Guillem Jover writes ("Re: Bug#964017: grep-excuses"):
> On Tue, 2020-06-30 at 14:15:13 +0100, Ian Jackson wrote:
> > The string "failed to verify signature" is not generated by code in
> > dgit. Looking at the code in dgit, I think the error happens here:
> >
> > my $dp = new Dpkg::Source::Package filename => $dscfn,
> > require_valid_signature => $needsig;
> > {
> > local $SIG{__WARN__} = sub {
> > print STDERR $_[0];
> > return unless $needsig;
> > fail __ "import-dsc signature check failed";
> > };
> > if (!$dp->is_signed()) {
> > warn f_ "%s: warning: importing unsigned .dsc\n", $us;
> > } else {
> > my $r = $dp->check_signature();
> > confess "->check_signature => $r" if $needsig && $r;
> > }
> > }
> >
> > I think this rather complex code is trying to deal with API
> > compatibility issues surrounding require_valid_signature etc. Anyway,
> > I think the message is generated by the call to
> > Dpkg::Source::Package::new. I think that function inserted $0 into
> > the error message.
> >
> > I don't know why it is verifying the signature. I think in this
> > particular test $needsig is 0. I searched the code for the variable
> > and the only place dgit sets it trueish is if dgit import-dsc is
> > told --require-valid-signature.
>
> This error message comes from Dpkg::OpenPGP::verify_signature() called
> by Dpkg::Source::Package->check_signature(), so if you do not want to
> verify the signature I guess you'd need to conditionalize that call
> also with $needsig.
Sorry, I was confused before. Yes, I see that it does verify the
signature even if $needsig is 0. That's desirable because I still
want to print a warning if the signature doesn't verify.
Previously this worked, I think.
The problem is that, now, check_signature exits the process when the
signature check fails, rather than returning a falseish value.
I'm pretty sure this must be a change in src:dpkg, since ci.d.n does
rerun the dgit test suite for gpg[v] migrations.
> > So I don't know what a "trustedkeys.kbx" file is or why I need one
> > now. (dgit's test suite naturally has a set of test keys, so it has
> > its own idea of the public keys to use for signature verifications.
> > But this test case should not involve any of that.)
>
> Hmm, I guess I should be passing --homedir to gpg also within the
> verify_signature(), like I did for the import_key() call. But I'm
> assuming you are setting GNUPGHOME in the test suite as well, which
> is what would make gpg look for the trustedkeys db in there.
Yes, I do pass GNUPGHOME. But it's quite possible that this test,
which is not supposed to have a valid signature, has a .dsc with a
signature whose public key is not available.
Ian.
--
Ian Jackson <[email protected]> These opinions are my own.
Pronouns: they/he. If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.
