Ubuntu
simplestreams package

Autopkgtest/build fails, because example gpg key is expired

Bug #2013081 reported by Dominik Viererbe on 2023-03-28

This bug affects 2 people

	Status	Importance	Assigned to
simplestreams (Ubuntu)	Fix Released	Undecided	Dominik Viererbe
Bionic	Won't Fix	Undecided	Unassigned
Focal	Fix Committed	Undecided	Unassigned
Jammy	Fix Committed	Undecided	Unassigned
Kinetic	Won't Fix	Undecided	Unassigned

Bug Description

[Impact]

Simplestreams package fails to build on Bionic, Focal and Jammy.
That issue is caused by the expired test gpg keys.
The fix is to generate a new keys to avoid this problem.

[Test Plan]

Type in:

1. git ubuntu clone simplestreams
2. pull-lp-source -d simplestreams <release-name>
3. cd simplestreams
4. git checkout ubuntu/<release-name>-devel
5. dpkg-buildpackage -S -I -i -nc -d -uc -us
6. cd ..
7. sbuild -d <release-name>-amd64 simplestreams_<version>.dsc

*where <release-name> equals bionic, focal and jammy

Example of failed output:

make[1]: Entering directory '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460'
./tools/create-gpgdir
creating GNUPGHOME dir in /build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/gnupg.
  pubkey '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/keys/example.pub'
  secret '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/keys/example.sec'
  pubkeys: /build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/keys/example.pub
imported secret key /build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/keys/example.sec
imported pubkey /build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/keys/example.pub
./tools/tenv ./tools/sign-examples
Traceback (most recent call last):
  File "/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/tools/js2signed", line 53, in <module>
    main()
  File "/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/tools/js2signed", line 41, in main
    signjson_file(path, force=force)
  File "/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/tools/sign_helper.py", line 25, in signjson_file
    util.sign_file(fname, inline=False)
  File "/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/simplestreams/util.py", line 546, in sign_file
    return subp(get_sign_cmd(path=fname, output=outfile, inline=inline))[0]
  File "/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/simplestreams/util.py", line 458, in subp
    raise subprocess.CalledProcessError(rc, args, output=(out, err))
subprocess.CalledProcessError: Command '['gpg', '--batch', '--output', '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/cirros/streams/v1/index.json.gpg', '--armor', '--detach-sign', '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460/examples/cirros/streams/v1/index.json']' returned non-zero exit status 2
Makefile:39: recipe for target 'examples-sign' failed
make[1]: *** [examples-sign] Error 1
make[1]: Leaving directory '/build/simplestreams-83uOzI/simplestreams-0.1.0~bzr460'
dh_auto_test: make -j1 test returned exit code 2
debian/rules:7: recipe for target 'build' failed
make: *** [build] Error 2
dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2
--------------------------------------------------------------------------------

Example of successful output:

The package builds without any issues.

[Where problems could occur]

The regression possibilities here are really low.
It is unlikely but possible that users could hardcode valid gpg keys into a file. In that case if the same user wants to install simplestreams, there is a high risk that a warning message will appear and there is a necessity to unify the keys by removing it and installing the package again.

---------------------original bug description-----------------------------

Running the autopkgtest fails to build the package. During the build process the example gpg key (examples/keys/example.pub and examples/keys/example.sec) gets imported. When the example key is used to test the package during build time; the build fails, because gpg fails to sign something with the expired gpg key.

How to verify:
1. Checkout the source tree
2. import examples/keys/example.pub with gpg --import examples/keys/example.pub
3. see details about key: gpg --list-keys 198E8D3C27227898CB4D413CA9714A203967536E

Should display something like this:
pub rsa1024 2013-02-26 [SCEA] [expired: 2023-02-24]
198E8D3C27227898CB4D413CA9714A203967536E
uid [ expired] Simple Streams Test User (Test Usage Only. Do Not Import.) <email address hidden>

4. Note that the key expired at 24.02.2023
5. (optional) remove key: gpg --delete-keys 198E8D3C27227898CB4D413CA9714A203967536E

How to fix this:
Generate a new key upstream or do the key generation dynamically to avoid this problem entirely.

