"sudo maas-import-ephemerals" steps on ~/.gnupg/pubring.gpg

Urgh, nasty. Ideally, this script should be dropping root privs for everything it doesn't need anyway.

I've targeted simplestreams because I just stepped through the code in the debugger and identified the exact part of the code that rewrites the file.

In simplestreams.util.read_signed(), which gets called to verify the signature of the json index file, it invokes a subprocess:

['gpg', '--batch', '--verify', u'--keyring=/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg', '-']

which after it returns, the pubring has been rewritten.

We don't have this script any more, but the new one still runs as root and uses the simplestreams library, so I don't expect any different behaviour.

Update: normal use no longer requires the script to run stand-alone. Normal runs triggered from the UI, or the automatic weekly runs, will keep their own GPG state in /var/lib/maas. The maas user owns that state, and the script runs as ‘maas’ not ‘root.’

The stand-alone script can still be used for failure feedback, and we're planning to address this need in a better way.

marked as low.
I wasnt able to reproduce this using sstream-query, though i thought i would have been able to.
basically expected that:
 sudo PYTHONPATH=$PWD ./bin/sstream-query -vvv --keyring /usr/share/keyrings/ubuntu-cloudimage-keyring.gp http://maas.ubuntu.com/images/ephemeral-v2/daily/streams/v1/com.ubuntu.maas:daily:v2:download.sjson

would have done the change, but it did not.

I did reproduce another issue:
$ cat > gen-key <<EOT
Key-Type: RSA
Key-Length: 1024
Name-Real: Test User
Name-Email: <email address hidden>
EOT
$ rm -Rf ~/.gnupg; gpg --gen-key --batch gen-key
$ sstream-query -vvv --keyring /usr/share/keyrings/ubuntu-cloudimage-keyring.gpg --max=1 http://maas.ubuntu.com/images/ephemeral-v2/daily/streams/v1/com.ubuntu.maas:daily:v2:download.sjson release=trusty arch=ppc64
failed: gpg --batch --verify --no-default-keyring --keyring=/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg -
 out=
 err=gpg: WARNING: unsafe ownership on configuration file `/home/ubuntu/.gnupg/gpg.conf'
gpg: Signature made Thu 29 Oct 2015 12:15:36 PM UTC using RSA key ID 476CF100
gpg: checking the trustdb
gpg: public key of ultimately trusted key 795D06FA not found
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "Ubuntu Cloud Image Builder (Canonical Internal Cloud Image Builder) <email address hidden>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4A3C E3CD 565D 7EB5 C810 E2B9 7FF3 F408 476C F100

Traceback (most recent call last):
  File "/usr/bin/sstream-query", line 136, in <module>
    main()
  File "/usr/bin/sstream-query", line 129, in main
    tmirror.sync(smirror, path)
  File "/usr/lib/python3/dist-packages/simplestreams/mirrors/__init__.py", line 83, in sync
    content, payload = reader.read_json(path)
  File "/usr/lib/python3/dist-packages/simplestreams/mirrors/__init__.py", line 41, in read_json
    return raw, self.policy(content=raw, path=path)
  File "/usr/bin/sstream-query", line 116, in policy
    checked=cmdargs.verify)
  File "/usr/lib/python3/dist-packages/simplestreams/util.py", line 267, in read_signed
    raise e
  File "/usr/lib/python3/dist-packages/simplestreams/util.py", line 263, in read_signed
    subp(cmd, data=content)
  File "/usr/lib/python3/dist-packages/simplestreams/util.py", line 435, in subp
    raise subprocess.CalledProcessError(rc, args, output=(out, err))
subprocess.CalledProcessError: Command '['gpg', '--batch', '--verify', '--no-default-keyring', '--keyring=/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg', '-']' returned non-zero exit status 2

fixed in revno 404 if you have gpgv, simplestreams will use that in leui of gpg