{"thread":{"id":"50783","subject":"[PATCH v2 1/1] t/lib-gpg.sh: fix GPG keyring import options","startedAt":"2019-03-19T23:20:19Z","lastAt":"2019-03-20T11:52:45Z","messageCount":3,"participants":["Dave Huseby","Junio C Hamano","SZEDER Gábor"],"isPatch":true,"patchVersion":2,"patchTotal":1},"messages":[{"id":"371935","messageId":"20190319232013.t5pmbgfgojjbczqh@localhost","threadId":"50783","inReplyTo":null,"subject":"[PATCH v2 1/1] t/lib-gpg.sh: fix GPG keyring import options","fromName":"Dave Huseby","fromEmail":"dhuseby@linuxfoundation.org","sentAt":"2019-03-19T23:20:13Z","receivedAt":"2019-03-19T23:20:19Z","isPatch":true,"sender":{"key":"dhuseby@linuxfoundation.org","avatar":null},"body":"Fix the way GPG keyrings are imported during testing to prevent GPG from \nprompting for approval to change the default config. This appears to have no\nadverse affects on GPG users with \"normal\" configurations but fixes the\nalways-interactive prompting I see with my multi-keyring setup.\n\nv2: fixed the whitespace.\n\nSigned-off-by: Dave Huseby <dhuseby@linuxfoundation.org>\n---\n t/lib-gpg.sh | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/t/lib-gpg.sh b/t/lib-gpg.sh\nindex 8d28652b72..e72e0554f1 100755\n--- a/t/lib-gpg.sh\n+++ b/t/lib-gpg.sh\n@@ -32,8 +32,8 @@ then\n \t\tGNUPGHOME=\"$(pwd)/gpghome\" &&\n \t\texport GNUPGHOME &&\n \t\t(gpgconf --kill gpg-agent >/dev/null 2>&1 || : ) &&\n-\t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import \\\n-\t\t\t\"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n+\t\tgpg --import-options merge-only --homedir \"${GNUPGHOME}\" 2>/dev/null \\\n+\t\t\t--import \"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n \t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import-ownertrust \\\n \t\t\t\"$TEST_DIRECTORY\"/lib-gpg/ownertrust &&\n \t\tgpg --homedir \"${GNUPGHOME}\" </dev/null >/dev/null 2>&1 \\\n-- \n2.11.0\n\n"},{"id":"371943","messageId":"xmqqo966wdkr.fsf@gitster-ct.c.googlers.com","threadId":"50783","inReplyTo":"20190319232013.t5pmbgfgojjbczqh@localhost","subject":"Re: [PATCH v2 1/1] t/lib-gpg.sh: fix GPG keyring import options","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2019-03-20T01:15:48Z","receivedAt":"2019-03-20T01:15:53Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Dave Huseby <dhuseby@linuxfoundation.org> writes:\n\n> Fix the way GPG keyrings are imported during testing to prevent GPG from \n> prompting for approval to change the default config. This appears to have no\n> adverse affects on GPG users with \"normal\" configurations but fixes the\n> always-interactive prompting I see with my multi-keyring setup.\n\nI do not quite follow.  If you are personally setting \"always\ninteractive\" somehow, would it be possible to solve the issue more\ndirectly by unsetting \"always interactive\" here?  After all, the\n\"${GNUPGHOME}\" we see in the test helper library is not referring to\nyour setting but our throw-away setting used only during the test,\nso...\n\n> v2: fixed the whitespace.\n\nThis line goes below \"---\"\n\n>\n> Signed-off-by: Dave Huseby <dhuseby@linuxfoundation.org>\n> ---\n>  t/lib-gpg.sh | 4 ++--\n>  1 file changed, 2 insertions(+), 2 deletions(-)\n>\n> diff --git a/t/lib-gpg.sh b/t/lib-gpg.sh\n> index 8d28652b72..e72e0554f1 100755\n> --- a/t/lib-gpg.sh\n> +++ b/t/lib-gpg.sh\n> @@ -32,8 +32,8 @@ then\n>  \t\tGNUPGHOME=\"$(pwd)/gpghome\" &&\n>  \t\texport GNUPGHOME &&\n>  \t\t(gpgconf --kill gpg-agent >/dev/null 2>&1 || : ) &&\n> -\t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import \\\n> -\t\t\t\"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n> +\t\tgpg --import-options merge-only --homedir \"${GNUPGHOME}\" 2>/dev/null \\\n> +\t\t\t--import \"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n\nThis patch, without any explanation in the proposed log message,\ngives an impression that '--import-options merge-only' somehow must\nbe inserted before '--homedir \"${GNUPGHOME}\"'.  If that is truly\nrequired, the reason why it must be done before --homedir needs to\nbe explained in the log message.  If not, inserting before --homedir\nis making the patch unnecessarily misleading.  If the lines were\nlike so:\n\n-\t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import \\\n-\t\t\t\"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n+\t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null \\\n+\t\t\t--import-options merge-only \\\n+\t\t\t--import \"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n\nthe patch wouldn't have forced readers wonder why the new option\nhas to come first.