See original description

Tags:

Related branches

~michal-maloszewski99/ubuntu/+source/simplestreams:lp-2013081-gpg-keys-jammyr

Merged into ubuntu/+source/simplestreams:ubuntu/jammy-devel at revision e6e295e88ec0bf6fb247cd7f2a96132324f67ebb

git-ubuntu bot: Approve on 2023-05-31

Lucas Kanashiro (community): Approve on 2023-05-31

Canonical Server Reporter: Pending requested 2023-05-24

~michal-maloszewski99/ubuntu/+source/simplestreams:lp-2013081-gpg-keys-focal

Merged into ubuntu/+source/simplestreams:ubuntu/focal-devel at revision afad5a0266358c050f5cc98fcd56a727845a2f57

git-ubuntu bot: Approve on 2023-05-31

Lucas Kanashiro (community): Approve on 2023-05-31

Canonical Server Reporter: Pending requested 2023-05-24

~michal-maloszewski99/ubuntu/+source/simplestreams:lp-2013081-gpg-keys-bionic

Rejected for merging into ubuntu/+source/simplestreams:ubuntu/bionic-devel

Lucas Kanashiro (community): Approve on 2023-05-31

Sergio Durigan Junior (community): Needs Fixing on 2023-05-26

Canonical Server Reporter: Pending requested 2023-05-24

git-ubuntu import: Pending requested 2023-05-24

~dviererbe/simplestreams:rotate-example-gpg-keys

Merged into simplestreams:master at revision 68414193c3fe27538cec757bafbfe3ce83f0ce80

Paride Legovini: Approve on 2023-03-30

Server Team CI bot: Needs Fixing (continuous-integration) on 2023-03-28

Robie Basak: Needs Fixing on 2023-03-28

Dominik Viererbe (dviererbe) on 2023-03-28

Changed in simplestreams (Ubuntu):
assignee:	nobody → Dominik Viererbe (dviererbe)
status:	New → In Progress

Dominik Viererbe (dviererbe) on 2023-03-28

Changed in simplestreams (Ubuntu):
status:	In Progress → Fix Committed

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2023-05-23:

Your changelog missed a bug reference, this is actually released

Changed in simplestreams (Ubuntu):
status:	Fix Committed → Fix Released

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2023-05-23:

Michal has found the same,
he will work on pushing the fix to block-proposed for Focal and Jammy to not hit anyone else again in the future.

Furthermore he will need it to fix 1870360 in Bionic.

For Kinetic, since this is just a quality of life for potential future updates I think we can ignore, it just has a few weeks of support left.
Setting won't fix

Changed in simplestreams (Ubuntu Kinetic):
status:	New → Won't Fix
Changed in simplestreams (Ubuntu Jammy):
status:	New → Triaged
Changed in simplestreams (Ubuntu Focal):
status:	New → Triaged
Changed in simplestreams (Ubuntu Bionic):
status:	New → Triaged
assignee:	nobody → Michał Małoszewski (michal-maloszewski99)
Changed in simplestreams (Ubuntu Focal):
assignee:	nobody → Michał Małoszewski (michal-maloszewski99)
Changed in simplestreams (Ubuntu Jammy):
assignee:	nobody → Michał Małoszewski (michal-maloszewski99)

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

Changed in simplestreams (Ubuntu Bionic):
status:	Triaged → In Progress

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

Changed in simplestreams (Ubuntu Focal):
status:	Triaged → In Progress

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

Changed in simplestreams (Ubuntu Jammy):
status:	Triaged → In Progress

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

description:

updated

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

description:

updated

Michał Małoszewski (michal-maloszewski99) on 2023-05-24

tags:

added: server-todo

Michał Małoszewski (michal-maloszewski99) on 2023-05-25

description:

updated

Michał Małoszewski (michal-maloszewski99) on 2023-05-25

description:	updated
description:	updated

Michał Małoszewski (michal-maloszewski99) on 2023-05-25

description:

updated

Michał Małoszewski (michal-maloszewski99) on 2023-05-31

description:

updated

Revision history for this message

Steve Langasek (vorlon) wrote on 2023-06-02:

As this is an autopkgtest-only fix, I am marking this bug block-proposed.

tags:	added: block-proposed-jammy
Changed in simplestreams (Ubuntu Jammy):
status:	In Progress → Fix Committed
tags:	added: verification-needed verification-needed-jammy

Revision history for this message

Steve Langasek (vorlon) wrote on 2023-06-02: Please test proposed package

Hello Dominik, or anyone else affected,

Accepted simplestreams into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/simplestreams/0.1.0-48-gb936edd4-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in simplestreams (Ubuntu Focal):
status:	In Progress → Fix Committed
tags:	added: verification-needed-focal

