usertags 642021 + pca.it-authentication thanks Hi there!
On Wed, 28 Sep 2011 16:20:21 +0200, Werner Koch wrote: > On Tue, 27 Sep 2011 10:50, [email protected] said: > >> 1) remotely-mounted home directories could be a problem if their >> filesystems do not support fifos or sockets. And Debian cares about >> NFS-mounted home directories: > > Right. However the majority of users don't have NFS mounted home > directories and those who have do have an admin to ask what to do. > gpg-agent provides an option to revert back to the old behaviour/ The final decision is for the Debian maintainer. However, I would say that in the Debian world this will be a regression if we stop supporting NFS-mounted home directories because of such decision. >> 2) gpg-agent's manpage still thinks that using GPG_AGENT_INFO is the >> first choice and *then* falling back to the standard socket: > > Quite possible. Our development resources are limited and updates to > the documentation of the stable release is unfortunately not a primary > target. It is your call. >> 3) Debian gpg-agent_2.0.18 is compiled without --enable-standard-socket, >> but this is easily fixable ;-) > > That might be a good thing to do. It would give us some feedback. Again, the final decision is for the Debian maintainer. I want to fix the broken behavior in Debian *now* in the easiest way. >> I would say that we should also check if the agent is running: >> >> if [ "$PS1" ] && gpg-agent 2>/dev/null; then > > There is no need for it. Really. If you want the agent for ssh, you > may simply start it in the interactive shell > > gpg-connect-agent /bye > > it does nothing if the agent is already running. Does it take into account another ssh-agent running? Please see #642012 for the other part of the problem in Debian: <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642012> >> Going back to the subject: what is the reason for the environment file >> not being deleted when quitting? As I wrote in my first email, I have > > You can't delete the environment variables either. > > Deleting the file may also exhibit a race if at the same time another > agent is started. Note also that gpg-agent terminates itself if it > detects another running instance or a started child process has > terminated. We are talking about something which is executed as part of the login process, which means that: 1) the variables are not set, because there is no gpg-agent running. 2) the variables are read from an PID file left by an old (i.e. dead) gpg-agent, thus unsetting them is fine. 3) there is another gpg-agent running (e.g. from a console login), whose variables are read from the PID file, the check for a running gpg-agent will simply be true and thus no new gpg-agent will be started. Please note that I tested all the three possible behaviors above, given that I *want* Debian to support an X login with another gpg-agent started on a previous console login. >> fail to see why ATM only the sockets are deleted. If there is no socket >> gpg-agent is not running, thus keeping the now-useless environment >> variables somewhere does not seem right to me. > > You can't remove environment variables of another process. See above. I ended up with a solution *only* for the Debian package and tested that on my sid, Git patch to the Debian package attached. Test packages fixing #444103, #642012 and #642021 are available at: <http://people.debian.org/~gismo/tmp/gnupg2_2.0.18-3~gismo444103.642012.642021.1.dsc> Thx, bye, Gismo / Luca
From 46a02bb8eff23901749f15d8acb6faec3705de8c Mon Sep 17 00:00:00 2001 From: Luca Capello <[email protected]> Date: Tue, 21 Feb 2012 13:01:20 +0100 Subject: [PATCH 3/3] debian/gnupg-agent.xsession: (#642021) already running gpg-agent --- debian/changelog | 1 + debian/gnupg-agent.xsession | 12 +++++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/debian/changelog b/debian/changelog index 0321edf..61d50c7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,7 @@ gnupg2 (2.0.18-3) UNRELEASED; urgency=low (Closes: #444103). + fix behavior with /etc/X11/Xsession.d/90x11-common_ssh-agent (Closes: #642012). + + fix behavior with an already running gpg-agent (Closes: #642021). -- diff --git a/debian/gnupg-agent.xsession b/debian/gnupg-agent.xsession index fe2b275..8f029b7 100644 --- a/debian/gnupg-agent.xsession +++ b/debian/gnupg-agent.xsession @@ -9,6 +9,12 @@ if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf" "$GNUPGHOME/options" if [ -r "$PID_FILE" ]; then . "$PID_FILE" + ## <http://bugs.debian.org/642021> + # sourcing the "$PID_FILE" is not enough to support an already + # running gpg-agent, see its manpage + export GPG_AGENT_INFO + export SSH_AGENT_PID + export SSH_AUTH_SOCK fi # Invoking gpg-agent with no arguments exits successfully if the agent @@ -17,9 +23,9 @@ if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf" "$GNUPGHOME/options" ## <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642012#22> # if there is no gpg-agent running, then "$PID_FILE" comes from # an old gpg-agent - if [ -w "$PID_FILE" ]; then - rm -rf "$PID_FILE" - fi + ## <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642021#33> + # not deleting the $PID_FILE because according to GnuPG upstream this + # "may also exhibit a race if at the same time another agent is started" unset GPG_AGENT_INFO unset SSH_AGENT_PID unset SSH_AUTH_SOCK -- 1.7.8.3
pgp8RJ6NdASRo.pgp
Description: PGP signature
