[SRU] torbrowser-launcher has missing gnupg dependency
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
torbrowser-launcher (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Thomas Ward |
Bug Description
[Impact]
torbrowser-
As such, we require gnupg/gnupg2 to be installed as a dependency.
Further, we also require to use the actual /usr/bin/gnupg binary as there are cases where /usr/bin/gnupg2 does *not* symlink back to the gnupg binary.
[Test Case]
(1) Use a clean installation (not an upgrade from 18.04) of Ubuntu 20.04 where torbrowser-launcher was not installed and configured before.
(2) Install torbrowser-
(3) Run torbrowser-launcher from a terminal.
(4) torbrowser-launcher will crash during signature verification:
$ torbrowser-launcher
Tor Browser Launcher
By Micah Lee, licensed under MIT
version 0.3.2
https:/
Creating GnuPG homedir /home/user/
Downloading Tor Browser for the first time.
Downloading https:/
Latest version: 9.5.4
Downloading https:/
Downloading https:/
Verifying Signature
Refreshing local keyring...
Traceback (most recent call last):
File "/usr/lib/
c.verify(
File "/usr/lib/
raise errors.
gpg.errors.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/
verify()
File "/usr/lib/
raise Exception
Exception
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/
self.
File "/usr/lib/
'--
File "/usr/lib/
restore_
File "/usr/lib/
raise child_exception
FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/gpg2': '/usr/bin/gpg2'
Aborted
[Regression Potential]
Limited regression potential - requiring gnupg is not insane here, and using the non-symlinked binary is also a sane change.
[racb] We're changing the binary name used to call gpg, so users with unusual system configurations who don't have a valid /usr/bin/gpg, or have wrapped the old name or similar may be affected.
[Original Bug Description]
The torbrowser-launcher package does not depend on gnupg/gnupg2 on Ubuntu 20.04. This results in torbrowser-launcher not working on some Ubuntu flavors that do not have gnupg installed by-default. Also, torbrowser-launcher calls /usr/bin/gpg2 instead of /usr/bin/gpg. The /usr/bin/gpg2 is just a symlink to /usr/bin/gpg on Debian/Ubuntu, provided by gnupg2 package that is not installed by-default on some Ubuntu-based systems (including Linux Mint), even if they have gnupg installed out-of-box.
The following patch and debian/control update fix the issue:
https:/
https:/
The first link contain a patch that replaces /usr/bin/gpg2 with /usr/bin/gpg in torbrowser-launcher code.
The second link contain a change adding gnupg as torbrowser-launcher dependency to debian/control.
It is already fixed in Groovy.
description: | updated |
Changed in torbrowser-launcher (Ubuntu): | |
status: | New → Confirmed |
status: | Confirmed → Fix Released |
Changed in torbrowser-launcher (Ubuntu Focal): | |
status: | New → In Progress |
assignee: | nobody → Thomas Ward (teward) |
summary: |
- torbrowser-launcher has missing gnupg dependency + [SRU] torbrowser-launcher has missing gnupg dependency |
description: | updated |
description: | updated |
tags: | removed: verification-needed |
In discussion with SRU team, we've determined this si a Mint only issue. Therefore "Ubuntu Flavors" does not apply as we do not have any affiliation or official recognition of Mint as an Ubuntu flavor.
This part of the SRU will be Won't Fix, and won't be addressed here. Mint can fix their own issues introduced by this not being available on their own repositories.