1 |
On Sunday, 21 July 2019 11:17:30 BST Stefano Crocco wrote: |
2 |
> On venerdì 19 luglio 2019 21:02:40 CEST Stefano Crocco wrote: |
3 |
> > On venerdì 19 luglio 2019 18:21:46 CEST Ian Zimmerman wrote: |
4 |
> > > On 2019-07-18 19:42, Stefano Crocco wrote: |
5 |
> > > > Hello to everyone, |
6 |
> > > > since yesterday emerge --sync fails because it can't refresh keys. The |
7 |
> > > > messages I get are: |
8 |
> > > > |
9 |
> > > > Syncing repository 'gentoo' into '/usr/portage'... |
10 |
> > > > |
11 |
> > > > * Using keys from /usr/share/openpgp-keys/gentoo-release.asc |
12 |
> > > > * Refreshing keys via WKD ... [ !! ] |
13 |
> > > > * Refreshing keys from keyserver hkps://keys.gentoo.org ...OpenPGP |
14 |
> > > > keyring |
15 |
> > > > |
16 |
> > > > refresh failed: |
17 |
> > > > gpg: refreshing 4 keys from hkps://keys.gentoo.org |
18 |
> > > > gpg: keyserver refresh failed: No keyserver available |
19 |
> > > > |
20 |
> > > > OpenPGP keyring refresh failed: |
21 |
> > > > gpg: refreshing 4 keys from hkps://keys.gentoo.org |
22 |
> > > > gpg: keyserver refresh failed: No keyserver available |
23 |
> > > |
24 |
> > > Perhaps something to do with this? |
25 |
> > > |
26 |
> > > https://www.bleepingcomputer.com/news/security/public-certificate-poison |
27 |
> > > in |
28 |
> > > g-> |
29 |
> > |
30 |
> > can-break-some-openpgp-implementations/ |
31 |
> > |
32 |
> > > Aside: |
33 |
> > > I have already switched my personal gpg configuration to use the new |
34 |
> > > isolated keyserver. |
35 |
> > |
36 |
> > Thanks for the answer. I'd heard of this attack and read this [1] article |
37 |
> > on gentoo.org. From what I understand, it said that in theory there |
38 |
> > shouldn't be problems when syncing because "The gemato tool used to |
39 |
> > verify the Gentoo ebuild repository uses WKD by default. During normal |
40 |
> > operation it should not be affected by this vulnerability". Reading the |
41 |
> > article again, I now see it also says that "In the worst case; Gentoo |
42 |
> > repository syncs will be slow or hang" which, as you suggest, could very |
43 |
> > well be what's happened on my system. Unfortunately, the article doesn't |
44 |
> > say what to do if this happens. |
45 |
> > |
46 |
> > Tomorrow I'll try investigating more. |
47 |
> > |
48 |
> > Stefano |
49 |
> > |
50 |
> > [1] https://www.gentoo.org/news/2019/07/03/sks-key-poisoning.html |
51 |
> |
52 |
> It seems I found out how to fix the issue. I tried comparing my |
53 |
> /usr/share/portage/config/repos.conf with the one which comes with a current |
54 |
> stage3 and found out mine had the line |
55 |
> |
56 |
> sync-openpgp-keyserver = hkps://keys.gentoo.org |
57 |
> |
58 |
> which was missing in the file from stage3. Removing it (both here and in |
59 |
> /etc/portage/repos.conf/gentoo.conf) allowed me to sync correctly. I hope |
60 |
> this is the correct fix. I don't remember ever writing this line, so I |
61 |
> suppose it came with the original stage3 I built my system from or was |
62 |
> changed by another update (an update of what, however? According to `equery |
63 |
> b`, this file doesn't belong to any package). |
64 |
> |
65 |
> I hope thing will keep working. |
66 |
> |
67 |
> Stefano |
68 |
|
69 |
I grepped two older installations I had immediate access to and there is no |
70 |
directive containing "openpgp" anywhere within /etc/portage/. |
71 |
|
72 |
In a new-ish installation there were a number of entries in /etc/portage/ |
73 |
repos.conf/gentoo.conf, but no keyserver URI: |
74 |
|
75 |
$ grep openpgp -r /etc/portage/repos.conf/gentoo.conf |
76 |
sync-openpgp-key-path = /usr/share/openpgp-keys/gentoo-release.asc |
77 |
sync-openpgp-key-refresh-retry-count = 40 |
78 |
sync-openpgp-key-refresh-retry-overall-timeout = 1200 |
79 |
sync-openpgp-key-refresh-retry-delay-exp-base = 2 |
80 |
sync-openpgp-key-refresh-retry-delay-max = 60 |
81 |
sync-openpgp-key-refresh-retry-delay-mult = 4 |
82 |
|
83 |
Perhaps you had added a keyserver as a fall back when you were configuring |
84 |
your system to use WKD? I haven't implemented WKD because there was no news |
85 |
item advising us to do so. |
86 |
-- |
87 |
Regards, |
88 |
|
89 |
Mick |