Description of problem:
In freeIPA we generate an encrypted file that is used to store replica configuration information.
This breaks in F-13 because gpg2 now requires an agent to be running and we encrypt this file something like this:
I'm using gpgtest as an example, we use python's tempfile.mkdtemp() to come up with a random name.
# mkdir -p /tmp/gpgtest/.gnupg
# /usr/bin/gpg --homedir /tmp/gpgtest/.gnupg --passphrase-fd 0 --yes --no-tty -o /path/to/outfile -c /path/to/infile
This hangs forever. If you remove the --no-tty arg you get:
can't connect to `/tmp/gpgtest/.gnupg/S.gpg-agent': No such file or directory
gpg-agent: command get_passphrase failed: Operation cancelled
gpg: cancelled by user
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of `infile' failed: Operation cancelled
The --no-use-agent argument is disabled, I'm not sure if this was an upstream choice or not.
I'm not to keen on firing up an agent on something that will rarely be run. Is there some other option, or can the --use-no-agent be re-enabled?
It seems this is related to the tty permissions. If I chmod o+rw $(tty) prior to running gpg it works. This is of course very ugly.
Even then I have to go through the pin entry program. I used to be able to pass in the passphrase over stdin.
And to round things out seems I need the --batch argument for --passphrase* to work. This is at least a problem in the man page.
It is also very different behavior from F-12.
Yes, this is right. You need to use the --batch.
GNUPG behavior is different because of change from gnupg-1.x to gnupg-2.0.
The upstream chose to require --batch for cases when input should not use tty or X.
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora
'version' of '13'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version prior to Fedora 13's end of life.
Bug Reporter: Thank you for reporting this issue and we are sorry that
we may not be able to fix it before Fedora 13 is end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora please change the 'version' of this
bug to the applicable version. If you are unable to change the version,
please add a comment here and someone will do it for you.
Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.
The process we are following is described here:
Still affects F-14, F-15 likely as well since the n-v-r are similar.
I think the --passphrase options in the man page should mention that batch is required for them to work.
It is fixed in Fedora 15 and 16 with gnupg2-2.0.18-1
In both `man gpg2' and `info gpg2' there is written:
Note that this passphrase is only used if the option --batch
has also been given. This is different from gpg.
for each in --passphrase, --passphrase-fd, and --passphrase-file.