-missing-IPv6-grac.patch | ||
This is clearly a bug in gpg. Neither gemato nor gentoo-keys force ipv6 in any way. I believe upstream's response is that it is a misconfigured system if you encounter this, so ipv6 should either be disabled system-wide using net.ipv6.conf.all.disable_ipv6 = 1 or disable-ipv6 in dirmngr. See https://dev.gnupg.org/T3331 for discussion, including some of my comments from august 2017. I added a /etc/dirmngr/dirmngr.conf file with "disable-ipv6" Now it syncs and checks the contents :) sent 32.20K bytes received 5.47M bytes 579.05K bytes/sec total size is 224.33M speedup is 40.78 INFO:root:Refreshing keys from keyserver... INFO:root:Keys refreshed. INFO:root:Manifest timestamp: 2018-01-31 11:08:16 UTC INFO:root:Valid OpenPGP signature found: INFO:root:- primary key: DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D INFO:root:- subkey: E1D6ABB63BFCFB4BA02FDF1CEC590EEAC9189250 INFO:root:- timestamp: 2018-01-31 11:08:16 UTC INFO:root:Verifying /usr/portage... INFO:root:/usr/portage verified in 51.75 seconds === Sync completed for gentoo For gemato, one way is to add dirmngr.conf to the temporary homedir created in line 185 on in gemato/openpgp.py with disable-ipv6 , that would ensure proper run without impacting user/system configuration Created attachment 517256 [details, diff]
0001-dirmngr-Handle-failures-related-to-missing-IPv6-grac.patch
Here's the patch I came up with. It's trivial, and it fixes the issues when IPv6 is enabled via procfs for me. The other 'case' should cover the case of it being disabled in kernel but I'd appreciate if one of you could test it.
Please note that GnuPG chooses between different IP addresses randomly, so you may need to bash it for a while to get it to fail ;-). You may do something like 'killall dirmngr; strace -ff gpg --refresh-keys |& less' to verify if it tried to use IPv6 during the test.
Thanks Michał for the patch. I also had "Address family not supported by protocol" error when IPv6 address was selected. I have no IPV6 in kernel so there is no /proc/sys/net/ipv6 to disabled_ipv6 to begin with. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b580348546711590c0152a8371e3cf00393b4720 commit b580348546711590c0152a8371e3cf00393b4720 Author: Kristian Fiskerstrand <k_f@gentoo.org> AuthorDate: 2018-02-07 20:42:38 +0000 Commit: Kristian Fiskerstrand <k_f@gentoo.org> CommitDate: 2018-02-07 20:42:38 +0000 app-crypt/gnupg: Add fix for missing IPv6 stack Bug: https://bugs.gentoo.org/646194 Package-Manager: Portage-2.3.19, Repoman-2.3.6 ...r-Handle-failures-related-to-missing-IPv6.patch | 31 +++++ app-crypt/gnupg/gnupg-2.2.4-r2.ebuild | 130 +++++++++++++++++++++ 2 files changed, 161 insertions(+)} The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9cdccbb4f67a6e3586df619a689ee9a7306ffe7d commit 9cdccbb4f67a6e3586df619a689ee9a7306ffe7d Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-02-07 21:34:58 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-02-07 21:38:56 +0000 sys-apps/portage: Require app-crypt/gnupg with IPv6 fix Depend on >=app-crypt/gnupg-2.2.4-r2 to avoid failing verification on systems that are missing an IPv6 stack. More importantly, this ensures that we will not stabilize Portage before that version of GnuPG. Bug: https://bugs.gentoo.org/646194 sys-apps/portage/{portage-2.3.24.ebuild => portage-2.3.24-r1.ebuild} | 2 +- sys-apps/portage/portage-9999.ebuild | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)} GnuPG is fixed now, and Portage has appropriate deps. I guess that's all to be done here. I have same error again:
# eix-sync
* Running emerge --sync
>>> Syncing repository 'gentoo' into '/usr/portage'...
