Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 646194 - app-crypt/gnupg: --refresh-keys fails if ipv6 is not supported (was: app-portage/gemato, sys-apps/portage: emerge --sync fails on verification)
Summary: app-crypt/gnupg: --refresh-keys fails if ipv6 is not supported (was: app-port...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Kristian Fiskerstrand
URL:
Whiteboard:
Keywords: UPSTREAM
Depends on: 646934
Blocks:
  Show dependency tree
 
Reported: 2018-01-31 08:51 UTC by Xavier Miller
Modified: 2020-01-17 11:19 UTC (History)
11 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
0001-dirmngr-Handle-failures-related-to-missing-IPv6-grac.patch (0001-dirmngr-Handle-failures-related-to-missing-IPv6-grac.patch,1.31 KB, patch)
2018-01-31 16:58 UTC, Michał Górny
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Xavier Miller gentoo-dev 2018-01-31 08:51:59 UTC
sent 31.50K bytes  received 4.29M bytes  665.51K bytes/sec
total size is 224.29M  speedup is 51.85

INFO:root:Refreshing keys from keyserver...
Traceback (most recent call last):
  File "/usr/lib/python-exec/python2.7/gemato", line 11, in <module>
    load_entry_point('gemato==10.3', 'console_scripts', 'gemato')()
  File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 403, in setuptools_main
    sys.exit(main(sys.argv))
  File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 398, in main
    return vals.func(vals, argp)
  File "/usr/lib64/python2.7/site-packages/gemato/cli.py", line 62, in do_verify
    env.refresh_keys()
  File "/usr/lib64/python2.7/site-packages/gemato/openpgp.py", line 219, in refresh_keys
    raise RuntimeError('Unable to refresh keys: {}'.format(err.decode('utf8')))
RuntimeError: Unable to refresh keys: gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: Address family not supported by protocol

q: Updating ebuild cache in /usr/portage ...
q: Finished 37364 entries in 0.230601 seconds

Action: sync for repo: gentoo, returned code = 1




 # emerge --info
Portage 2.3.21 (python 2.7.14-final-0, default/linux/amd64/17.1/no-multilib, gcc-7.3.0, glibc-2.26-r5, 4.15.0-gentoo x86_64)
=================================================================
System uname: Linux-4.15.0-gentoo-x86_64-Intel-R-_Celeron-R-_2957U_@_1.40GHz-with-gentoo-2.4.1
KiB Mem:     3960520 total,   1927428 free
KiB Swap:    4194300 total,   4163324 free
Timestamp of repository gentoo: Wed, 31 Jan 2018 08:00:01 +0000
Head commit of repository gentoo: 1a223c0614db81eee1220f4766837a1e2ebc76cc
sh bash 4.4_p12-r1
ld GNU gold (Gentoo 2.29.1 p3 2.29.1) 1.14
distcc 3.2rc1 x86_64-pc-linux-gnu [disabled]
app-shells/bash:          4.4_p12-r1::gentoo
dev-lang/perl:            5.26.1-r1::gentoo
dev-lang/python:          2.7.14-r1::gentoo, 3.5.4-r1::gentoo
dev-util/cmake:           3.10.2::gentoo
dev-util/pkgconfig:       0.29.2::gentoo
sys-apps/baselayout:      2.4.1-r2::gentoo
sys-apps/openrc:          0.34.11::gentoo
sys-apps/sandbox:         2.12::gentoo
sys-devel/autoconf:       2.69-r4::gentoo
sys-devel/automake:       1.15.1-r1::gentoo
sys-devel/binutils:       2.29.1-r1::gentoo, 2.30::gentoo
sys-devel/gcc:            7.3.0::gentoo
sys-devel/gcc-config:     1.9.1::gentoo
sys-devel/libtool:        2.4.6-r4::gentoo
sys-devel/make:           4.2.1-r1::gentoo
sys-kernel/linux-headers: 4.15::gentoo (virtual/os-headers)
sys-libs/glibc:           2.26-r5::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000
    sync-rsync-openpgp-key-path: /var/lib/gentoo/gkeys/keyrings/gentoo/release/pubring.gpg
    sync-rsync-verify-metamanifest: yes
    sync-rsync-extra-opts:

local
    location: /usr/local/portage/overlay
    masters: gentoo
    priority: 0

gentoo-kodi-overlay
    location: /usr/local/portage/gentoo-kodi-overlay
    masters: gentoo
    priority: 1

