Re: [RFH] gpg --import entropy while running tests

From: Jeff King <peff@peff.net>
Date: Dec 28, 2016, 08:02 UTC
Message-ID: <20161228080230.wygcmdmwvifcthvl@sigill.intra.peff.net>
In-Reply-To: <20161228072303.4wbhkwf37fvgpi7h@sigill.intra.peff.net>

On Wed, Dec 28, 2016 at 02:23:03AM -0500, Jeff King wrote:

Show 16 quoted lines

> That's a lot of time not using any CPU. What's going on? Running with
> "sh -x" shows that we spend most of the time in this line from
> lib-gpg.sh:
> 
>   gpg --homedir "${GNUPGHOME}" 2>/dev/null --import \
> 	  "$TEST_DIRECTORY"/lib-gpg/keyring.gpg
> 
> And running gpg with "--debug-level guru" shows that we are blocking
> while waiting for entropy. Has anybody else seen this? I feel like I
> noticed it starting a few weeks ago, and indeed dropping back to gpg
> 2.0.26 (from 2.1.17) makes the problem go away.
> 
> Is it a bug in gpg (oddly, the kernel reports lots of entropy available,
> and generating the signatures themselves is quite fast)? Or is the new
> version doing something special in the import process that we need to
> work around or disable?

Answering my own question (somewhat): this is bisectable in the gnupg repository, and it turns out to be caused by their 4473db1ef (agent: Kludge to mitigate blocking calls in Libgcrypt., 2016-11-11), which introduces a 100ms sleep (yuck) that is presumably triggering way more than it needs to. More details at:

  https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=4473db1ef24031ff4e26c9a9de95dbe898ed2b97

So this does seem like a gpg bug.

-Peff