* Using keys from /usr/share/openpgp-keys/gentoo-release.asc
* Refreshing keys from keyserver ...OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: General error
OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: General error
Installed version is:
app-crypt/gnupg-2.2.4-r2
(In reply to Tomas Rusnak from comment #10) > I have same error again: > > # eix-sync > * Running emerge --sync > >>> Syncing repository 'gentoo' into '/usr/portage'... > * Using keys from /usr/share/openpgp-keys/gentoo-release.asc > * Refreshing keys from keyserver ...OpenPGP keyring refresh failed: > gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net > gpg: keyserver refresh failed: General error > > OpenPGP keyring refresh failed: > gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net > gpg: keyserver refresh failed: General error > > Installed version is: > app-crypt/gnupg-2.2.4-r2 The root cause may not be exactly the same as the IPV6 issue fixed in app-crypt/gnupg/gnupg-2.2.4-r2, so please open a new bug report. Actually I have a cron job that showed the "General error" today. The cron job runs every 30 minutes, with lots of retry just like emerge, and a cron email was sent 5 Jul 2018 19:55:42 +0000 (UTC). (In reply to Zac Medico from comment #12) > Actually I have a cron job that showed the "General error" today. The cron > job runs every 30 minutes, with lots of retry just like emerge, and a cron > email was sent 5 Jul 2018 19:55:42 +0000 (UTC). I'd still prefer a separate bug for it, in particular one that includes dirmngr log (dirmngr.conf: log-file /path/to/file.log\ndebug-level guru) and gpgconf --kill dirmngr Before I found this ticket I created https://dev.gnupg.org/T4817 . Even with --disable-ipv6 it doesn't work. Any other workaround? The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=9268a92b9666eaaf263999b18220c0d56d8c476c commit 9268a92b9666eaaf263999b18220c0d56d8c476c Author: Sam James <sam@gentoo.org> AuthorDate: 2023-08-13 04:36:04 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-08-17 06:52:55 +0000 sync: rsync, git: respect --debug for gemato Respect --debug and pass it down to gemato so we get nice debugging output when e.g. 'refreshing keys' is stuck. Bug: https://bugs.gentoo.org/646194 Bug: https://bugs.gentoo.org/647696 Bug: https://bugs.gentoo.org/691666 Bug: https://bugs.gentoo.org/779766 Bug: https://bugs.gentoo.org/873133 Bug: https://bugs.gentoo.org/906875 Bug: https://github.com/projg2/gemato/issues/7 Bug: https://github.com/projg2/gemato/issues/25 Signed-off-by: Sam James <sam@gentoo.org> lib/portage/sync/modules/git/git.py | 15 +++++++++++++-- lib/portage/sync/modules/rsync/rsync.py | 11 +++++++++-- lib/portage/sync/syncbase.py | 12 ++++++++---- 3 files changed, 30 insertions(+), 8 deletions(-) |
sent 31.50K bytes received 4.29M bytes 665.51K bytes/sec total size is 224.29M speedup is 51.85 INFO:root:Refreshing keys from keyserver... Traceback (most recent call last): File "/usr/lib/python-exec/python2.7/gemato", line 11, in <module> load_entry_point('gemato==10.3', 'console_scripts', 'gemato')() File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 403, in setuptools_main sys.exit(main(sys.argv)) File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 398, in main return vals.func(vals, argp) File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 62, in do_verify env.refresh_keys() File "/usr/lib64/python2.7/site-packages/gemato/openpgp.py", line 219, in refresh_keys raise RuntimeError('Unable to refresh keys: {}'.format(err.decode('utf8'))) RuntimeError: Unable to refresh keys: gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net gpg: keyserver refresh failed: Address family not supported by protocol q: Updating ebuild cache in /usr/portage ... q: Finished 37364 entries in 0.230601 seconds Action: sync for repo: gentoo, returned code = 1 # emerge --info Portage 2.3.21 (python 2.7.14-final-0, default/linux/amd64/17.1/no-multilib, gcc-7.3.0, glibc-2.26-r5, 4.15.0-gentoo x86_64) ================================================================= System uname: Linux-4.15.0-gentoo-x86_64-Intel-R-_Celeron-R-_2957U_@_1.40GHz-with-gentoo-2.4.1 KiB Mem: 3960520 total, 1927428 free KiB Swap: 4194300 total, 4163324 free Timestamp of repository gentoo: Wed, 31 Jan 2018 08:00:01 +0000 Head commit of repository gentoo: 1a223c0614db81eee1220f4766837a1e2ebc76cc sh bash 4.4_p12-r1 ld GNU gold (Gentoo 2.29.1 p3 2.29.1) 1.14 distcc 3.2rc1 x86_64-pc-linux-gnu [disabled] app-shells/bash: 4.4_p12-r1::gentoo dev-lang/perl: 5.26.1-r1::gentoo dev-lang/python: 2.7.14-r1::gentoo, 3.5.4-r1::gentoo dev-util/cmake: 3.10.2::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.4.1-r2::gentoo sys-apps/openrc: 0.34.11::gentoo sys-apps/sandbox: 2.12::gentoo sys-devel/autoconf: 2.69-r4::gentoo sys-devel/automake: 1.15.1-r1::gentoo sys-devel/binutils: 2.29.1-r1::gentoo, 2.30::gentoo sys-devel/gcc: 7.3.0::gentoo sys-devel/gcc-config: 1.9.1::gentoo sys-devel/libtool: 2.4.6-r4::gentoo sys-devel/make: 4.2.1-r1::gentoo sys-kernel/linux-headers: 4.15::gentoo (virtual/os-headers) sys-libs/glibc: 2.26-r5::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-openpgp-key-path: /var/lib/gentoo/gkeys/keyrings/gentoo/release/pubring.gpg sync-rsync-verify-metamanifest: yes sync-rsync-extra-opts: local location: /usr/local/portage/overlay masters: gentoo priority: 0 gentoo-kodi-overlay location: /usr/local/portage/gentoo-kodi-overlay masters: gentoo priority: 1 proaudio location: /var/lib/layman/proaudio masters: gentoo priority: 50 xmw location: /var/lib/layman/xmw masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="@FREE as-is freedist" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=core2 -mcx16 -msahf -mpclmul -mpopcnt -msse4.2 --param l1-cache-size=32 --param l1-cache-line-size=64 --param l2-cache-size=256 -mtune=core2 -fomit-frame-pointer -O2" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.1/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=core2 -mcx16 -msahf -mpclmul -mpopcnt -msse4.2 --param l1-cache-size=32 --param l1-cache-line-size=64 --param l2-cache-size=256 -mtune=core2 -fomit-frame-pointer -O2" DISTDIR="/var/portage/distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps y --quiet-build=n --buildpkg" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg candy config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="fr_BE.utf8" LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--hash-style=gnu -Wl,--as-needed" LINGUAS="fr fr_FR fr_BE nl nl_NL nl_BE" MAKEOPTS="-j5 -l2" PKGDIR="/var/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="acpi amd64 bmp branding bzip2 cli crossdev crypt cups cxx dbus dlna dri gif iconv jpeg jpeg2k mmx modules ncurses nls nptl openmp pcre pdf png readline sane scanner seccomp sqlite sse2 sse4_1 sse4_2 ssl ssse3 svg tcpd threads tiff unicode upnp xattr zlib" ABI_X86="64" ALSA_CARDS="hda-intel usb-audio virmidi" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" L10N="fr nl" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LIRC_DEVICES="ftdi" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-0" POSTGRES_TARGETS="postgres9_5" PYTHON_SINGLE_TARGET="python3_5" PYTHON_TARGETS="python2_7 python3_5" QEMU_USER_TARGETS="arm" RUBY_TARGETS="ruby23" SANE_BACKENDS="hp" USERLAND="GNU" VIDEO_CARDS="dummy" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS