FS#43479 - [devtools] Handling of gnupg 2.1.x public keyring
Attached to Project:
Arch Linux
Opened by Christian Hesse (eworm) - Friday, 16 January 2015, 22:57 GMT
Last edited by Pierre Schmitz (Pierre) - Thursday, 14 May 2015, 08:37 GMT
Opened by Christian Hesse (eworm) - Friday, 16 January 2015, 22:57 GMT
Last edited by Pierre Schmitz (Pierre) - Thursday, 14 May 2015, 08:37 GMT
|
Details
Description:
devtools helper scripts know how to handle public keyring from ~/.gnupg/pubring.gpg. This file is created by gnupg before 2.1 and gnupg 2.1.x can handle it when present. However gnupg 2.1.x does create a file ~/.gnupg/pubring.kbx if no configuration is found. This breaks devtools helper scripts. https://www.gnupg.org/faq/whats-new-in-2.1.html#sec-1-11 Additional info: devtools 20141224-1 Steps to reproduce: $ mv ~/.gnupg/pubring.gpg ~/.gnupg/publickeys $ gpg --import ~/.gnupg/publickeys $ makechrootpkg -r ~chroots/extra-x86_64/ [...] ==> Verifying source file signatures with gpg... archive.tar.gz ... FAILED (unknown public key DEADBEEF) |
This task depends upon
$ rm ~/.gnupg/pubring.kbx
$ touch ~/.gnupg/pubring.gpg
After that gnupg will use the old file.
For example, take the following real case:
$ ls -l ~/.gnupg | grep pubring | grep -v ~$
-rw------- 1 someuser users 1284991 7. Feb 09:44 pubring.gpg
-rw-r--r-- 1 someuser users 13673 7. Sep 2007 pubring.kbx
Obviously the keyring from 2007 isn't the one we want to copy to the chroot.
We could either prioritize pubring.gpg or simply copy both files.
Probably we should copy both files then.