Bug#1070688: [pkg-gnupg-maint] Bug#1070688: gnupg: PINENTRY_USER_DATA not passed to pinentry

2024-05-14 Thread Daniel Kahn Gillmor
Hi Farblos--

On Tue 2024-05-14 21:28:05 +0200, Farblos wrote:
> Should I open another issue about PINENTRY_USER_DATA not being
> forwarded to the pinentry when using the gpg from package gpg-sq/
> gpg-from-sq?  If yes, on what repository exactly?

I would report it at
https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg -- the more you
can explain your specific setup, and reference the gpg documentation
(perhaps the "environment variables" subsection of the FILES section of
gpg(1)?) to justify the behavior would probably help sequoia figure out
what needs fixing for your scenario.

> gpg-from-sq indeed was on my system, and I think it got there because
> of some of aptitude's proposals to resolve broken references.

Thanks for including the apt logs.  I'm still not sure how to replicate
this change.  It looks like some part of gpg was explicitly "held" by
apt?  and the other packages involved during this upgrade run
(libdv4t64, libnetpbm11t64, libopencore-amrnb0, libopencore-amrwb0,
gstreamer1.0-plugins-good, netpbm) don't seem related to GnuPG at all.

And, gpgv itself somehow wasn't held?  Curious!  but i still don't
really understand what happened here, unfortunately ☹

If anyone else has any insights or can suggest other things that Farblos
could report, i'd welcome other suggestions.

  --dkg


signature.asc
Description: PGP signature


Bug#1070688: [pkg-gnupg-maint] Bug#1070688: gnupg: PINENTRY_USER_DATA not passed to pinentry

2024-05-14 Thread Farblos
Hi Daniel,

On 2024-05-08  19:25, Daniel Kahn Gillmor wrote:

thanks for taking care about this in general and this one:

> Thanks, i've reported this part upstream:
> https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg/-/issues/74

in particular.

Should I open another issue about PINENTRY_USER_DATA not being
forwarded to the pinentry when using the gpg from package gpg-sq/
gpg-from-sq?  If yes, on what repository exactly?


With respect to your packaging questions:

> gpg-sq doesn't install any diversions to my knowledge.  the only
> diversions that might be installed are in gpg-from-sq or gpgv-from-sq.

You are right here, I've been sloppy in my wording.

> If those packages were on your system, then they could indeed have
> installed a diversion.  But nothing explicitly depends on those packages
> (try running "apt rdepends gpg{,v}-from-sq") so i'm not sure how they
> got installed during an upgrade.

gpg-from-sq indeed was on my system, and I think it got there because
of some of aptitude's proposals to resolve broken references.

> Perhaps it has something to do with the fact that the packages use the
> Provides field?  If you didn't deliberately install either of the
> *-from-sq packages, and they ended up on your system, is there some way
> that you can replicate the upgrade path?  I'd like to understand that
> better, as i don't think it should have happened by accident.

Unfortunately, I don't think I can explain that fully, but I can try
to provide some more information.  (Even if I'm now rather sure that
this should not affect too many other users ...)

As mentioned before, this all happened in the heat of the t64 upgrade
on a Debian testing system.  For a month or so I would have to wait
until the daily unattended upgrade failed to completely do its job,
then I would use aptitude to manually handle the remaining packages
in a way that wouldn't deinstall anything valuable.  Meaning: In the
aptitude curses front-end I would press "+" on the "Upgradable
Packages" and then cycle through aptitude's proposal on how to
resolve the packages that unattended upgrade (and aptitude) would not
upgrade automatically.

I have attached the interesting bits for that day (2024-05-07) from
my unattended upgrade logs and from the aptitude log below.  If you
think there could be more treasures hidden in my logs (nothing special
configured on my system), please let me know.

> Perhaps there is some signal either package can give to apt to help it
> avoid that problem in the future?

This would be a question for the apt (or aptitude) folks, I think,
but as mentioned above this was probably a rather special case, so
not really worth further effort ...

 unattended-upgrades.log 
2024-05-07 10:28:56,541 INFO Starting unattended upgrades script
2024-05-07 10:28:56,542 INFO Allowed origins are: 
origin=Debian,archive=testing,label=Debian
2024-05-07 10:28:56,542 INFO Initial blacklist: 
2024-05-07 10:28:56,542 INFO Initial whitelist (not strict): 
2024-05-07 10:29:09,972 INFO Packages that will be upgraded: acl e2fsprogs 
elpa-org fwupd gir1.2-lightdm-1 groff-base gstreamer1.0-plugins-base libacl1 
libboost-iostreams1.83.0 libboost-locale1.83.0 libboost-thread1.83.0 libc-bin 
libc-dev-bin libc-l10n libc6 libc6-dev libcairo-gobject2 libcairo2 libcom-err2 
libext2fs2t64 libfftw3-double3 libfftw3-single3 libfwupd2 
libgstreamer-plugins-base1.0-0 liblightdm-gobject-1-0 libp11-kit0 
libpolkit-agent-1-0 libpolkit-gobject-1-0 libsnappy1v5 libsqlite3-0 libss2 
libudisks2-0 lightdm locales logsave org-mode-doc pkexec policykit-1 polkitd 
postfix python-apt-common python3-apt rsyslog sqlite3 udisks2
2024-05-07 10:29:09,973 INFO Writing dpkg log to 
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log
2024-05-07 10:29:46,076 INFO All upgrades installed
2024-05-07 10:29:46,269 INFO Package dirmngr is kept back because a related 
package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,278 INFO Package gnupg is kept back because a related 
package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,278 INFO Package gnupg-l10n is kept back because a related 
package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,278 INFO Package gnupg-utils is kept back because a related 
package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,282 INFO Package gpg is kept back because a related package 
is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,282 INFO Package gpg-agent is kept back because a related 
package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,283 INFO Package gpg-wks-client is kept back because a 
related package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,283 INFO Package gpg-wks-server is kept back because a 
related package is kept back or due to local apt_preferences(5).
2024-05-07 10:29:46,283 INFO Package gpgconf is kept back because 

Bug#1070688: [pkg-gnupg-maint] Bug#1070688: gnupg: PINENTRY_USER_DATA not passed to pinentry

2024-05-08 Thread Daniel Kahn Gillmor
Control: affects 1070688 + gpg-from-sq apt

Hi Farblos, all--

Thanks for this detailed bug report (https://bugs.debian.org/1070688).
I'm a bit confused about the following:

On Wed 2024-05-08 11:07:28 +0200, Farblos wrote:
> Never mind.  During one of the last t64 upgrade orgies package gpg-sq got
> installed on my system and succeeded to install the diversion to /usr/bin/gpg.
> And the sequoia replacement is not very feature complete, as they continue
> to stress themselfes.

gpg-sq doesn't install any diversions to my knowledge.  the only
diversions that might be installed are in gpg-from-sq or gpgv-from-sq.

If those packages were on your system, then they could indeed have
installed a diversion.  But nothing explicitly depends on those packages
(try running "apt rdepends gpg{,v}-from-sq") so i'm not sure how they
got installed during an upgrade.

Perhaps it has something to do with the fact that the packages use the
Provides field?  If you didn't deliberately install either of the
*-from-sq packages, and they ended up on your system, is there some way
that you can replicate the upgrade path?  I'd like to understand that
better, as i don't think it should have happened by accident.

Perhaps there is some signal either package can give to apt to help it
avoid that problem in the future?

> For example, referencing a recipient by exact name with "="
> does not work in gpg-sq, either.

Thanks, i've reported this part upstream:
https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg/-/issues/74

--dkg


signature.asc
Description: PGP signature