| 1 |
On venerdì 19 luglio 2019 21:02:40 CEST Stefano Crocco wrote: |
| 2 |
> On venerdì 19 luglio 2019 18:21:46 CEST Ian Zimmerman wrote: |
| 3 |
> > On 2019-07-18 19:42, Stefano Crocco wrote: |
| 4 |
> > > Hello to everyone, |
| 5 |
> > > since yesterday emerge --sync fails because it can't refresh keys. The |
| 6 |
> > > messages I get are: |
| 7 |
> > > |
| 8 |
> > > Syncing repository 'gentoo' into '/usr/portage'... |
| 9 |
> > > |
| 10 |
> > > * Using keys from /usr/share/openpgp-keys/gentoo-release.asc |
| 11 |
> > > * Refreshing keys via WKD ... [ !! ] |
| 12 |
> > > * Refreshing keys from keyserver hkps://keys.gentoo.org ...OpenPGP |
| 13 |
> > > keyring |
| 14 |
> > > |
| 15 |
> > > refresh failed: |
| 16 |
> > > gpg: refreshing 4 keys from hkps://keys.gentoo.org |
| 17 |
> > > gpg: keyserver refresh failed: No keyserver available |
| 18 |
> > > |
| 19 |
> > > OpenPGP keyring refresh failed: |
| 20 |
> > > gpg: refreshing 4 keys from hkps://keys.gentoo.org |
| 21 |
> > > gpg: keyserver refresh failed: No keyserver available |
| 22 |
> > |
| 23 |
> > Perhaps something to do with this? |
| 24 |
> > |
| 25 |
> > https://www.bleepingcomputer.com/news/security/public-certificate-poisonin |
| 26 |
> > g-> |
| 27 |
> can-break-some-openpgp-implementations/ |
| 28 |
> |
| 29 |
> > Aside: |
| 30 |
> > I have already switched my personal gpg configuration to use the new |
| 31 |
> > isolated keyserver. |
| 32 |
> |
| 33 |
> Thanks for the answer. I'd heard of this attack and read this [1] article on |
| 34 |
> gentoo.org. From what I understand, it said that in theory there shouldn't |
| 35 |
> be problems when syncing because "The gemato tool used to verify the Gentoo |
| 36 |
> ebuild repository uses WKD by default. During normal operation it should |
| 37 |
> not be affected by this vulnerability". Reading the article again, I now |
| 38 |
> see it also says that "In the worst case; Gentoo repository syncs will be |
| 39 |
> slow or hang" which, as you suggest, could very well be what's happened on |
| 40 |
> my system. Unfortunately, the article doesn't say what to do if this |
| 41 |
> happens. |
| 42 |
> |
| 43 |
> Tomorrow I'll try investigating more. |
| 44 |
> |
| 45 |
> Stefano |
| 46 |
> |
| 47 |
> [1] https://www.gentoo.org/news/2019/07/03/sks-key-poisoning.html |
| 48 |
|
| 49 |
It seems I found out how to fix the issue. I tried comparing my |
| 50 |
/usr/share/portage/config/repos.conf with the one which comes with a current |
| 51 |
stage3 and found out mine had the line |
| 52 |
|
| 53 |
sync-openpgp-keyserver = hkps://keys.gentoo.org |
| 54 |
|
| 55 |
which was missing in the file from stage3. Removing it (both here and in |
| 56 |
/etc/portage/repos.conf/gentoo.conf) allowed me to sync correctly. I hope this |
| 57 |
is the correct fix. I don't remember ever writing this line, so I suppose it |
| 58 |
came with the original stage3 I built my system from or was changed by another |
| 59 |
update (an update of what, however? According to `equery b`, this file doesn't |
| 60 |
belong to any package). |
| 61 |
|
| 62 |
I hope thing will keep working. |
| 63 |
|
| 64 |
Stefano |
Archives