#120 gpg_fingerprint doesn't work : Failures in"Autoset trust of key"

[Nirgal Vourgère]

Hello

I occasionally restore servers by installing a basic server, recovering the /root/.duply and then use duply restore.
At that point, I don't have a gnupg home, so that that keys are imported on first run. This works fine.
However, then, the key needs to be trusted, and it always fail.

Step to reproduce:

mv .gnupg .gnupg.bak
duply ... status

You then get something like:

Encryption public key 'DEBF3E88927A9346' not found.
Import keyfile '/root/.duply/hosname/gpgkey.DEBF3E88927A9346.pub.asc' to keyring (OK)
Import keyfile '/root/.duply/hosname/gpgkey.DEBF3E88927A9346.sec.asc' to keyring (OK)
Autoset trust of key 'DEBF3E88927A9346' to ultimate (FAILED)
For duply to work you have to set the trust level
with the command "trust" to "ultimate" (5) now.
Exit the edit mode of gpg with "quit".
Running gpg to manually edit key 'DEBF3E88927A9346'Secret key is available.

This is really annoying.

I traced back the issue to the function gpg_fingerprint that's not working.

The attached patch fixes the issue.

Thank you

[ede]

hi,

looks like gpg changed its output inbetween. can you specify the gpg version where it broke?

thanks.. ede

[Nirgal Vourgère]

Hi

This cannot be related to gpp version, no:

The awk script uses the line #2 of gpg output (this is what the "NR==2" is about).
Then somehow, all the remaining awk script uses $2 while we have "-F= " (meaning no field separator) so that all the input is in $1. My knowledge of awk is pretty limited, but you can try
gpg --fingerprint "edso@domain.com" | awk -F= 'NR==2{print $1}'
and
gpg --fingerprint "edso@domain.com" | awk -F= 'NR==2{print $2}'
to realize that there is nothing in $2.

gpg_fingerprint is a 2 lines function, fell free to try it in your bash!
Remember that $ is not escaped by bash when enclosed in single quotes.

This probably has been broken for a loooong time.

[ede]

On 16.02.2020 14:43, "Nirgal Vourgère" wrote:

Hi

This cannot be related to gpp version, no:

The awk script uses the line #2 of gpg output (this is what the "NR==2" is about).

does it now? ;)

Then somehow, all the remaining awk script uses $2 while we have "-F= " (meaning no field separator) so that all the input is in $1.

hmm. right that looks pretty fishy.

My knowledge of awk is pretty limited, but you can try
gpg --fingerprint "edso@domain.com" | awk -F= 'NR==2{print $1}'
and
gpg --fingerprint "edso@domain.com" | awk -F= 'NR==2{print $2}'
to realize that there is nothing in $2.

hmm. works for me. see below

:~> gpg --fingerprint 7CDF5D28
pub 1024D/7CDF5D28 2011-05-02
Schl.-Fingerabdruck = 5DF0 456D 5F7C 2000 23C0 21A8 D893 80B7 7CDF 5D28

:~> gpg --fingerprint 7CDF5D28 | awk -F= 'NR==2{print $2}'
5DF0 456D 5F7C 2000 23C0 21A8 D893 80B7 7CDF 5D28

maybe an issue with awk? my test system uses gawk. yours?

gpg_fingerprint is a 2 lines function, fell free to try it in your bash!
Remember that $ is not escaped by bash when enclosed in single quotes.

yeah. no. $ is properly escaped by single quotes (') but not by double quotes ("). ;)
e.g.

:~> echo gpg --fingerprint 7CDF5D28 | awk -F= 'NR==2{gsub(/ /,"",$2);$2=toupper($2); if ( $2 ~ /^[A-F0-9]+$/ && length($2) == 40 ) print $2; else exit 1}'
gpg --fingerprint 7CDF5D28 | awk -F= NR==2{gsub(/ /,"",$2);$2=toupper($2); if ( $2 ~ /^[A-F0-9]+$/ && length($2) == 40 ) print $2; else exit 1}

This probably has been broken for a loooong time.

possible. i am not running unit tests. especially testing on different platforms is merely done during development. this one might have slipped trough.

so you are saying it never worked for you. do i get that right?

..ede/duply.net

[ede]

On 16.02.2020 14:43, "Nirgal Vourgère" wrote:

This cannot be related to gpp version, no:

hmm. just tried gpg 1.x - 2.1 and they all spit out

pub 1024D/7CDF5D28 2011-05-02
Schl.-Fingerabdruck = 5DF0 456D 5F7C 2000 23C0 21A8 D893 80B7 7CDF 5D28
uid test nopass
sub 1024g/8AB13891 2011-05-02

on another system using a test key and gpg 2.2 the output looks like this

pub rsa2048 2020-02-16 [SCEA]
2C26 9D50 E2B6 9D2F 131E 95BC 3B02 9748 CB18 7EE6
uid [ ultimativ ] test
sub rsa2048 2020-02-16 [SEA]

looks like gpg changed the output format, wouldn't you agree?

i'll work up a patch to work with both outputs soon. will you be willing to doublecheck the result?

..ede/duply.net

[Nirgal Vourgère]

The format changed indeed. My appologies.

I'm using Debian, where this has been broken for at least 3 years.

My awk version is "GNU Awk 4.2.1, API: 2.0 (GNU MPFR 4.0.2, GNU MP 6.1.2)"

In awk, "-F=" actually means "=" is the field separator.

awk -F= 'NR==2{ gsub(/ /,"",$1); $1=toupper($1); gsub(/ /,"",$2); $2=toupper($2); if ( $1 ~ /^[A-F0-9]+$/ && length($1) == 40 ) print $1; else if ( $2 ~ /^[A-F0-9]+$/ && length($2) == 40 ) print $2 ; else exit 1 }'

should be working in both cases.

[ede]

a little bit long. found a shorter approach. please try the latest snapshot
http://duply.net/wiki/index.php/Duply-code#Latest_Development_Snapshot

thanks.. ede/duply.net

[Nirgal Vourgère]

The gpg_fingerprint function works here, with gpg (GnuPG) 2.2.12
I have no simple way to test gpg 1.x

I let you close this issue.

Thank you :)

[ede]

thank you for your kind permission ;)
will be released soonish.

.. ede/duply.net