Changeset d70dd6e in mod_gnutls

Timestamp:

May 27, 2016, 8:12:04 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

298dc66

Parents:

0bda20f

git-author:

Daniel Kahn Gillmor <dkg@…> (04/17/16 16:22:45)

git-committer:

Thomas Klute <thomas2.klute@…> (05/27/16 20:12:04)

Message:

ensure cleanup of gpg v2.1 keyrings as well

depending on the version of gpg, the choices of secret keyrings, and
the behavior when exporting secret key material is different.

for example, see ​https://bugs.gnupg.org/gnupg/issue2324, and the fact
that secret keys are stored in different locations.

This change allows the test suite to work with all known major
versions of GnuPG.

Location:

test

Files:

• Makefile.am (modified) (3 diffs)
• pgpcrc.c (added)
• test_ca.mk (modified) (2 diffs)

test/Makefile.am

@@ -42 +42 @@
 # Append strings after ":=" to each identity to generate a list of
 # necessary files
-pgp_tokens = $(pgp_identities:=/secring.gpg) $(pgp_identities:=/cert.pgp) \
+pgp_tokens = $(pgp_identities:=/cert.pgp) \
         $(pgp_identities:=/secret.pgp)
 x509_keys = $(x509_identities:=/secret.key)
@@ -93 +93 @@
 # one day, so regenerating them is both fast and frequently
 # necessary.
-MOSTLYCLEANFILES += */*.pgp */*.gpg */*.gpg~ */gpg.conf authority/lock
+MOSTLYCLEANFILES += */*.pgp */*.gpg */*.gpg~ */gpg.conf authority/lock */*.kbx */*.kbx~ */S.gpg-agent */private-keys-v1.d/*
 # GnuPG random pool, no need to regenerate on every build
 CLEANFILES += authority/random_seed
@@ -149 +149 @@
         -rmdir $(msva_home) || true
 endif
+        rm -f pgpcrc
 
 # Apache configuration and data files

test/test_ca.mk

@@ -3 +3 @@
 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 # Thomas Klute <thomas2.klute@uni-dortmund.de>
+
+pgpcrc: pgpcrc.c
+        gcc -o $@ $<
 
 # General rules to set up a miniature CA & server & client environment
@@ -18 +21 @@
         certtool --generate-privkey > $@
 
-%/secring.gpg: %.uid %/secret.key
-        rm -f $(dir $@)pubring.gpg $(dir $@)secring.gpg $(dir $@)trustdb.gpg
-        PEM2OPENPGP_EXPIRATION=86400 PEM2OPENPGP_USAGE_FLAGS=authenticate,certify,sign pem2openpgp "$$(cat $<)" < $(dir $@)secret.key | GNUPGHOME=$(dir $@) gpg --import
+%/secret.pgp.raw: %.uid %/secret.key
+        PEM2OPENPGP_EXPIRATION=86400 PEM2OPENPGP_USAGE_FLAGS=authenticate,certify,sign pem2openpgp "$$(cat $<)" < $(dir $@)secret.key > $@
+
+%/secret.pgp: %/secret.pgp.raw pgpcrc
+        (printf -- '-----BEGIN PGP PRIVATE KEY BLOCK-----\nVersion: test\n\n' && \
+        base64 < $< && \
+        printf -- '=' && \
+        ./pgpcrc < $< | base64 && \
+        printf -- '-----END PGP PRIVATE KEY BLOCK-----\n' ) > $@
+
+%/gpg.conf: %/secret.pgp
+        rm -f $(dir $@)pubring.gpg $(dir $@)secring.gpg $(dir $@)trustdb.gpg $(dir $@)pubring.kbx $(dir $@)private-keys-v1.d/*.key
+        GNUPGHOME=$(dir $@) gpg --import $<
         printf "%s:6:\n" "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)" | GNUPGHOME=$(dir $@) gpg --import-ownertrust
-
-%/gpg.conf: %/secring.gpg
         printf "default-key %s\n" "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)" > $@
 
-%/secret.pgp: %/secring.gpg
-        GNUPGHOME=$(dir $@) gpg --armor --batch --no-tty --yes --export-secret-key "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)" > $@
-
-%/minimal.pgp: %/secring.gpg
-        GNUPGHOME=$(dir $@) gpg --armor --export "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)" > $@
+%/minimal.pgp: %/gpg.conf
+        GNUPGHOME=$(dir $@) gpg --output $@ --armor --export "$$(GNUPGHOME=$(dir $@) gpg --with-colons --list-secret-keys --fingerprint | grep ^fpr: | cut -f 10 -d :)"
 
 # Import and signing modify the shared keyring, which leads to race