Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 927288 - dev-build/meson-1.4.0-r1: USE flag -verify-sig does not skip OpenPGP verification
Summary: dev-build/meson-1.4.0-r1: USE flag -verify-sig does not skip OpenPGP verifica...
Status: RESOLVED DUPLICATE of bug 927277
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Linux bug wranglers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-19 11:42 UTC by Yorick Yu
Modified: 2024-03-19 11:44 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Yorick Yu 2024-03-19 11:42:38 UTC
Emerging dev-build/meson-1.4.0-r1 with USE="-verify-sig" failed at unpack phase,
because "gpg verify signatures failed".

Reproducible: Always

Steps to Reproduce:
1. ACCEPT_KEYWOREDS="~amd64" emerge dev-build/meson (that is 1.4.0-r1)

Actual Results:  
# emerge dev-build/meson                                                                                                           
Calculating dependencies... done!                                                                                                             
Dependency resolution took 3.15 s (backtrack: 0/20).                                                                                          
                                                                                                                                              
                                                                                                                                              
>>> Verifying ebuild manifests                                                                                                                
                                                                                                                                              
>>> Emerging (1 of 1) dev-build/meson-1.4.0-r1::gentoo
 * meson-1.4.0.tar.gz BLAKE2B SHA512 size ;-) ...                                                                                      [ ok ]
 * meson-reference-1.4.0.3 BLAKE2B SHA512 size ;-) ...                                                                                 [ ok ]
>>> Unpacking source...
>>> Unpacking meson-1.4.0.tar.gz to /var/tmp/portage/dev-build/meson-1.4.0-r1/work
>>> Unpacking meson-reference-1.4.0.3 to /var/tmp/portage/dev-build/meson-1.4.0-r1/work
unpack meson-reference-1.4.0.3: file format not recognized. Ignoring.
 * Verifying meson-1.4.0.tar.gz ...
[  ERROR] OpenPGP verification failed for <_io.BufferedReader name='/var/tmp/portage/dev-build/meson-1.4.0-r1/distdir/meson-1.4.0.tar.gz'> (si
g in /var/tmp/portage/dev-build/meson-1.4.0-r1/distdir/meson-1.4.0.tar.gz.asc):
OpenPGP signature rejected for unknown reason:
gpg: can't open '/var/tmp/portage/dev-build/meson-1.4.0-r1/distdir/meson-1.4.0.tar.gz.asc': No such file or directory
gpg: verify signatures failed: No such file or directory

 * ERROR: dev-build/meson-1.4.0-r1::gentoo failed (unpack phase):
 *   PGP signature verification failed
 * 
 * Call stack:
 *     ebuild.sh, line  136:  Called src_unpack
 *   environment, line 4030:  Called verify-sig_verify_detached '/var/tmp/portage/dev-build/meson-1.4.0-r1/distdir/meson-1.4.0.tar.gz' '/var/t
mp/portage/dev-build/meson-1.4.0-r1/distdir/meson-1.4.0.tar.gz.asc'
 *   environment, line 5055:  Called die
 * The specific snippet of code:
 *               gemato openpgp-verify-detached -K "${key}" "${extra_args[@]}" --no-require-all-good "${sig}" "${file}" || die "PGP signature 
verification failed"
 * 
 * If you need support, post the output of `emerge --info '=dev-build/meson-1.4.0-r1::gentoo'`,
 * the complete build log and the output of `emerge -pqv '=dev-build/meson-1.4.0-r1::gentoo'`.
 * The complete build log is located at '/var/log/portage/dev-build:meson-1.4.0-r1:20240319-112431.log'.
 * For convenience, a symlink to the build log is located at '/var/tmp/portage/dev-build/meson-1.4.0-r1/temp/build.log'.
 * The ebuild environment file is located at '/var/tmp/portage/dev-build/meson-1.4.0-r1/temp/environment'.
 * Working directory: '/var/tmp/portage/dev-build/meson-1.4.0-r1/work'
 * S: '/var/tmp/portage/dev-build/meson-1.4.0-r1/work/meson-1.4.0'


Expected Results:  
doesn't verify packages' pgp signature and build successfully.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-03-19 11:44:50 UTC
Please emerge --sync.

*** This bug has been marked as a duplicate of bug 927277 ***