Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 80044

Summary: gnupg-1.4.0-r2 crashed on built with file open error on secring.gpg
Product: Gentoo Linux Reporter: Nicolas Vilz <niv>
Component: Current packagesAssignee: Crypto team [DISABLED] <crypto+disabled>
Status: VERIFIED FIXED    
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: PPC   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---
Attachments: Workaround for gpg check failure with USE=selinux

Description Nicolas Vilz 2005-01-30 03:24:22 UTC
everytime I try to update gnupg, i get the following error messages: 

Making all in doc
make[2]: Entering directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/doc'
make  all-am
make[3]: Entering directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/doc'
make[3]: Nothing to be done for `all-am'.
make[3]: Leaving directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/doc'
make[2]: Leaving directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/doc'
Making all in checks
make[2]: Entering directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/checks'
echo '#!/bin/sh' >./gpg_dearmor
echo "../g10/gpg --no-options --no-greeting \
             --no-secmem-warning --batch --dearmor" >>./gpg_dearmor
chmod 755 ./gpg_dearmor
../tools/mk-tdata   500  >data-500
../tools/mk-tdata  9000  >data-9000
../tools/mk-tdata 32000  >data-32000
../tools/mk-tdata 80000  >data-80000
cat ./../doc/HACKING \
    ./../doc/DETAILS \
    ./../doc/FAQ         >plain-large
./gpg_dearmor > ./pubring.gpg < ./pubring.asc
./gpg_dearmor > ./secring.gpg < ./secring.asc
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/secring.gpg': file open error
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/pubring.gpg': file open error
make[2]: *** [pubring.gpg] Error 2
make[2]: *** Waiting for unfinished jobs....
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/secring.gpg': file open error
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/pubring.gpg': file open error
make[2]: *** [secring.gpg] Error 2
make[2]: Leaving directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0/checks'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/var/tmp/portage/gnupg-1.4.0-r2/work/gnupg-1.4.0'
make: *** [all] Error 2

!!! ERROR: app-crypt/gnupg-1.4.0-r2 failed.
!!! Function src_compile, Line 111, Exitcode 2
!!! (no error message)
!!! If you need support, post the topmost build error, NOT this status message.


Reproducible: Always
Steps to Reproduce:
1.emerge -u gnupg
2.
3.




pr0llb00k ~ # emerge -pv gnupg

These are the packages that I would merge, in order:

Calculating dependencies  ...done!
[ebuild     U ] app-crypt/gnupg-1.4.0-r2 [1.2.6] +bzip2* -caps -debug -ecc -idea
+ldap +nls +readline +selinux -smartcard +zlib 0 kB 

---

pr0llb00k ~ # emerge info   
Portage 2.0.51-r15 (selinux/2004.1/ppc, gcc-3.4.3, glibc-2.3.4.20041102-r0,
2.6.9-gentoo-r6 ppc)
=================================================================
System uname: 2.6.9-gentoo-r6 ppc 7410, altivec supported
Gentoo Base System version 1.6.8
Python:              dev-lang/python-2.3.4 [2.3.4 (#1, Sep 30 2004, 22:05:08)]
dev-lang/python:     2.3.4
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.9.4, 1.7.9-r1, 1.8.5-r3, 1.4_p6, 1.6.3, 1.5
sys-devel/binutils:  2.15.90.0.3-r4
sys-devel/libtool:   1.5.10-r4
virtual/os-headers:  2.4.22
ACCEPT_KEYWORDS="ppc ~ppc"
AUTOCLEAN="yes"
CFLAGS="-O2 -pipe -mcpu=7400 -maltivec -mabi=altivec -fno-strict-aliasing"
CHOST="powerpc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.2/share/config
/usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown
/usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -pipe -mcpu=7400 -maltivec -mabi=altivec -fno-strict-aliasing"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs autoconfig candy ccache cvs distlocks sfperms strict
userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://gentoo-distfiles.local.nil.nul/gentoo-portage"
USE="X aalib aim alsa altivec apache2 arts bash-completion berkdb bidi
bitmap-fonts bluetooth bonobo bzip2 cddb cdr cdrom cjk clamav crypt cups curl
dba directfb divx4linux dmx dvd dvdr dvdread eep escreen esd etwin fam fbcon fla
flac font-server foomaticdb ftp gd gdbm gif gimpprint gpm gtk gtk2 hardened
hardenedphp iconv icq imagemagick imap imlib ipv6 ipv6arpa irda irmc jabber jack
jack-tmpfs java jpeg junit ldap libwww maildir motif mozilla mpeg mpeg4 msn
mysql ncurses nethack nls odbc oggvorbis opengl oscar pam pcmcia pda perl php
png pnp postgres ppc ppds psyco pthreads python qt quicktime radeon readline
samba sdl selinux session slang soap spell sqlite ssl svg tcltk tcpd tetex tiff
truetype truetype-fonts type1 type1-fonts vhosts vim-with-x wmf xine xinerama
xml xml2 xmms xprint xsl xv xvid yahoo zlib"
Unset:  ASFLAGS, CBUILD, CTARGET, LANG, LC_ALL, LDFLAGS, PORTDIR_OVERLAY
Comment 1 Nicolas Vilz 2005-02-17 10:48:03 UTC
mh... problem still exists, sorry to disturb your sleep :)
Comment 2 Daniel Black (RETIRED) gentoo-dev 2005-02-17 12:55:01 UTC
does rm -rf /var/tmp/portage/*
and reemerging help?
Comment 3 Nicolas Vilz 2005-02-17 13:19:14 UTC
didn't change anything.. :/
Comment 4 Daniel Black (RETIRED) gentoo-dev 2005-02-18 03:16:49 UTC
what owner and permissions are on /var/tmp/portage/homedir/.gnupg/*ring.gpg?
Comment 5 Nicolas Vilz 2005-02-18 10:12:33 UTC
well, actually the .gnupg-dir doesn't exist after emerge fails. even after i copied my .gnupg-dir from a test-homedir, it doesn't exist after emerge fails.
Comment 6 Lars Weiler (RETIRED) gentoo-dev 2005-02-20 05:17:23 UTC
No problems here on ppc.  Probably you have a program open, that accesses the sec- and pubkeyring (like gpg-agent)?
Comment 7 Nicolas Vilz 2005-02-20 07:55:06 UTC
gnupg-agent _does_ access and probably block /var/tmp/homedir/.gnupg/*sec.key, which doesn't exist and which wasn't created during merge-time? and which doesn't exist anymore after i copied it, owned it to portage:portage and tried to merge gnupg ?

*shrug*

weired programs :)

I don't think so.
Comment 8 Jesse Throwe 2005-03-08 07:38:58 UTC
The issue is that gnupg expects to create a real key in the home directory of the user building it.  However if ~/.gnupg does not exist, the build fails as it does not create that directory manually (never mind the sandbox breakage issues this creates).  The quick work around is to create ~/.gnupg.
Comment 9 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2005-03-16 14:35:00 UTC
I've put some work into the 1.4.1 ebuild that should resolve this problem (the src_test works now, where it failed before). Please reopen if this problem persists.
Comment 10 Braam van Heerden 2005-03-29 09:53:31 UTC
I am not the original poster, but I do have the same issue with app-crypt/gnupg-1.4.1

bugsy portage # emerge -pv gnupg

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild     U ] app-crypt/gnupg-1.4.1 [1.2.6] +X +bzip2* +caps +curl -debug +ecc* +idea* +ldap +nls +readline +selinux* -smartcard +zlib 0 kB

Total size of downloads: 0 kB

Then, when I compile, I get the following:

Making all in checks
make[2]: Entering directory `/var/tmp/portage/gnupg-1.4.1/work/gnupg-1.4.1/checks'
echo '#!/bin/sh' >./gpg_dearmor
../tools/mk-tdata   500  >data-500
echo "../g10/gpg --no-options --no-greeting \
             --no-secmem-warning --batch --dearmor" >>./gpg_dearmor
../tools/mk-tdata  9000  >data-9000
chmod 755 ./gpg_dearmor
../tools/mk-tdata 32000  >data-32000
../tools/mk-tdata 80000  >data-80000
cat ./../doc/HACKING \
    ./../doc/DETAILS \
    ./../doc/FAQ         >plain-large
./gpg_dearmor > ./pubring.gpg < ./pubring.asc
./gpg_dearmor > ./secring.gpg < ./secring.asc
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/secring.gpg': file open error
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/pubring.gpg': file open error
make[2]: *** [pubring.gpg] Error 2
make[2]: *** Waiting for unfinished jobs....
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/secring.gpg': file open error
gpg: keyblock resource `/var/tmp/portage/homedir/.gnupg/pubring.gpg': file open error
make[2]: *** [secring.gpg] Error 2
make[2]: Leaving directory `/var/tmp/portage/gnupg-1.4.1/work/gnupg-1.4.1/checks'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/var/tmp/portage/gnupg-1.4.1/work/gnupg-1.4.1'
make: *** [all] Error 2

