Changeset 04addef in mod_gnutls for test/test_ca.mk

Timestamp:

Jun 13, 2016, 1:32:44 AM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

16ad0eb

Parents:

0831437

Message:

Test suite: Always lock authority PGP keyring

I've occasionally observed PGP authentication failing in
test-14_basic_openpgp.bash due to problems with server/cert.pgp. Debug
runs and analysis of GnuTLS source code point at problems with the
exported signatures.

The former lack of locking during exports from the authority seems
like the likeliest culprit: a parallel access might have damaged the
keyring, in particular key and signature creation times.

File:

• test/test_ca.mk (modified) (1 diff)

test/test_ca.mk

@@ -43 +43 @@
 
 # Import and signing modify the shared keyring, which leads to race
-# conditions with parallel make. Locking avoids this problem.
-%/cert.pgp: %/minimal.pgp authority/gpg.conf
+# conditions with parallel make. Locking avoids this problem. Building
+# authority/minimal.pgp (instead of just authority/gpg.conf) before
+# */cert.pgp avoids having to lock for all */minimal.pgp, too.
+%/cert.pgp: %/minimal.pgp authority/minimal.pgp
         if test -r $@; then rm $@; fi
         GNUPGHOME=authority $(GPG_FLOCK) gpg --import $<
         GNUPGHOME=authority $(GPG_FLOCK) gpg --batch --sign-key --no-tty --yes "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)"
-        GNUPGHOME=authority gpg --output $@ --armor --export "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)"
+        GNUPGHOME=authority $(GPG_FLOCK) gpg --output $@ --armor --export "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)"
 
 # special cases for the authorities' root certs: