debuild fails to use seahorse-agent or gpg-agent

[Vladimír Lapáček]

Binary package hint: devscripts

Using the latest Feisty. I installed seahorse not to enter gpg key password every time. It works ok with gpg --sign but fails with debuild with the following error:

gpg: problem with the agent - disabling agent use
debsign: gpg error occurred! Aborting....
debuild: fatal error at line 1155:
running debsign failed

It does not remember the password moreover I am unable to enter the password manually. To sign the packages I have to disable caching the passwords in seahorse.

This seems to be connected to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322208.

The same issue/solution also affects gpg-agent with pinentry-qt, although the symptoms are a bit different:

gpg: cancelled by user
gpg: skipped "Scott Kitterman <email address hidden>": bad passphrase
gpg: [stdin]: clearsign failed: bad passphrase
debsign: gpg error occurred! Aborting....
debuild: fatal error at line 1155:
running debsign failed

As described in the comments, adding DEBUILD_PRESERVE_ENVVARS="DISPLAY" to ~/.devscripts solves the problem.

[Jose Carlos Garcia Sogo (jsogo)]

El mar, 09-08-2005 a las 21:22 +0300, Martin-Éric Racine escribió:
> Package: seahorse
> Version: 0.7.6-5
> Severity: important
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I launch searhorse-agent from my GNOME session startup files. This works well in GNOME applications such as Balsa or
> when executing 'gpg' form the command line, such as with 'caff' from the "signing-party" package. However, it fails
> whenever I build packages using debuild. What I get:

 Yes, of course I also use seahorse and this is something I have been
suffering for long. But I haven't had managed to discover where the
problem is. After all it says "problem with the agent" but I dono't have
any idea. Anyway, I stopped my search when I run out of time, and I
haven't sent anything yet to gnupg mailing list. I will do so now.

 Tip: if after the build you use debsign, this works

--
Jose Carlos Garcia Sogo
   <email address hidden>

[Jose Carlos Garcia Sogo (jsogo)]

As reported in the bug below when using seahorse-agent and debuild it
will always fail with the "problem with the agent - disabling agent use"
error (it also happens to me). But if I use debsign after build process,
I can sign the package using seahorse-agent fine.

I am completely lost about where should I start looking for the
bug/problem. This is why I am CCing both lists. Perhaps problem is in
debuild itself, but any hint on how debugging this would be appreciated.

 Thanks

El mar, 09-08-2005 a las 21:22 +0300, Martin-Éric Racine escribió:
> Package: seahorse
> Version: 0.7.6-5
> Severity: important
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I launch searhorse-agent from my GNOME session startup files. This works well in GNOME applications such as Balsa or
> when executing 'gpg' form the command line, such as with 'caff' from the "signing-party" package. However, it fails
> whenever I build packages using debuild. What I get:
>
> 8X-----
> Now signing changes and any dsc files...
> signfile gaim-irchelper_0.12-1.dsc Martin-Éric Racine <email address hidden>
>
> You need a passphrase to unlock the secret key for
> user: "Martin-Éric Racine <email address hidden>"
> 1024-bit DSA key, ID 1E0CB9CD, created 2003-10-26
>
> gpg: problem with the agent - disabling agent use
> Enter passphrase:
> 8X-----
>
> I then enter my passphrase, which gives me this:
>
> 8X-----
> debsign: gpg error occurred! Aborting....
> debuild: fatal error at line 788:
> running debsign failed
> 8X-----
>
> Note: this bug might actually be caused by 'debuild' but I'm not sure how I would verify this. If you feel that this
> bug belongs to the "devscripts" package, you are welcome to reasign it to that.
>
> - -- System Information:
> Debian Release: testing/unstable
> Architecture: powerpc (ppc)
> Shell: /bin/sh linked to /bin/bash
> Kernel: Linux 2.6.11-imac
> Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8)
>
> Versions of packages seahorse depends on:
> ii debconf [debconf-2.0] 1.4.52 Debian configuration management sy
> ii gconf2 2.10.1-1 GNOME configuration database syste
> ii libart-2.0-2 2.3.17-1 Library of functions for 2D graphi
> ii libatk1.0-0 1.10.1-2 The ATK accessibility toolkit
> ii libbonobo2-0 2.10.0-1 Bonobo CORBA interfaces library
> ii libbonoboui2-0 2.8.1-2 The Bonobo UI library
> ii libc6 2.3.5-3 GNU C Library: Shared libraries an
> ii libeel2-2 2.8.2-1 Eazel Extensions Library (for GNOM
> ii libgail-common 1.8.4-1 GNOME Accessibility Implementation
> ii libgail17 1.8.4-1 GNOME Accessibility Implementation
> ii libgconf2-4 2.10.1-1 GNOME configuration database syste
> ii libglade2-0 1:2.5.1-2 library to load .glade files at ru
> ii libglib2.0-0 2.6.5-1 The GLib library of C routines
> ii libgnome2-0 2.8.1-2 The GNOME 2 library - runtime file
> ii libgnomecanvas2-0 2.10.2-2 A powerful object-oriented display
> i...