\n\nBut as I said earlier, there needs a better explanation why it helps\nto have --import-options to squelch prompts---the cause-effect linkage\nis a bit too weak to make a convincing case to support why this is\nthe right fix to a problem worth fixing.\n\nThanks.\n\n>  \t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import-ownertrust \\\n>  \t\t\t\"$TEST_DIRECTORY\"/lib-gpg/ownertrust &&\n>  \t\tgpg --homedir \"${GNUPGHOME}\" </dev/null >/dev/null 2>&1 \\\n"},{"id":"372000","messageId":"20190320115234.GA22459@szeder.dev","threadId":"50783","inReplyTo":"20190319232013.t5pmbgfgojjbczqh@localhost","subject":"Re: [PATCH v2 1/1] t/lib-gpg.sh: fix GPG keyring import options","fromName":"SZEDER Gábor","fromEmail":"szeder.dev@gmail.com","sentAt":"2019-03-20T11:52:34Z","receivedAt":"2019-03-20T11:52:45Z","isPatch":true,"sender":{"key":"szeder.dev@gmail.com","avatar":"https://avatars.githubusercontent.com/u/116324?v=4"},"body":"On Tue, Mar 19, 2019 at 04:20:13PM -0700, Dave Huseby wrote:\n> Fix the way GPG keyrings are imported during testing to prevent GPG from \n> prompting for approval to change the default config. This appears to have no\n> adverse affects on GPG users with \"normal\" configurations but fixes the\n> always-interactive prompting I see with my multi-keyring setup.\n> \n> v2: fixed the whitespace.\n> \n> Signed-off-by: Dave Huseby <dhuseby@linuxfoundation.org>\n> ---\n>  t/lib-gpg.sh | 4 ++--\n>  1 file changed, 2 insertions(+), 2 deletions(-)\n> \n> diff --git a/t/lib-gpg.sh b/t/lib-gpg.sh\n> index 8d28652b72..e72e0554f1 100755\n> --- a/t/lib-gpg.sh\n> +++ b/t/lib-gpg.sh\n> @@ -32,8 +32,8 @@ then\n>  \t\tGNUPGHOME=\"$(pwd)/gpghome\" &&\n>  \t\texport GNUPGHOME &&\n>  \t\t(gpgconf --kill gpg-agent >/dev/null 2>&1 || : ) &&\n> -\t\tgpg --homedir \"${GNUPGHOME}\" 2>/dev/null --import \\\n> -\t\t\t\"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n> +\t\tgpg --import-options merge-only --homedir \"${GNUPGHOME}\" 2>/dev/null \\\n> +\t\t\t--import \"$TEST_DIRECTORY\"/lib-gpg/keyring.gpg &&\n\nNormally an Ubuntu 16.04 LTS based box can run all tests with the GPG\nprereq just fine, but with this patch it can't.\n\nAfter making 'lib-gpg.sh' a bit more informative by adding 'set -x'\nand removing the 'gpg ... 2>/dev/null' redirections it appears that\nwith this '--import-options merge-only' GPG can't find the keys:\n\n  $ ./t7612-merge-verify-signatures.sh -V -x\n  + gpg --version\n  + gpg_version=gpg (GnuPG) 1.4.20\n  Copyright (C) 2015 Free Software Foundation, Inc.\n  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\n  This is free software: you are free to change and redistribute it.\n  There is NO WARRANTY, to the extent permitted by law.\n  \n  Home: /home/szeder/src/git/t/trash directory.t7612-merge-verify-signatures/gnupg-home-not-used\n  Supported algorithms:\n  Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA\n  Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,\n          CAMELLIA128, CAMELLIA192, CAMELLIA256\n  Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224\n  Compression: Uncompressed, ZIP, ZLIB, BZIP2\n  + test 0 != 127\n  + mkdir ./gpghome\n  + chmod 0700 ./gpghome\n  + pwd\n  + GNUPGHOME=/home/szeder/src/git/t/trash directory.t7612-merge-verify-signatures/gpghome\n  + export GNUPGHOME\n  + gpgconf --kill gpg-agent\n  + gpg --import-options merge-only --homedir /home/szeder/src/git/t/trash directory.t7612-merge-verify-signatures/gpghome --import /home/szeder/src/git/t/lib-gpg/keyring.gpg\n  gpg: keyring `/home/szeder/src/git/t/trash directory.t7612-merge-verify-signatures/gpghome/secring.gpg' created\n  gpg: keyring `/home/szeder/src/git/t/trash directory.t7612-merge-verify-signatures/gpghome/pubring.gpg' created\n  gpg: key CDDE430D: secret key not found: secret key not available\n  gpg: error reading `/home/szeder/src/git/t/lib-gpg/keyring.gpg': secret key not available\n  gpg: import from `/home/szeder/src/git/t/lib-gpg/keyring.gpg' failed: secret key not available\n  gpg: Total number processed: 0\n  gpg:       secret keys read: 1\n  + test_have_prereq GPG\n  + save_IFS=     \n  \n  + IFS=,\n  + set -- GPG\n  + IFS=  \n  \n  + total_prereq=0\n  + ok_prereq=0\n  + missing_prereq=\n  + negative_prereq=\n  + total_prereq=1\n  + satisfied_this_prereq=\n  + prerequisite=GPG\n  + test -z \n  + missing_prereq=GPG\n  + test 1 = 0\n  + set +x\n  ok 1 # skip create signed commits (missing GPG)\n  [....]\n\n"}]}