Hide Forgot
Description of problem: rpm --import publicfilekey reports a failure even for a valid public key Version-Release number of selected component (if applicable): 4.8.1 How reproducible: see gdb script Steps to Reproduce: 1. rpm --import publicgpgfile 2. 3. Actual results: An error message saying gpg file is invalid Expected results: success Additional info:
Created attachment 473756 [details] This is a recording of my tracking the bug in a live gdb session
Created attachment 473761 [details] I demonstrate that the examination of public key stops improprerly and test at rpmpgp.c:1463 is bad, I have turned this into a security bug because b goes out of bounds and pgpValTok (in rpmpgp.c) seems incomplete. Look at the bottom of the second attachment just before pgpValTok seems to make a good recognition at $159 but then drops the ball.
Please attach the public key too for reproducing.
Created attachment 473920 [details] One key that refused to be imported
That key certainly works for me and obviously a whole lot of users. I suspect what you're seeing here is simply related to bug 667582: the armor of four keys in that bug causes corruption which is making things fail randomly.
Created attachment 474988 [details] This is what I mean by yum being attack vector but should be separate This should probably be a separate report but it is a security problem. Noscript and Selinux obviously didn't stop it.
*** Bug 689357 has been marked as a duplicate of this bug. ***
The key I cannot import is the same one.
*** This bug has been marked as a duplicate of bug 667582 ***
Panu -- 667582 is closed ... could you please open it, or work in this bug so I may follow it Thank you -- Russ herrold