Bug 2246111 - F39 no longer contains systemd gpg-agent* files breaking gpg-agent usage
Summary: F39 no longer contains systemd gpg-agent* files breaking gpg-agent usage
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: gnupg2
Version: 39
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jakub Jelen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-10-25 13:10 UTC by Hans de Goede
Modified: 2024-11-27 21:36 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-11-27 21:36:44 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-1010 0 None None None 2023-10-25 13:13:23 UTC

Description Hans de Goede 2023-10-25 13:10:51 UTC
Under F38, "ls /usr/lib/systemd/user | grep gpg" outputs:

pg-agent-browser.socket
gpg-agent-extra.socket
gpg-agent-ssh.socket
gpg-agent.service
gpg-agent.socket

Under F39 this is empty now. The recommended way to use gpg-agent as ssh-agent (which is necessary with ssh keys stored in hw tokens) is to do:

systemctl --user enable gpg-agent.socket
systemctl --user enable gpg-agent-ssh.socket

After the F38 -> F39 upgrade there are now dangling symlinks under:
~/.config/systemd/user/sockets.target.wants/

and the gpg-agent is no longer started when using a SSH key for the first time.

Reproducible: Always

Steps to Reproduce:
1. Upgrade from F38 with working gpg-agent setup to F39
2. Notice gpg-agent no longer works under F39

Actual Results:  
gpg-agent no longer works under F39

Expected Results:  
gpg-agent works as before

Copying over the /usr/lib/systemd/user/gpg* files from a F38 install to a system upgraded to F39 works around the issue.

Comment 1 Jakub Jelen 2023-10-25 14:54:06 UTC
This is intentional as upstream does no longer support systemd units:

https://pagure.io/fedora-docs/release-notes/issue/1029

unfortunately, it did not make it to release notes yet ...

gpg should be able to start the gpg-agent on demand.

Comment 2 Hans de Goede 2023-10-25 15:29:01 UTC
(In reply to Jakub Jelen from comment #1)
> This is intentional as upstream does no longer support systemd units:
> 
> https://pagure.io/fedora-docs/release-notes/issue/1029

Thank you for the quick answer.

gpg starting the agent on demand does not help for the use-case where the agent is also (and mostly) used as ssh-agent which is a somewhat common thing to do AFAIK.

I think the release notes also need some recommendation on how to start the gpg-agent for this use case to replace the systemd units.

I guess such a recommendation would likely involve adding a new user systemd-unit to start gpg-agent at login, at which point having a system level unit to link to seems better...

Comment 3 Jakub Jelen 2023-10-26 07:15:46 UTC
Since I did not use this use case, I do not know what needs to be done for this to work. If you can describe some draft or notes you would like to see in RN, please do that in the above pagure request.

Comment 4 Hans de Goede 2023-10-26 09:21:30 UTC
(In reply to Jakub Jelen from comment #3)
> Since I did not use this use case, I do not know what needs to be done for
> this to work. If you can describe some draft or notes you would like to see
> in RN, please do that in the above pagure request.

My problem is that I don't know what is the best way to keep my usecase working without the systems files.

My question is without the systemd units how is one supposed to start (does not need to be autostart) the gpg-agent when using it as ssh-agent (so it is not autostarted by the gpg commandline tool, since that is not used) ?

Once that questions is answered I would be happy to propose some release-notes text for this.

Comment 5 Robin Jarry 2023-11-06 11:54:01 UTC
Hi, got bitten by this as well.

Debian did restore the systemd units as part of the downstream package:

https://salsa.debian.org/debian/gnupg2/-/commit/6473b20ad8cdc661d939c6f2b25dca3fc4374af1
https://salsa.debian.org/debian/gnupg2/-/commit/21320bf63da5a37842767130caee8ed1e7e283fd

Would that be enough to warrant restoring the files as part of the downstream RPM package as well?

Comment 6 Hans de Goede 2023-11-06 11:59:15 UTC
FWIW restoring the systemd units downstream would be my preferred solution too.

Comment 7 Jakub Jelen 2023-11-06 21:33:39 UTC
Reverted the systemd units in https://src.fedoraproject.org/rpms/gnupg2/c/fd39da6d1827a7dbb0f8d40210e4b81f5ee45f1c?branch=rawhide building rawhide and f39 now.

The final Fedora 39 release should come tomorrow so after that the Fedora 39 update can land also there. Feedback and testing would be welcomed both here and in bodhi when it will land

Comment 8 Hans de Goede 2023-11-08 10:42:17 UTC
Thank you I've just reverted my manual fix and installed the update from updates-testing and I can confirm that it fixes things. I have left positive karma for the update in bodhi.

Comment 9 Aoife Moloney 2024-11-13 09:57:07 UTC
This message is a reminder that Fedora Linux 39 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 39 on 2024-11-26.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '39'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 39 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 10 Aoife Moloney 2024-11-27 21:36:44 UTC
Fedora Linux 39 entered end-of-life (EOL) status on 2024-11-26.

Fedora Linux 39 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.