Revision history for this message

Steve Langasek (vorlon) wrote on 2023-06-02:

Hello Dominik, or anyone else affected,

Accepted simplestreams into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/simplestreams/0.1.0-30-g3cc8988a-0ubuntu1.20.04.2 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

tags:

added: block-proposed-focal
removed: verification-needed-focal

Revision history for this message

Michał Małoszewski (michal-maloszewski99) wrote on 2023-06-12 (last edit on 2023-06-12):

Download full text (3.4 KiB)

The fix works, both 0.1.0-48-gb936edd4-0ubuntu1.1 and 0.1.0-30-g3cc8988a-0ubuntu1.20.04.2 fix the bug.

Jammy:

I followed the same steps (1:1) on my local machine, which are described in the SRU template above, but previously, after installing a simplestreams package I typed in:

$ apt policy simplestreams

The output:

simplestreams:
  Installed: 0.1.0-48-gb936edd4-0ubuntu1
  Candidate: 0.1.0-48-gb936edd4-0ubuntu1
  Version table:
*** 0.1.0-48-gb936edd4-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        100 /var/lib/dpkg/status

After following the steps, I've noticed that nothing has changed there, so the problem still existed:

make[1]: Entering directory '/<<PKGBUILDDIR>>'
./tools/create-gpgdir
creating GNUPGHOME dir in /<<PKGBUILDDIR>>/gnupg.
  pubkey '/<<PKGBUILDDIR>>/examples/keys/example.pub'
  secret '/<<PKGBUILDDIR>>/examples/keys/example.sec'
  pubkeys: /<<PKGBUILDDIR>>/examples/keys/example.pub
imported secret key /<<PKGBUILDDIR>>/examples/keys/example.sec
imported pubkey /<<PKGBUILDDIR>>/examples/keys/example.pub
./tools/tenv ./tools/sign-examples
Traceback (most recent call last):
  File "/<<PKGBUILDDIR>>/tools/js2signed", line 53, in <module>
    main()
  File "/<<PKGBUILDDIR>>/tools/js2signed", line 41, in main
    signjson_file(path, force=force)
  File "/<<PKGBUILDDIR>>/tools/sign_helper.py", line 25, in signjson_file
    util.sign_file(fname, inline=False)
  File "/<<PKGBUILDDIR>>/simplestreams/util.py", line 546, in sign_file
    return subp(get_sign_cmd(path=fname, output=outfile, inline=inline))[0]
  File "/<<PKGBUILDDIR>>/simplestreams/util.py", line 458, in subp
    raise subprocess.CalledProcessError(rc, args, output=(out, err))
subprocess.CalledProcessError: Command '['gpg', '--batch', '--output', '/<<PKGBUILDDIR>>/examples/cirros/streams/v1/index.json.gpg', '--armor', '--detach-sign', '/<<PKGBUILDDIR>>/examples/cirros/streams/v1/index.json']' returned non-zero exit status 2
Makefile:39: recipe for target 'examples-sign' failed
make[1]: *** [examples-sign] Error 1
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
dh_auto_test: make -j1 test returned exit code 2
debian/rules:7: recipe for target 'build' failed
make: *** [build] Error 2
dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2
--------------------------------------------------------------------------------
Build finished at 2023-06-12T14:50:16Z

Finished
--------

+------------------------------------------------------------------------------+
| Cleanup |
+------------------------------------------------------------------------------+

Purging /<<BUILDDIR>>
Not cleaning session: cloned chroot in use
E: Build failure (dpkg-buildpackage died)

Then I've upgraded simplestreams using:
$ apt install simplestreams=0.1.0-48-gb936edd4-0ubuntu1.1

Later I've typed in:

$ apt policy simplestreams

simplestreams:
  Installed: 0.1.0-48-gb936edd4-0ubuntu1.1
  Candidate: 0.1.0-48-gb936edd4-0ubuntu1.1
  Version table:
*** 0.1.0-48-gb936edd4-0ubuntu1.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/universe amd64 ...

Duplicates of this bug

Bug #2019864

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

tags:	added: verification-done-focal
Changed in simplestreams (Ubuntu Bionic):
status:	In Progress → Won't Fix

Ubuntusimplestreams package

Autopkgtest/build fails, because example gpg key is expired

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Remote bug watches

Ubuntu
simplestreams package