proaudio
    location: /var/lib/layman/proaudio
    masters: gentoo
    priority: 50

xmw
    location: /var/lib/layman/xmw
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="@FREE as-is freedist"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=core2 -mcx16 -msahf -mpclmul -mpopcnt -msse4.2 --param l1-cache-size=32 --param l1-cache-line-size=64 --param l2-cache-size=256 -mtune=core2 -fomit-frame-pointer -O2"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.1/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=core2 -mcx16 -msahf -mpclmul -mpopcnt -msse4.2 --param l1-cache-size=32 --param l1-cache-line-size=64 --param l2-cache-size=256 -mtune=core2 -fomit-frame-pointer -O2"
DISTDIR="/var/portage/distfiles"
EMERGE_DEFAULT_OPTS="--with-bdeps y --quiet-build=n --buildpkg"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs buildpkg candy config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LANG="fr_BE.utf8"
LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--hash-style=gnu -Wl,--as-needed"
LINGUAS="fr fr_FR fr_BE nl nl_NL nl_BE"
MAKEOPTS="-j5 -l2"
PKGDIR="/var/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
USE="acpi amd64 bmp branding bzip2 cli crossdev crypt cups cxx dbus dlna dri gif iconv jpeg jpeg2k mmx modules ncurses nls nptl openmp pcre pdf png readline sane scanner seccomp sqlite sse2 sse4_1 sse4_2 ssl ssse3 svg tcpd threads tiff unicode upnp xattr zlib" ABI_X86="64" ALSA_CARDS="hda-intel usb-audio virmidi" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" L10N="fr nl" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LIRC_DEVICES="ftdi" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-0" POSTGRES_TARGETS="postgres9_5" PYTHON_SINGLE_TARGET="python3_5" PYTHON_TARGETS="python2_7 python3_5" QEMU_USER_TARGETS="arm" RUBY_TARGETS="ruby23" SANE_BACKENDS="hp" USERLAND="GNU" VIDEO_CARDS="dummy" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-01-31 10:23:07 UTC
This is clearly a bug in gpg. Neither gemato nor gentoo-keys force ipv6 in any way.
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2018-01-31 11:28:01 UTC
I believe upstream's response is that it is a misconfigured system if you encounter this, so ipv6 should either be disabled system-wide using net.ipv6.conf.all.disable_ipv6 = 1 or disable-ipv6 in dirmngr. See https://dev.gnupg.org/T3331 for discussion, including some of my comments from august 2017.
Comment 3 Xavier Miller gentoo-dev 2018-01-31 11:49:17 UTC
I added a /etc/dirmngr/dirmngr.conf file
with "disable-ipv6"

Now it syncs and checks the contents :)

sent 32.20K bytes  received 5.47M bytes  579.05K bytes/sec
total size is 224.33M  speedup is 40.78
INFO:root:Refreshing keys from keyserver...
INFO:root:Keys refreshed.
INFO:root:Manifest timestamp: 2018-01-31 11:08:16 UTC
INFO:root:Valid OpenPGP signature found:
INFO:root:- primary key: DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
INFO:root:- subkey: E1D6ABB63BFCFB4BA02FDF1CEC590EEAC9189250
INFO:root:- timestamp: 2018-01-31 11:08:16 UTC
INFO:root:Verifying /usr/portage...
INFO:root:/usr/portage verified in 51.75 seconds
=== Sync completed for gentoo
Comment 4 Kristian Fiskerstrand gentoo-dev Security 2018-01-31 14:11:05 UTC
For gemato, one way is to add dirmngr.conf to the temporary homedir created in line 185 on in gemato/openpgp.py with disable-ipv6 , that would ensure proper run without impacting user/system configuration
Comment 5 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-01-31 16:58:55 UTC
Created attachment 517256 [details, diff]
0001-dirmngr-Handle-failures-related-to-missing-IPv6-grac.patch

Here's the patch I came up with. It's trivial, and it fixes the issues when IPv6 is enabled via procfs for me. The other 'case' should cover the case of it being disabled in kernel but I'd appreciate if one of you could test it.

Please note that GnuPG chooses between different IP addresses randomly, so you may need to bash it for a while to get it to fail ;-). You may do something like 'killall dirmngr; strace -ff gpg --refresh-keys |& less' to verify if it tried to use IPv6 during the test.
Comment 6 manwe 2018-02-04 21:57:19 UTC
Thanks Michał for the patch. I also had "Address family not supported by protocol" error when IPv6 address was selected. 

