Re: [PATCH 1/3] gpg-interface/gpgsm: fix for v2.3

From: Todd Zullinger <tmz@pobox.com>
Date: Feb 28, 2022, 17:57 UTC
Message-ID: <Yh0NHkyquB7nht3W@pobox.com>
In-Reply-To: <20220224100628.612789-1-fs@gigacodes.de>

Hi,

Fabian Stelzer wrote:

Show 10 quoted lines

> gpgsm v2.3 changed some details about its output:
>  - instead of displaying `fingerprint:` for keys it will print `sha1
>    fpr:` and `sha2 fpr:`
>  - some wording of errors has changed
>  - signing will omit an extra debug output line before the [GNUPG]: tag
> 
> This change adjusts the gpgsm test prerequisite to work with v2.3 as
> well by accepting `sha1 fpr:` as well as `fingerprint:`. To make this
> parsing more robust switch to gpg's `--with-colons` output format.
> Also allow both variants of errors for unknown certs.

I ran this series through the fedora buildsystem on releases with gnupg 2.2 and 2.3. All the tests pass, as expected.

I think we may be able to simplify the wording above and the patch below regarding the fingerprint/shaN fpr output change, I'll add a comment below the changed hunk.

Show 15 quoted lines

> diff --git a/t/lib-gpg.sh b/t/lib-gpg.sh
> index 3e7ee1386a..e997ce10ea 100644
> --- a/t/lib-gpg.sh
> +++ b/t/lib-gpg.sh
> @@ -72,12 +72,10 @@ test_lazy_prereq GPGSM '
>  		--passphrase-fd 0 --pinentry-mode loopback \
>  		--import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
>  
> -	gpgsm --homedir "${GNUPGHOME}" -K |
> -	grep fingerprint: |
> -	cut -d" " -f4 |
> -	tr -d "\\n" >"${GNUPGHOME}/trustlist.txt" &&
> +	gpgsm --homedir "${GNUPGHOME}" -K --with-colons |
> +	awk -F ":" "/^(fpr|fingerprint):/ {printf \"%s S relax\\n\", \$10}" \
> +		>"${GNUPGHOME}/trustlist.txt" &&

Using --with-colons to parse the output, we shouldn't be affected by the changed output. The pattern for awk can be simplified to '^fpr:' as older and newer versions of gnupg have used that string in the --with-colons output for many, many years.

Perhaps that allows the commit message to say less about the specific's the gnugp-2.3 output change and just mention that it changed and using --with-colons is the preferred way to parse the output (where we must parse output at all).

    Switch to gpg's `--with-colons` output format to make
    parsing more robust.  This avoids issues where the
    human-readable output from gpg commands changes.

or something?

Thanks,

-- 
Todd