Re: GPG signing a package without a password

[Albert Chin <rpm-list thewrittenword com>]

On Fri, Aug 09, 2002 at 10:02:32AM -0400, Jeff Johnson wrote:
> On Fri, Aug 09, 2002 at 08:47:45AM -0500, Albert Chin wrote:
> > On Fri, Aug 09, 2002 at 09:23:01AM -0400, Jeff Johnson wrote:
> > > On Fri, Aug 09, 2002 at 08:05:45AM -0500, Albert Chin wrote:
> > > > I'm using RPM 4.0.4 and GPG to sign a package. It seems that RPM is
> > > > handling input of the password and passing this to GPG
> > > > (--passphrase-fd 3). Any way to disable this? We want to use
> > > > gpg-agent, an ssh-agent-like program for GPG, to batch-sign RPM files.
> > > > This appears impossible if RPM wants to control input.
> > > 
> > > There are macros that describe each and ever invocation of gpg/pgp helpers
> > > that can be reconfigured, see /usr/lib/rpm/macros, watchout for the
> > > explicit argv[0] value needed by pgp IIRC.
> > > 
> > > You can probably make %__gpg_check_password_cmd a noop and challenge
> > > later while signing.
> > 
> > Are you sure? From rpmqv.c:
> >                   case RPMSIGTAG_GPG:
> >                     passPhrase = rpmGetPassPhrase(_("Enter pass phrase: "), sigTag);
> >                     if (passPhrase == NULL) {
> >                         fprintf(stderr, _("Pass phrase check failed\n"));
> >                         ec = EXIT_FAILURE;
> >                         goto exit;
> >                     }
> >                     fprintf(stderr, _("Pass phrase is good.\n"));
> >                     passPhrase = xstrdup(passPhrase);
> >                     break;
> > 
> > This implies to me that it is outside the control of GPG.
> 
> Yup, the read is in rpm, password string checked with
> %__gpg_check_password_cmd, then password string is passed repeatedly
> to %__gpg_sign_cmd.
> 
> Looks like it ain't gonna be easy to do "batch mode" signing with gpgme.
> 
> Again, doing DSA/RSA signing internal to rpm is what's on my (and rpm's)
> development roadmap, not scraping status returns off of various output
> streams coughed up by a variety of helpers. 
> 
> Too bad that libgcrypt wasn't LGPL when I needed a crypto library.
> I'm very happy with beecrypt, and will use that as a basis for signing
> packages down the road a bit.

Ok, that's not going to work for us. We just hacked RPM not to prompt
for the password and everything is working fine.

-- 
albert chin (china@thewrittenword.com)