[Rasmus Toftdahl Olesen (halfdan)]

I have now used 2 hours trying to pinpoint this problem, and have
finally narrowed it down to seahorse-agent wanting DISPLAY to be set in
order for it to be used. If you insert a "env" call in /usr/bin/debsign
- you will see that the DISPLAY variable has been removed (probably by
debuild in some way).

If you start seahorse-agent as a "non-deamonized" process using the -d
option when starting it you will receive a log message when debsign is
trying sign files like this:

** (seahorse-agent:14298): WARNING **: received passphrase request from
wrong terminal

And apparently wrong terminal means (DISPLAY variable different from the
one i was started with).

If i try doing a export DISPLAY=":0.0" in debsign before the gpg command
is run, the thing works fine!

So maybe this bug should be reassigned to devscripts and have them
preserve DISPLAY when calling debsign.

--
Rasmus Toftdahl Olesen <email address hidden>
halfdans.net

[Rasmus Toftdahl Olesen (halfdan)]

I might add that a quick fix is to add DISPLAY to the
DEBUILD_PRESERVE_ENVVARS list in either /etc/devscripts.conf or
~/.devscripts.conf

--
Rasmus Toftdahl Olesen <email address hidden>
halfdans.net

[Jose Carlos Garcia Sogo (jsogo)]

El mié, 21-09-2005 a las 23:08 +0200, Rasmus Toftdahl Olesen escribió:
> I have now used 2 hours trying to pinpoint this problem, and have
> finally narrowed it down to seahorse-agent wanting DISPLAY to be set in
> order for it to be used. If you insert a "env" call in /usr/bin/debsign
> - you will see that the DISPLAY variable has been removed (probably by
> debuild in some way).
>
> If you start seahorse-agent as a "non-deamonized" process using the -d
> option when starting it you will receive a log message when debsign is
> trying sign files like this:
>
> ** (seahorse-agent:14298): WARNING **: received passphrase request from
> wrong terminal
>
> And apparently wrong terminal means (DISPLAY variable different from the
> one i was started with).
>
> If i try doing a export DISPLAY=":0.0" in debsign before the gpg command
> is run, the thing works fine!
>
> So maybe this bug should be reassigned to devscripts and have them
> preserve DISPLAY when calling debsign.

 Yay! Thanks for finding this. I will try to see if problem is
devscripts or seahorse, and the submit it to the proper place.

 Thanks for your work!

--
Jose Carlos Garcia Sogo
   <email address hidden>

[Martin-Éric Racine (q-funk)]

Package: seahorse
Version: 0.8.0-1
Followup-For: Bug #322208

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As others suggested, I tried the DEBUILD_PRESERVE_ENVVARS trick and,
sure enough, it fixes it. Personally, I would just reassign this bug
to devscripts and ask the maintainers to fix this in their defaults,
rather than argue about why seahorse-agent needs it and whether it's
an acceptable programming choice.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDqpT5eXr56x4Muc0RAieAAJ9B3dApYpQICpmKLqL6+wiJbTCO8wCgp+Dx
VdNZcXk1W1qHn6kf7c+zRts=
=Ubz7
-----END PGP SIGNATURE-----

