Bug 2225463

whois-5.5.17-3.fc39 fails to build in Fedora 39:

Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.9DE8Ja
+ umask 022
+ cd /builddir/build/BUILD
++ mktemp --tmpdir whois-XXXXXXX.gpg
+ TMPKEY=/tmp/whois-dIkE40K.gpg
+ gpg --no-default-keyring --keyring /tmp/whois-dIkE40K.gpg --import /builddir/build/SOURCES/md-pgp.asc
gpg: key E6FFF1E38DC968B0: 64 signatures not checked due to missing keys
gpg: directory '/builddir/.gnupg' created
gpg: /builddir/.gnupg/trustdb.gpg: trustdb created
gpg: key E6FFF1E38DC968B0: public key "Marco d'Itri <md>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found
+ dscverify --keyring /tmp/whois-dIkE40K.gpg /builddir/build/SOURCES/whois_5.5.17.dsc
/builddir/build/SOURCES/whois_5.5.17.dsc:
dscverify: /builddir/build/SOURCES/whois_5.5.17.dsc failed signature check:
gpg: Signature made Wed May  3 12:27:41 2023 UTC
gpg:                using EDDSA key 272945CD836D38DFB7427E86CB3EC33AE1DED781
gpg: Can't check signature: No public key
Validation FAILED!!
error: Bad exit status from /var/tmp/rpm-tmp.9DE8Ja (%prep)

A difference between passing and failing build root is at <https://koschei.fedoraproject.org/build/15454437>. An upgrade of gnupg2 from 2.4.0-3.fc39 to 2.4.1-1.fc39 looks suspicious.

Please note that the gpg --import command spoils $HOME/.gnupg which should not happen. Commands executed when building a package should not modify user's home directory.

That it touched $HOME can be seen in these lines:

gpg: directory '/builddir/.gnupg' created
gpg: /builddir/.gnupg/trustdb.gpg: trustdb created

Also when building the package in my virtual machine (HOME=/home/test), I can see:

gpg: WARNING: unsafe permissions on homedir '/home/test/.gnupg'

(And the build passes in my virutal machine, probably because of prepopulated ~./gnupg.)