Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1228234 - rpm --resign fails with encrypted key, gnupg fails to present password dialog
rpm --resign fails with encrypted key, gnupg fails to present password dialog
Product: Fedora
Classification: Fedora
Component: rpm (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: packaging-team-maint
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2015-06-04 08:48 EDT by Noa Resare
Modified: 2018-06-09 09:47 EDT (History)
7 users (show)

See Also:
Fixed In Version: rpm-
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-06-25 04:23:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Noa Resare 2015-06-04 08:48:05 EDT
Description of problem:
"rpm --resign" interoperates badly with gpg2 when the key is encrypted

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Set up a minimal Fedora 22 system
2. dnf install rpm-sign
3. gpg2 --gen-key
4. create a key for user 'test test', a loop that repeatedly issues "find / -type f -print" will help you with entropy creation, otherwise takes a really long time.
5. choose a password. I picked 'a'.
6. echo "%_gpg_name test" > .rpmmacros
7. dnf download rpm
8. rpm --resign rpm*rpm
9. enter your simple password, 'a' when prompted

Actual results:
[noa@localhost ~]$ rpm --resign rpm- 
Enter pass phrase: 
gpg: signing failed: Inappropriate ioctl for device
gpg: signing failed: Inappropriate ioctl for device
Pass phrase check failed or gpg key expired

Expected results:
the package res-signed with my newly created key

Additional info:
I guess this default behaviour will encourage people to use passwordless keys, which seems like a really bad side effect of the change that gpg2 really tries to get people to provide passwords interactively.

I'm assuming the fix is to provide gpg-agent with access to the tty to create a proper password prompt.
Comment 1 Ľuboš Kardoš 2015-06-12 07:47:44 EDT
Now this is fixed upstream: 0bce5fcf270711a2e077fba0fb7c5979ea007eb5
Comment 2 Devrim Gündüz 2015-06-19 00:50:54 EDT
Any chance we can get an updated package soon? I am holding PostgreSQL community RPMs just because of this :-(
Comment 3 Fedora Update System 2015-06-19 06:40:58 EDT
rpm- has been submitted as an update for Fedora 22.
Comment 4 Fedora Update System 2015-06-20 20:04:16 EDT
Package rpm-
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing rpm-'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2015-06-25 04:23:11 EDT
rpm- has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.