Bug 1228234 - rpm --resign fails with encrypted key, gnupg fails to present password dialog
Summary: rpm --resign fails with encrypted key, gnupg fails to present password dialog
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: rpm
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Packaging Maintenance Team
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-04 12:48 UTC by Noa Resare
Modified: 2018-06-09 13:47 UTC (History)
7 users (show)

Fixed In Version: rpm-4.12.0.1-11.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-06-25 08:23:11 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Noa Resare 2015-06-04 12:48:05 UTC
Description of problem:
"rpm --resign" interoperates badly with gpg2 when the key is encrypted

Version-Release number of selected component (if applicable):
gnupg2-2.1.4-1.fc22.x86_64
rpm-sign-4.12.0.1-9.fc22.x86_64


How reproducible:
Always


Steps to Reproduce:
1. Set up a minimal Fedora 22 system
2. dnf install rpm-sign
3. gpg2 --gen-key
4. create a key for user 'test test', a loop that repeatedly issues "find / -type f -print" will help you with entropy creation, otherwise takes a really long time.
5. choose a password. I picked 'a'.
6. echo "%_gpg_name test" > .rpmmacros
7. dnf download rpm
8. rpm --resign rpm*rpm
9. enter your simple password, 'a' when prompted

Actual results:
[noa@localhost ~]$ rpm --resign rpm-4.12.0.1-9.fc22.x86_64.rpm 
Enter pass phrase: 
gpg: signing failed: Inappropriate ioctl for device
gpg: signing failed: Inappropriate ioctl for device
Pass phrase check failed or gpg key expired


Expected results:
the package res-signed with my newly created key

Additional info:
I guess this default behaviour will encourage people to use passwordless keys, which seems like a really bad side effect of the change that gpg2 really tries to get people to provide passwords interactively.

I'm assuming the fix is to provide gpg-agent with access to the tty to create a proper password prompt.

Comment 1 Ľuboš Kardoš 2015-06-12 11:47:44 UTC
Now this is fixed upstream: 0bce5fcf270711a2e077fba0fb7c5979ea007eb5

Comment 2 Devrim Gündüz 2015-06-19 04:50:54 UTC
Any chance we can get an updated package soon? I am holding PostgreSQL community RPMs just because of this :-(

Comment 3 Fedora Update System 2015-06-19 10:40:58 UTC
rpm-4.12.0.1-11.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/rpm-4.12.0.1-11.fc22

Comment 4 Fedora Update System 2015-06-21 00:04:16 UTC
Package rpm-4.12.0.1-11.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing rpm-4.12.0.1-11.fc22'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-10347/rpm-4.12.0.1-11.fc22
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2015-06-25 08:23:11 UTC
rpm-4.12.0.1-11.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.