Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Andrew Ruthven]

On Wed, 2021-02-10 at 22:01 +, Dominic Hargreaves wrote:
> On Sun, Feb 07, 2021 at 11:42:43PM +, Dominic Hargreaves wrote:
> > Andrew, was this intentional? Maybe we should just restore that
> > part
> > of the patch?
> 
> Ah, I expect the change to /usr/bin/gpg was lost when applying an
> altered upstream version of the patch. So my tentative fix
> was correct and just the previous behaviour, with the upstream
> changes and the Debian-specific changes now in separate files.
> Uploaded.

You are correct, that was accidental while I was updating the patches.
You fix looks correct to me. Thank you!

Cheers,
Andrew
-- 
Andrew Ruthven, Wellington, New Zealand
and...@etc.gen.nz |
Catalyst Cloud:   | This space intentionally left blank
 https://catalystcloud.nz |

Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Dominic Hargreaves]

On Sun, Feb 07, 2021 at 11:42:43PM +, Dominic Hargreaves wrote:
> [Adding Andrew as the person who has recently worked on the package]
> 
> On Sun, Feb 07, 2021 at 03:28:48PM -0500, Aaron M. Ucko wrote:
> > Dominic Hargreaves  writes:
> > 
> > > As a hunch, I changed the default from 'gpg' to '/usr/bin/gpg'.
> > > Could you install this on your system and confirm whether it fixes
> > > the problem?
> 
> (the tentative fix was at
> )
> 
> > I must confess that I haven't actually fully deployed MonkeySphere, so I
> > can't test the change quite as thoroughly as it perhaps deserves, but
> > AFAICT this tweak is sufficient: I can log in without incident, and both
> > dh_auto_test calls to succeed (albeit noisily) with
> > 
> >   -- FULLPERL='/usr/bin/perl -t'
> > 
> > appended.  (Full -T appears to break the test harness, but -t suffices
> > to trigger the PATH-clearing logic.)
> 
> In fact, I've just realised that this regression comes from reverting
> a functionality equivalent (part of a) patch in the latest upload.
> This looks like it might have been unintentional?
> 
> https://salsa.debian.org/perl-team/modules/packages/libgnupg-interface-perl/-/commit/a96ae3047570483e96da309008d4110f16824ed5#f37d120361709f5984c8a7d93302241dc341b4b3_1_1
> 
> Andrew, was this intentional? Maybe we should just restore that part
> of the patch?

Ah, I expect the change to /usr/bin/gpg was lost when applying an
altered upstream version of the patch. So my tentative fix
was correct and just the previous behaviour, with the upstream
changes and the Debian-specific changes now in separate files.
Uploaded.

Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Dominic Hargreaves]

[Adding Andrew as the person who has recently worked on the package]

On Sun, Feb 07, 2021 at 03:28:48PM -0500, Aaron M. Ucko wrote:
> Dominic Hargreaves  writes:
> 
> > As a hunch, I changed the default from 'gpg' to '/usr/bin/gpg'.
> > Could you install this on your system and confirm whether it fixes
> > the problem?

(the tentative fix was at
)

> I must confess that I haven't actually fully deployed MonkeySphere, so I
> can't test the change quite as thoroughly as it perhaps deserves, but
> AFAICT this tweak is sufficient: I can log in without incident, and both
> dh_auto_test calls to succeed (albeit noisily) with
> 
>   -- FULLPERL='/usr/bin/perl -t'
> 
> appended.  (Full -T appears to break the test harness, but -t suffices
> to trigger the PATH-clearing logic.)

In fact, I've just realised that this regression comes from reverting
a functionality equivalent (part of a) patch in the latest upload.
This looks like it might have been unintentional?

https://salsa.debian.org/perl-team/modules/packages/libgnupg-interface-perl/-/commit/a96ae3047570483e96da309008d4110f16824ed5#f37d120361709f5984c8a7d93302241dc341b4b3_1_1

Andrew, was this intentional? Maybe we should just restore that part
of the patch?

