Comment 23 for bug 1536871

Revision history for this message
Mario Limonciello (superm1) wrote :

Seth,

I believe I've identified what's going on (and why Richard couldn't reproduce this on Fedora).

gpgme1.0 shells out to /usr/bin/gpg2 to perform actions. If you turn on it's debug flags verbose enough you can track down the various calls it's sending around.

I was noting the cert actually isn't getting properly enrolled in gnupg2 database in the first place.
In looking at the commands that happened for the import and noticed that gpgme uses "--pinentry=error" [1] but doesn't test to make sure that gpg2 actually supports this. The net result is that it sends this command to gpg2 which returns back on the pipe an error about an unsupported argument.

GPG2 added support for this argument in version 2.1. Ubuntu 16.04 isn't currently shipping 2.1, but Fedora (24) is.

So what's happening is the GPG key never gets enrolled in the GNUPG database.

So there's a few actions I notice out of this:
1) fwupd needs to test if the key import was actually successful
2) gpgme probably needs to test the version of GPG2 it's working with before building these arguments
3) Ubuntu 16.04's gnupg needs to be updated to 2.1 (this already happened in Debian) [2]

[1] http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=61a0d92b679f248505f1bf16386bc41a5bf2ba1d
[2] https://tracker.debian.org/pkg/gnupg2