[Jose Carlos Garcia Sogo (jsogo)]

# Automatically generated email from bts, devscripts version 2.9.22
reassign 322208 devscripts

[Jose Carlos Garcia Sogo (jsogo)]

# Automatically generated email from bts, devscripts version 2.9.22
retitle 322208 devscripts should keep DISPLAY var when calling debuild

[Julian Gilbey (jdg-polya)]

On Thu, Dec 22, 2005 at 01:58:49PM +0200, Martin-Éric Racine wrote:
> As others suggested, I tried the DEBUILD_PRESERVE_ENVVARS trick and,
> sure enough, it fixes it. Personally, I would just reassign this bug
> to devscripts and ask the maintainers to fix this in their defaults,
> rather than argue about why seahorse-agent needs it and whether it's
> an acceptable programming choice.

debuild deliberately cleans as many environment variables as possible,
so that maintainers' environment variables don't accidentally slip
into and affect package builds. I have no idea whether some package
would build incorrectly if DISPLAY is set.

I would prefer one of the following solutions:

- seahorse-agent should not rely on DISPLAY being correctly set
- set DEBUILD_PRESERVE_ENV=DISPLAY in the .devscripts file
- have Debian's version of seahorse-agent do something to handle this
  situation, for example by setting DEBUILD_PRESERVE_ENV
  appropriately, or by wrapping debuild

But if there is agreement that preserving DISPLAY is the correct way
to go, and that it is unlikely to have any effect on other package
builds, then we can go with that.

   Julian

[Vladimír Lapáček (vil)]

Binary package hint: devscripts

Using the latest Feisty. I installed seahorse not to enter gpg key password every time. It works ok with gpg --sign but fails with debuild with the following error:

gpg: problem with the agent - disabling agent use
debsign: gpg error occurred! Aborting....
debuild: fatal error at line 1155:
running debsign failed

It does not remember the password moreover I am unable to enter the password manually. To sign the packages I have to disable caching the passwords in seahorse.

This seems to be connected to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322208.

[Chris Irwin (chrisirwin)]

As indicated in the bug above, a workaround is to add the following value to either /etc/devscripts.conf or ~/.devscripts.conf

DEBUILD_PRESERVE_ENVVARS="DISPLAY"

[Mohammed Adnène Trojette (adn+ubuntu)]

retitle 323782 [bts] add "list" command to output a list of bugnumber/title
retitle 366925 [bts] bts cache: add option to only get bugs never downloaded before
retitle 233246 [bts] bts cache "recursive" retrieval?
retitle 395536 [bts] bts reassign does not allow multiple packages (reassign ### foo, bar)
retitle 378342 [bts] cache: should have option to ignore resolved bugs
retitle 338179 [bts] console display mode would be helpful
retitle 403859 [bts] does owner have a functional effect, or doesn't it?
retitle 340259 [bts] option to *not* cache resolved bugs?
retitle 333371 [bts] please consider adding an option to Cc: an arbitrary address
retitle 293714 [bts] please consider adding an option to edit message before it is sent
retitle 353048 [bts] please consider including procmailrc for bts autosubscription
retitle 406632 [bts] Please help stupid users to not add recursive forwards
retitle 340838 [bts] support for 'fixed' 'notfixed'
retitle 409028 [checkbashisms] need to check for pattern expansions, error expansions, length expansion, varnames expansions
retitle 385957 [claimbug] please consider
retitle 376595 [dd-list] minimize calls to apt-cache
retitle 403207 [dd-list] With binary packages as input, output should be binary packages, too
retitle 326064 [debchange] a better format for author entries?
retitle 234203 [debchange] add -1 debian revision to -v if new upstream version
retitle 405956 [debchange] adds an extraline in the comments, duplicating the latest character
retitle 227721 [debchange] checkout debian/changelog if source-managed
retitle 316662 [debchange] dch --news should be smarter about versions
retitle 364510 [debchange] dch -r and experimental distribution
retitle 383542 [debchange] option to not create duplicate blocks in multi-maintainer mode
retitle 284658 [debchange] please add option to augment version number automatically
retitle 354047 [debchange] should warn when using likely incorrect fallback
retitle 381159 [debchange] Why not replace --force-bad-version with --allow-lower-version <pattern>
retitle 370066 [debclean] have -d to override missing build-depends a-la-debuild
retitle 408127 [debcommit] allow to specify basedir for debian/changelog (or changelog file itself)
retitle 402539 [debcommit] Document use of git-diff --cached, and offer option for alternative
retitle 381152 [debcommit] please allow specifications of files to check in
retitle 384230 [debcommit] prefer debian/ when determining the VCS in use
retitle 402531 [debcommit] Should format commit messages better for Git
retitle 404952 [debc] Please add udeb support to debc
retitle 369691 [debdiff] allow use without any argument
retitle 320083 [debdiff] --control does not work when comparing multiple .debs
retitle 359765 [debdiff] help me to use debdiff
retitle 370286 [debdiff] please add option to prepend diffstat output
retitle 381731 [deb-reversion] licence change
retitle 371078 [debsign] please add option to verify changes/dsc files
retitle 194678 [debuild] making -uc -us the default signing options
retitle 380326 [debuild] please add ccache support
retitle 262253 [debuild] please allow use of deb*r*sign for debuild
retitle 405440 [debuild] please all...