Dominic

Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Aaron M. Ucko]

Dominic Hargreaves  writes:

> As a hunch, I changed the default from 'gpg' to '/usr/bin/gpg'.
> Could you install this on your system and confirm whether it fixes
> the problem?

I must confess that I haven't actually fully deployed MonkeySphere, so I
can't test the change quite as thoroughly as it perhaps deserves, but
AFAICT this tweak is sufficient: I can log in without incident, and both
dh_auto_test calls to succeed (albeit noisily) with

  -- FULLPERL='/usr/bin/perl -t'

appended.  (Full -T appears to break the test harness, but -t suffices
to trigger the PATH-clearing logic.)

Thanks!

-- 
Aaron M. Ucko, KB1CJC (amu at alum.mit.edu, ucko at debian.org)
http://www.mit.edu/~amu/ | http://stuff.mit.edu/cgi/finger/?a...@monk.mit.edu

Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Dominic Hargreaves]

On Tue, Feb 02, 2021 at 10:09:45AM -0500, Aaron M. Ucko wrote:
> Package: libgnupg-interface-perl
> Version: 1.01-1
> Severity: important
> Tags: upstream
> X-Debbugs-Cc: msva-p...@packages.debian.org
> Control: affects -1 msva-perl
> 
> [Copying msva-perl maintainers.]
> 
> My X session normally boils down to
> 
> exec /usr/bin/ssh-agent /usr/bin/monkeysphere-validation-agent 
> /usr/bin/im-launch x-session-manager
> 
> where /usr/bin/monkeysphere-validation-agent resolves (via the
> alternatives system) to /usr/bin/msva-perl.  With this setup,
> libgnupg-interface-perl 1.01 attempts to run gpg with no PATH and
> bails because it couldn't find an acceptable version of gpg, thereby
> immediately crashing msva-perl and my entire X session.
> 
> I'm not entirely sure what triggers the PATH-clearing here, perhaps
> the fact that ssh-agent is setgid ssh.  Regardless, I'd suggest
> setting a sane PATH that includes at minimum /bin and /usr/bin rather
> than clearing PATH entirely.  (Explicitly running /usr/bin/gpg might
> also work.)
> 
> Could you please take a look?

As a hunch, I changed the default from 'gpg' to '/usr/bin/gpg'.
Could you install this on your system and confirm whether it fixes
the problem?

https://salsa.debian.org/perl-team/modules/packages/libgnupg-interface-perl/-/tree/hardcode-gpg-path

Cheers
Dominic

Bug#981647: libgnupg-interface-perl 1.01 breaks ssh-agent msva-perl ...

[Aaron M. Ucko]

Package: libgnupg-interface-perl
Version: 1.01-1
Severity: important
Tags: upstream
X-Debbugs-Cc: msva-p...@packages.debian.org
Control: affects -1 msva-perl

[Copying msva-perl maintainers.]

My X session normally boils down to

exec /usr/bin/ssh-agent /usr/bin/monkeysphere-validation-agent 
/usr/bin/im-launch x-session-manager

where /usr/bin/monkeysphere-validation-agent resolves (via the
alternatives system) to /usr/bin/msva-perl.  With this setup,
libgnupg-interface-perl 1.01 attempts to run gpg with no PATH and
bails because it couldn't find an acceptable version of gpg, thereby
immediately crashing msva-perl and my entire X session.

I'm not entirely sure what triggers the PATH-clearing here, perhaps
the fact that ssh-agent is setgid ssh.  Regardless, I'd suggest
setting a sane PATH that includes at minimum /bin and /usr/bin rather
than clearing PATH entirely.  (Explicitly running /usr/bin/gpg might
also work.)

Could you please take a look?

Thanks!

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-2-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libgnupg-interface-perl depends on:
ii  gnupg   2.2.20-1
pn  libautodie-perl 
ii  libmoo-perl 2.004004-1
ii  libmoox-handlesvia-perl 0.001009-1
ii  libmoox-late-perl   0.100-1
ii  perl [libmath-bigint-perl]  5.32.0-6

libgnupg-interface-perl recommends no packages.

libgnupg-interface-perl suggests no packages.

-- no debconf information