I have no IPV6 in kernel so there is no /proc/sys/net/ipv6 to disabled_ipv6 to begin with.
Comment 7 Larry the Git Cow gentoo-dev 2018-02-07 20:44:57 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b580348546711590c0152a8371e3cf00393b4720

commit b580348546711590c0152a8371e3cf00393b4720
Author:     Kristian Fiskerstrand <k_f@gentoo.org>
AuthorDate: 2018-02-07 20:42:38 +0000
Commit:     Kristian Fiskerstrand <k_f@gentoo.org>
CommitDate: 2018-02-07 20:42:38 +0000

    app-crypt/gnupg: Add fix for missing IPv6 stack
    
    Bug: https://bugs.gentoo.org/646194
    Package-Manager: Portage-2.3.19, Repoman-2.3.6

 ...r-Handle-failures-related-to-missing-IPv6.patch |  31 +++++
 app-crypt/gnupg/gnupg-2.2.4-r2.ebuild              | 130 +++++++++++++++++++++
 2 files changed, 161 insertions(+)}
Comment 8 Larry the Git Cow gentoo-dev 2018-02-07 21:39:00 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9cdccbb4f67a6e3586df619a689ee9a7306ffe7d

commit 9cdccbb4f67a6e3586df619a689ee9a7306ffe7d
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2018-02-07 21:34:58 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2018-02-07 21:38:56 +0000

    sys-apps/portage: Require app-crypt/gnupg with IPv6 fix
    
    Depend on >=app-crypt/gnupg-2.2.4-r2 to avoid failing verification
    on systems that are missing an IPv6 stack. More importantly, this
    ensures that we will not stabilize Portage before that version of GnuPG.
    
    Bug: https://bugs.gentoo.org/646194

 sys-apps/portage/{portage-2.3.24.ebuild => portage-2.3.24-r1.ebuild} | 2 +-
 sys-apps/portage/portage-9999.ebuild                                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)}
Comment 9 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-02-09 11:26:20 UTC
GnuPG is fixed now, and Portage has appropriate deps. I guess that's all to be done here.
Comment 10 Tomas Rusnak 2018-07-05 19:52:43 UTC
I have same error again:

# eix-sync
 * Running emerge --sync
>>> Syncing repository 'gentoo' into '/usr/portage'...
 * Using keys from /usr/share/openpgp-keys/gentoo-release.asc
 * Refreshing keys from keyserver ...OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: General error

OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: General error

Installed version is:
app-crypt/gnupg-2.2.4-r2
Comment 11 Zac Medico gentoo-dev 2018-07-05 20:16:54 UTC
(In reply to Tomas Rusnak from comment #10)
> I have same error again:
> 
> # eix-sync
>  * Running emerge --sync
> >>> Syncing repository 'gentoo' into '/usr/portage'...
>  * Using keys from /usr/share/openpgp-keys/gentoo-release.asc
>  * Refreshing keys from keyserver ...OpenPGP keyring refresh failed:
> gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
> gpg: keyserver refresh failed: General error
> 
> OpenPGP keyring refresh failed:
> gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
> gpg: keyserver refresh failed: General error
> 
> Installed version is:
> app-crypt/gnupg-2.2.4-r2

The root cause may not be exactly the same as the IPV6 issue fixed in  app-crypt/gnupg/gnupg-2.2.4-r2, so please open a new bug report.
Comment 12 Zac Medico gentoo-dev 2018-07-06 06:03:57 UTC
Actually I have a cron job that showed the "General error" today. The cron job runs every 30 minutes, with lots of retry just like emerge, and a cron email was sent 5 Jul 2018 19:55:42 +0000 (UTC).
Comment 13 Kristian Fiskerstrand gentoo-dev Security 2018-07-06 07:59:39 UTC
(In reply to Zac Medico from comment #12)
> Actually I have a cron job that showed the "General error" today. The cron
> job runs every 30 minutes, with lots of retry just like emerge, and a cron
> email was sent 5 Jul 2018 19:55:42 +0000 (UTC).

I'd still prefer a separate bug for it, in particular one that includes dirmngr log (dirmngr.conf: log-file /path/to/file.log\ndebug-level guru) and gpgconf --kill dirmngr
Comment 14 Massimo Burcheri 2020-01-17 11:19:33 UTC
Before I found this ticket I created https://dev.gnupg.org/T4817 .
Even with --disable-ipv6 it doesn't work. Any other workaround?