http://bugzilla.opensuse.org/show_bug.cgi?id=1012144 Bug ID: 1012144 Summary: gpg2 in roundcubemail enigma opens trustdb.gpg despite --trust-model 'always' Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: x86-64 OS: openSUSE 42.1 Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: jimc@math.ucla.edu QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Versions: OpenSuSE "Leap" 42.1 roundcubemail-1.2.2-2.1 (including enigma plugin) gpg2-2.0.24-5.1 Enigma configuration: none (take all defaults). Starting with no keyring at all, I import a keypair, and /var/log/roundcube/errors reports: PHP Error: Enigma plugin: Unknown error importing GPG key... In the debug output the failing gpg2 command line is /usr/bin/gpg --status-fd '3' --command-fd '4' --no-secmem-warning \ --no-tty --no-default-keyring --no-options --no-permission-warning \ --exit-on-status-write-error --trust-model always --homedir \ '/home/httpd/htdocs/kerberos/roundcube/plugins/enigma/home/jimc' \ --import And the major error message is: gpg: Fatal: can't open `/home/httpd/htdocs/kerberos/roundcube/plugins/enigma/home/jimc/trustdb.gpg': No such file or directory Please see https://github.com/roundcube/roundcubemail/issues/5526 for the complete debug output and for discussions with their maintainer about what could be done at their end about the bug (basically, not a whole lot). It appears that gpg2-2.0.24 inappropriately opens trustdb.gpg despite --trust-model 'always', failing, and that this bug is fixed in gpg2-2.0.27. I tried upgrading to gpg2-2.1.26 from the security:privacy sub-repo. (Plus dependent packages: libgpg-error0-1.25-78.1.x86_64 libnpth0-1.2-3.2.x86_64 libassuan0-2.4.3-90.1.x86_64 libgcrypt20-1.7.3-125.2.x86_64 .) But there's a new file format called a keybox, handled by starting fresh and re-importing the keypairs (failing), and there's also some kind of incompatibility probably involving pseudo-interactive commands. This is obviously an Enigma issue, not yours, but here's the symptom: After successfully importing the public key, Enigma sends the secret key, and gpg2 blocks doing nothing (per strace). After a timeout (60 secs, only with debug turned on), somebody says "ERROR: gpg: error building skey array: Timeout". I'm posting this new debug log with the roundcube 5526 bug since I think it's their issue, not yours. My conclusion is that gpg2-2.1.x is not going to work with Enigma until their maintainer does some magic with the interprocess incantations. On the SuSE Build Service, the only gpg2 versions are 2.0.24 (42.1), 2.0.26 (13.2), 2.1.16 (all others). My request to SuSE is to upgrade gpg2 for "Leap" 42.1 to 2.0.27 or later, since it is actually a bug. But a snap upgrade to 2.1.16, though tempting, is not SuSE's style and is already known to break my app. Actually I'm going to try to come up with the 2.0.27 sources and compile gpg2 locally, but this is not the "right" way for an end user to glonch the distro. As for --trust-model 'always', the issue is putting together a GUI to emulate GPG's web of trust maintenance, which is not easy. Even so, it's important to use the web of trust. On that topic see: http://www.jfcarter.net/~jimc/documents/mail-signed-1611.html -- You are receiving this mail because: You are on the CC list for the bug.