!!! ERROR: app-crypt/gnupg-1.4.1 failed.
!!! Function src_compile, Line 116, Exitcode 2
!!! (no error message)
!!! If you need support, post the topmost build error, NOT this status message.


I have tried creating ~portage/.gnupg as well as empty key files in the homedir.
Comment 11 nixnut (RETIRED) gentoo-dev 2005-05-19 04:13:52 UTC
same here, wasn't fixed for me.

Worked around it by USE="-selinux" emerge gnupg


Portage 2.0.51.19 (selinux/2005.1/ppc, gcc-3.4.1, glibc-2.3.4.20041102-r1,
2.6.11-hardnut-r13 ppc)
=================================================================
System uname: 2.6.11-hardnut-r13 ppc 7447A, altivec supported
Gentoo Base System version 1.4.16
Python:              dev-lang/python-2.3.5 [2.3.5 (#1, May  1 2005, 18:06:15)]
dev-lang/python:     2.3.5
sys-apps/sandbox:    1.2.8
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.9.5, 1.5, 1.6.3, 1.8.5-r3, 1.4_p6, 1.7.9-r1
sys-devel/binutils:  2.15.90.0.3-r4
sys-devel/libtool:   1.5.16
virtual/os-headers:  2.6.8.1-r4
ACCEPT_KEYWORDS="ppc"
AUTOCLEAN="yes"
CFLAGS="-O2 -mtune=G4 -maltivec -mabi=altivec -fno-strict-aliasing -pipe"
CHOST="powerpc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config
/usr/lib/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -mtune=G4 -maltivec -mabi=altivec -fno-strict-aliasing -pipe"
DISTDIR="/var/tmp/portage/distfiles"
FEATURES="autoaddcvs autoconfig ccache distlocks sandbox selinux sfperms strict
userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X alsa altivec berkdb cdr crypt cups dlloader dvd dvdread esd flac gd gdbm
gif gpm gtk hardened imagemagick imlib java jpeg ldap mad motif mpeg ncurses
network nls ogg opengl pam perl png ppc python readline real selinux ssl tcpd
theora tiff truetype vorbis xml2 xv xvid zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CBUILD, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS
Comment 12 Ben Peddell 2005-06-28 05:19:09 UTC
I have found that this issue persists with 1.4.1-r1 on x86 using selinux (built
in the selinux/2004.1/x86/hardened profile).
Note that this is a GnuPG issue, as an unpatched source compile with
--enable-selinux-support fails with exactly the same error on a hardened/x86/2.6
profile.

I've just tracked it down to this:
The --enable-selinux-support configuration option forces it to try to grab or
create the ~/.gnupg/{sec,pub}ring.gpg even when the --no-options command-line
option disables the creation of the ~/.gnupg directory.

#line 2921 g10/g10.c
    /* Add the keyrings, but not for some special commands and not in
       case of "-kvv userid keyring".  Also avoid adding the secret
       keyring for a couple of commands to avoid unneeded access in
       case the secrings are stored on a floppy.
       
       We always need to add the keyrings if we are running under
       SELinux, thi is so that the rings are added to the list of
       secured files. */

Perhaps a workaround could be to ignore --no-options when selinux is enabled,
and also to patch checks/Makefile to add e.g. `--homedir .'
Comment 13 Ben Peddell 2005-06-28 07:08:17 UTC
Created attachment 62151 [details, diff]
Workaround for gpg check failure with USE=selinux

Causes try_make_homedir to ignore --no-options when selinux is enabled.
Adds `--homedir .' to options in gpg_dearmor
touch checks/{pub,sec}ring.gpg to 1970-01-02 if they don't exist.
Comment 14 Daniel Black (RETIRED) gentoo-dev 2005-07-01 15:58:11 UTC
Thanks Ben - this patch is good. Commiting it soon and I'll submit it to the 
upstream devs.