[Étienne BERSAC (bersace)]

Hi,

It's ~/.descripts , trim the .conf.

Étienne.

[Luca Falavigna (dktrkranz)]

Now it seems to be possible to sign them using command line interface.

[Vladimír Lapáček (vil)]

I don't have any ~/.descripts. So this will not work for me.

On 3/21/07, Étienne Bersac <email address hidden> wrote:
> Hi,
>
> It's ~/.descripts , trim the .conf.
>
> Étienne.
>
> --
> debuild fails to use seahorse-agent
> https://launchpad.net/bugs/78165
>

[Michael Bienia (geser)]

After 'cp /etc/devscripts.conf ~/.devscripts' you have one and can edit it to your demands.

[Mohammed Adnène Trojette (adn+ubuntu)]

# Automatically generated email from bts, devscripts version 2.10.2
retitle 322208 [debuild] devscripts should keep DISPLAY var when calling debuild

[Mohammed Adnène Trojette (adn+ubuntu)]

# Automatically generated email from bts, devscripts version 2.10.2
merge 416507 322208

[Scott Kitterman (kitterman)]

gpg-agent is likely going to be moved into Main for Gutsy, so this should be addresses.

[Scott Kitterman (kitterman)]

When using debuild and gpg-agent with pinentry-qt, a very similar failure
occurs:

gpg: cancelled by user
gpg: skipped "Scott Kitterman <email address hidden>": bad passphrase
gpg: [stdin]: clearsign failed: bad passphrase
debsign: gpg error occurred! Aborting....
debuild: fatal error at line 1155:
running debsign failed

Adding DEBUILD_PRESERVE_ENVVARS="DISPLAY" to ~/.devscripts solves the
problem in this case too.

[Steve Kowalik (stevenk)]

devscripts (2.10.5ubuntu1) gutsy; urgency=low

  * Merge from Debian unstable
  * Remaining Ubuntu changes:
    - requestsync:
      + New script.
      + ask for explanation why Ubuntu changes can be dropped (patch from
        Adrien Cunin)
      + use gpg2 for signing if available
      + General cleanup, mostly to stop mixing tabs and spaces.
      + Add a -n option, to show that this is a new source package according
        to Ubuntu.
      + Add a -s option, that will subscribe the relevant sponsor group
        instead of ubuntu-archive.
      + Look up the Debian component, and support downloading changelog
        entries from components other than main.
      + Print a meaningful error rather than throwing an exception if
        apt-cache madison contains nothing.
      + Don't confirm the bug when -s (sponsorship) is passed
      + Giving base version as a third argument works again, thanks Kjell
        Braden. (LP: #119313)
    - debchange: add --security option, which acts like --nmu, but adds
      security update template instead of NMU template to changelog.
    - debuild:
      + Add some heuristic checks about the Ubuntu merging policy. Issue a
        warning if a merge does not use -v or describe the remaining Ubuntu
        changes.
      + Keep DISPLAY, XAUTHORITY and GNOME_KEYRING_SOCKET environment
        variables around for safe keeping before we destroy the environment,
        and re-set them before running debsign. (LP: #78165)
  * Ubuntu changes dropped:
    - debchange:
      + Add support for Ubuntu versioning.
      + Allow UNRELEASED in Ubuntu distro check.
      + Accept Ubuntu distribution "gutsy" and use it by default on Ubuntu.

devscripts (2.10.5) unstable; urgency=low

  [ Luk Claes ]
  * debc: Make reporting on a single deb work again (Closes: #419487).

  [ Adam D. Barratt ]
  * debchange: Add gutsy (gibbon) and UNRELEASED to the list of recognised
    Ubuntu distributions
  * rc-alert
    + Update HTML parsing to support the new structure of the RC bug page
    + The "I" tag can now also mean "lenny-ingore"
    + Add "[E]xperimental" to the distribution list, and remove "X"
      ("not in testing")
  * bts
    + Allow the use of SMTP instead of sendmail. Thanks to Josh Tripplet for
      the patch (Closes: #420847)
    + Fix syntax error when reverting to default SENDMAILCMD
    + When cleaning up a bug's cache entries, also remove {raw,status}.mbox
    + Fix pod formatting so that the description of the "fixed" command
      actually appears in the manpage.
    + Add an option to not cache resolved bugs (Closes: #340259, #378342)
    + Fix URL parsing to account for recent HTML changes (Closes: #429236)
    + Always download version graphs rather than the new "options page"
    + Fix attachment parsing code to handle "filename="
  * mass-bug: Fix syntax error when reverting to default SENDMAILCMD
  * dd-list: Treat teams.debian.net addresses as mailing lists rather
    than individuals
  * tagpending: Update license statement to GPL >= 2
  * uscan: Ensure --dehs generates well formed XML (Closes: #426996)

  [ Martin Zobel-Helas ]
  * debchange: Add volatile to the list of recognised Debian dist...

[Steve Kowalik (stevenk)]

tags 322208 + patch
kthxbye

Hi,

 I've written a patch that doesn't preserve the DISPLAY
environment variable by the usual standard, but stores it out of the
way, and then sets it again before calling debsign.

Cheers,
--
     Steve
"I'm a doctor, not a doorstop"
         - EMH, USS Enterprise

[Steve Kowalik (stevenk)]

devscripts (2.10.6ubuntu1) gutsy; urgency=low

  * Merge from Debian unstable
  * Remaining Ubuntu changes:
    - requestsync:
      + New script.
    - debchange: add --security option, which acts like --nmu, but adds
      security update template instead of NMU template to changelog.
    - debuild:
      + Add some heuristic checks about the Ubuntu merging policy. Issue a
        warning if a merge does not use -v or describe the remaining Ubuntu
        changes.
      + Keep DISPLAY, XAUTHORITY and GNOME_KEYRING_SOCKET environment
        variables around for safe keeping before we destroy the environment,
        and re-set them before running debsign. (LP: #78165)
    - Modify Maintainer field as per spec.
  * Add a manual page for requestsync.

devscripts (2.10.6) unstable; urgency=low

  [ Adam D. Barratt ]
  * bts
    + Cc bug reports if the control message contains a comment
      (Closes: #429649)
    + Support passing multiple packages / addresses to "bts cache"
      (Closes: #416548)
    + Add archive / unarchive support
    + Make caching of "status mboxes" work again
  * Fix changelog typos (Closes: #429774)
  * debdiff: Sort conffiles and control before comparing them. Thanks to Peter
    Samuelson for the patch (Closes: #421781)
  * tagpending
    + Use tag=pending rather than include=pending (Closes: #430786)
    + Sort bug numbers in numerical order
    + Process bugs that are already tagged pending and closed in the changelog

  [ James Vega ]
  * uupdate:
    + When displaying patch reject files, show the path to the new upstream
      directory where they're contained. (Closes: #419133)
  * uscan:
    + Support https URLs. This requires installing libcrypt-ssleay-perl.
      (Closes: #423669)
  * debian/control:
    + Add libcrypt-ssleay-perl to Suggests and description for uscan.
  * wnpp:
    + Update the manpage and help output to document what RFA, RFH, and O
      mean. Also add a pointer to the WNPP website. (Closes: #421872)
  * PackageDeps:
    + Use ||= instead of |= to set the package name in %dep_pkgs. It is the
      correct way to do things and |= causes odd results on at least amd64.
      (Closes: #419024)

  [ Mohammed Adnène Trojette ]
  * Release.

 -- Steve Kowalik <email address hidden> Mon, 6 Aug 2007 23:38:54 +1000

[Steve Kowalik (stevenk)]

devscripts (2.10.7ubuntu1) gutsy; urgency=low

  * Merge from Debian unstable.
  * Remaining Ubuntu changes:
    - requestsync:
      + New script.
      + Don't try and affect packages that won't exist when -n is passed.
    - debchange: add --security option, which acts like --nmu, but adds
      security update template instead of NMU template to changelog.
    - debuild:
      + Add some heuristic checks about the Ubuntu merging policy. Issue a
        warning if a merge does not use -v or describe the remaining Ubuntu
        changes.
      + Keep DISPLAY, XAUTHORITY and GNOME_KEYRING_SOCKET environment
        variables around for safe keeping before we destroy the environment,
        and re-set them before running debsign. (LP: #78165)
    - Modify Maintainer field as per spec.

devscripts (2.10.7) unstable; urgency=low

  [ Adam D. Barratt ]
  * debian/control: Add libsoap-lite-perl to the Suggests and
    description for bts
  * README
    + Add libcrypt-ssleay-perl to the description for uscan
    + Add libsoap-lite-perl to the description for bts
    + Mention the SOAP interface in the description for bts
  * debchange: Fix NMU versioning for Debian native packages
  * dd-list: Sort developer names case-insensitively. Thanks to Steinar H.
    Gunderson for the suggestion
  * bts
    + Fix test for libwww-perl not being installed
    + Only pass -c to mail(1) if there are Cc: addresses
      (Closes: #433385)
    + Add support for selecting bug lists via the SOAP interface. This
      requires libsoap-lite-perl. Thanks to Don Armstrong for the patch
      (Closes: #433169)
  * deb-reversion: Apply patch from Adeodato Simó to ensure -v is
    honoured (Closes: #433492)
  * debcommit: When using git, allow either all files or only those in
    the index to be committed. Thanks to Martin F Krafft and Junichi
    Uekawa for the patch. (Closes: #402539, #427429, #433081)
  * uscan
    + Allow a user agent string to be specified (Closes: #433419)
    + Fix https support (Closes: #423669)
    + Correctly set exit status after downloading (Closes: #431840)
  * licensecheck
    + Allow directories to be passed as arguments
    + Allow a pattern to be specified indicating files / directories
      which should be excluded from checking. The default is the same
      as dpkg-source's -i option
    + Allow the set of files to be checked to be specified via a
      regular expression
    + Optionally attempt to find copyright statements

  [ Christoph Berg ]
  * rmadison: Support ubuntu and querying multiple archives, suggested by
    Loïc Minier. (Closes: #431303)
  * dget: Downloading multiple binaries was broken. (Closes: #428827)

  [ Stefano Zacchiroli ]
  * dd-list: list Uploaders per default, added --nouploaders option to
    force the old behaviour

  [ Mohammed Adnène Trojette ]
  * debi: add svn-buildpackage support. Thanks to Raphaël Hertzog for
    the patch. (Closes: #315409, #417609)
  * dch: add --bpo support. (Closes: #434183)
  * debcommit: add debian/changelog to the list of files to commit. Thanks
    Damyan Ivanov for the patch. (Closes: #419657)
  * bts: add file:// to local urls. (Closes: #435011)
  * checkbashims: add a -...

[Mohammed Adnène Trojette (adn+ubuntu)]

# Automatically generated email from bts, devscripts version 2.10.7
package devscripts
tags 322208 + pending