mandos-client hangs during installation

[Grondr]

Binary package hint: mandos

In Ubuntu karmic (development branch) [last ran update-manager sometime earlier today], mandos server & client 1.0.11-1build1, in a system originally installed from the AMD64 alternate install (Linux 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC 2009 x86_64 GNU/Linux):

I just used Synaptic to attempt to install mandos and mandos-client, and it hung partway through, during the installation of mandos-client. It's not using any runtime; it's just wedged. The last few lines in Synaptic's progress output were:

Setting up mandos (1.0.11-1build1) ...
/usr/sbin/mandos:52: DeprecationWarning: the sets module is deprecated
  from sets import Set
mandos [2281]: WARNING: No clients defined

Setting up mandos-client (1.0.11-1build1) ...
gpg: WARNING: some OpenPGP programs can't handle a DSA key with this digest size
.+++++++++++++++++++++++++......++++++++++..++++++++++.++++++++++..+++++.++++++++++.+++++++++++++++++++++++++..++++++++++.++++++++++.++++++++++++++++++++++++++++++>.+++++++++++++++++++++++++...................................\.............+++++

...and then nothing. The relevant lines from ps -elf --forest:

4 S root 2107 2042 7 80 0 - 53930 poll_s 00:54 pts/0 00:00:22 | \_ synaptic
1 S root 2121 2107 0 80 0 - 53778 poll_s 00:55 pts/1 00:00:00 | \_ synaptic
0 S root 2228 2121 0 80 0 - 3766 wait 00:55 pts/2 00:00:00 | \_ /usr/bin/dpkg --status-fd 32 --configure fping python-gnutls mandos mandos-client
0 S root 2284 2228 0 80 0 - 1001 wait 00:55 pts/2 00:00:00 | \_ /bin/sh -e /var/lib/dpkg/info/mandos-client.postinst configure
0 S root 2287 2284 0 80 0 - 1001 wait 00:55 pts/2 00:00:00 | \_ /bin/sh -e /usr/sbin/mandos-keygen
4 S root 2294 2287 0 80 0 - 4997 poll_s 00:55 pts/2 00:00:02 | \_ gpg --quiet --batch --no-tty --no-options --enable-dsa2 --homedir /tmp/mandos-keygen-keyrings.26PnaFOZwF --trust-m\o

It's now been hung for half an hour or so.

Oh wait, WTF? At some point while I was assembling this bug report, it printed more output:

..++++++++++...+++++++++++++++..+++++++++++++++.++++++++++.++++++++++.+++++....++++++++++.++++++++++.++++++++++.+++++++++++++++++++++++++.++++++++++..+++++++++++++++>++++++++++>+++++.......................+++++^^^^^
update-initramfs: Generating /boot/initrd.img-2.6.31-14-generic
update-initramfs: Generating /boot/initrd.img-2.6.31-13-generic
update-initramfs: Generating /boot/initrd.img-2.6.31-11-generic

Processing triggers for python-support ...

...and then declared that it had finished.

So it looks like it hung for a LOOONG time between generating a pair of keys (I'm guessing, since it printed two separate lines of plusses and minuses). Something that can (a) hang for 30 minutes and (b) use no CPU time during that hang will make everything think there's a bug there, and I'm reasonably sure there is. Certainly it shouldn't take that long to generate keys on a fast machine (and it wasn't using CPU), and I believe it had actually finished generating that first line of +/- in seconds and that it wasn't accomplishing any useful work for half an hour until it generated the second line. Maybe GPG ran out of entropy until it had time to gather more? The machine had been up about an hour before I tried the installation, and had one window open via its native display (just an xterm that I did a ps on to debug it) and two ssh sessions and one Firefox (this one); the latter two of which I started in order to debug and which clearly weren't enough on their own to give the machine more entropy (since they'd been up for 20-30 minutes before the installation suddenly continued). If it really -is- running out of entropy, then the installer should attempt to warn the user or something, but it's hard to believe it hasn't seen enough activity to collect enough bits.

ProblemType: Bug
Architecture: amd64
Date: Mon Oct 19 01:05:41 2009
DistroRelease: Ubuntu 9.10
Package: mandos 1.0.11-1build1
PackageArchitecture: all
ProcEnviron:
 LC_COLLATE=C
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: mandos
Uname: Linux 2.6.31-14-generic x86_64
XsessionErrors:
 (gnome-settings-daemon:1870): GLib-CRITICAL **: g_propagate_error: assertion `src != NULL' failed
 (gnome-settings-daemon:1870): GLib-CRITICAL **: g_propagate_error: assertion `src != NULL' failed
 (polkit-gnome-authentication-agent-1:1953): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed
 (nautilus:1929): Eel-CRITICAL **: eel_preferences_get_boolean: assertion `preferences_is_initialized ()' failed

[Mandos Maintainers (mandos-maintainers)]

This is not a bug - mandos-client does *not* hang upon installation, it is only GnuPG which take a really long time on some systems, presumably low on entropy.

[Mandos Maintainers (mandos-maintainers)]

This is not a bug, it's just how GnuPG works. Yes, it prints two separate lines of characters. Yes, it can take a really long time on some systems without entropy - one person said it took 2 1/2 hours on his system. I don't know why this it - you'll have to take this up with the GnuPG folks.

I guess we could print a warning before starting GnuPG key generation; I'll look into it.

[Eurobiz computer administration (m-admin-eurobiz-upb-de-deactivatedaccount)]

GnuPG gets very few entropy on the computer, as Mandos Maintainers already mentioned. A workaround is to install e.g. randomsound temporarily for higher entropy. Note that randomsound blocks your sound card, so you should deinstall it after installation of mandos-client if you want to use your sound card.