Bug 905087

Summary: bzr gpg signing is failing
Product: [Fedora] Fedora Reporter: Mats Wichmann <mats>
Component: bzrAssignee: Toshio Ernie Kuratomi <a.badger>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: a.badger, henrik, shahms
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: bzr-2.5.1-12.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-06-07 23:25:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mats Wichmann 2013-01-28 14:43:15 UTC
Description of problem: I have bazaar offer to sign my commits to a particular project.  This is enabled by a config file setting.  It has worked fine since I set up it up, until upgrade to Fedora 18.


Version-Release number of selected component (if applicable):
bzr-2.5.1-2.fc18.x86_64

Bazaar (bzr) 2.5.1
  Python interpreter: /usr/bin/python 2.7.3
  Python standard library: /usr/lib64/python2.7
  Platform: Linux-3.7.4-204.fc18.x86_64-x86_64-with-fedora-18-Spherical_Cow
  bzrlib: /usr/lib64/python2.7/site-packages/bzrlib
  Bazaar configuration: /home/mats/.bazaar
  Bazaar log file: /home/mats/.bzr.log


How reproducible: always


Steps to Reproduce:
Commit signing is enabled for a project per the bazaar documentation. As an example, add this to: $HOME/.bazaar/locations.conf:
[/home/mats/LSB]
create_signatures = always
check_signatures = require

Now commit on a changed branh under /home/mats/LSB.
  
Actual results:
normal commit information is displayed - a list of files modified - but then command aborts with error:
gpg: Sorry, no terminal at all requested - can't get input                     
bzr: ERROR: Failed to GPG sign data with command "[u'gpg', '--clearsign', '-u', u'mats', '--no-tty']"


Expected results:
a prompt for the gpg key is issued, I type the password, and the commit completes correctly.

Comment 1 Henrik Nordström 2013-01-30 13:21:36 UTC
Do you have suitable pinentry-* packages installed?

Comment 2 Mats Wichmann 2013-01-30 13:59:10 UTC
pinentry-gtk-0.8.1-8.fc18.x86_64
pinentry-0.8.1-8.fc18.x86_64


(which is the same pair as on a working F17 installation)

Comment 3 Mats Wichmann 2013-05-02 14:30:59 UTC
Just updating: this problem remains, updates to other packages since F18 released (there have been no bzr updates) have not made it go away. Also checked current F19 alpha bzr has same issue.

Comment 4 Mats Wichmann 2013-05-10 15:32:15 UTC
Update after investigation:

the difference between a working (e.g. as released for F17) and non-working edition is a change to the gpg options.

For 64-bit Fedora, that would be in the file:

/usr/lib64/python2.7/site-packages/bzrlib/gpg.py

193c193
<                 '-u', key]
---
>                 '-u', key, '--no-tty', '--batch']


With --batch, there is no input terminal, from the gpg docs:

    Use  batch  mode.  Never ask, do not allow interactive commands.

The problem is, when bzr asks gpg to sign the data generated for commit, it may be necessary for gpg to prompt the committer for a passkey, and the --batch option makes that impossible.

Comment 5 Toshio Ernie Kuratomi 2013-05-29 00:17:08 UTC
I was working on a CVE update for bzr and wanted to take a look at this before pushing an update all the way back to F17.  I could not reproduce with the current bzr package.

I took a look in the bzr-2.5.1-2.fc18.x86_64.rpm from the Fedora 18 release repositories and found this at gpg.py line 193:

         return [self._config_stack.get('gpg_signing_command'), '--clearsign',
                '-u', key, '--no-tty']

So it looks like the package itself is correct.  Do you have a different version of bzr installed in site packages perhaps?

rpm -V bzr

might tell you.

Comment 6 Toshio Ernie Kuratomi 2013-05-29 00:48:13 UTC
Hmm.. So discovered several things --

* I think that --no-tty is to blame, not --batch.
* If I run gpg --clearsign -u toshio bzr.spec then I get:
  gpg: gpg-agent is not available in this session
  gpg: Sorry, no terminal at all requested - can't get input

  which seems to match up with your error.

* The change was introduced to fix a bug with gpg signatures in bzr-explorer: https://bugs.launchpad.net/bzr/+bug/847388  and was reverted because of what looks like the same error as here: https://bugs.launchpad.net/bzr/+bug/1014570

I'm going to patch out the --no-tty flag in our version of bzr as well.

Comment 7 Fedora Update System 2013-05-29 01:24:37 UTC
bzr-2.5.1-12.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/bzr-2.5.1-12.fc17

Comment 8 Fedora Update System 2013-05-29 01:24:46 UTC
bzr-2.5.1-12.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/bzr-2.5.1-12.fc18

Comment 9 Fedora Update System 2013-05-29 01:24:55 UTC
bzr-2.5.1-12.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/bzr-2.5.1-12.fc19

Comment 10 Fedora Update System 2013-05-29 17:43:12 UTC
Package bzr-2.5.1-12.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing bzr-2.5.1-12.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-9537/bzr-2.5.1-12.fc19
then log in and leave karma (feedback).

Comment 11 Fedora Update System 2013-06-07 23:25:49 UTC
bzr-2.5.1-12.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2013-06-07 23:53:29 UTC
bzr-2.5.1-12.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2013-06-08 03:39:14 UTC
bzr-2.5.1-12.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.