slackpkg: gpg error (md5 checksum)

theCalcaholic · 01-19-2014, 03:43 PM

Hello everyone,

I'm currently stuck with a problem while configuring slapt-get.

I installed slapt-get and it works - well at least it 'runs' - but when I tried to do "slapt-get --update" it gives me an "Segmentation fault"-error after trying to verify the checksum signature. Retrieving package data, patch list, checksum list and checksum signature goes fine...

However, after a bit of googling and experimenting I noticed that this doesn't seem to be a slapt-get specific error. When I do "slackpkg update" (after reinstalling gpg, refreshing the date and doing "slackpkg update gpg"), it terminates with an gpg error as well:

Code:

ERROR: Verification of the gpg signature on CHEKCSUMS.md5
       failed! This could mean that the file is out of date
       or has been tampered with.

I also tried many different mirrors - including the ftp://mirrors.slackware.com:/slackware/slackware-14.1/.

And I reinstalled slackpkg (therefor I had to turn off the MD5- and GPG-checks int the slackpkg.conf

Do you have any ideas why I still recieve this error?

Regards, theCalcaholic

55020 · 01-20-2014, 09:02 AM

I'm wondering whether you did 'su -', or just 'su'. You should be doing all this as root, with 'su -', and you should have the gnupg packgage installed (slackpkg uses the gpg command from gnupg, so you need gnupg -- the gnupg2 package is not a replacement for gnupg -- which is a good example of why everybody here says you should have a *full* install of Slackware unless you know exactly what you're doing. Sorry if this is something you know already.)

You can check whether your previous 'slackpkg update gpg' worked by doing 'gpg --list-keys'. You should see this

Code:

pub   1024D/40102233 2003-02-26 [expires: 2038-01-19]
uid                  Slackware Linux Project <security@slackware.com>
sub   1024g/4E523569 2003-02-26 [expires: 2038-01-19]

and possibly other useful public keys, like "SlackBuilds.org Development Team <slackbuilds-devel@slackbuilds.org>".

You can manually check something with 'gpg --verify something.asc', and then, if that fails, you can tell us the error message. For example, if you download CHECKSUMS.md5 and CHECKSUMS.md5.asc manually, you can check it like this:

Code:

# gpg --verify CHECKSUMS.md5.asc 
gpg: Signature made Tue 14 Jan 2014 04:12:41 AM GMT using DSA key ID 40102233
gpg: Good signature from "Slackware Linux Project <security@slackware.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EC56 49DA 401E 22AB FA67  36EF 6A44 63C0 4010 2233
#

Don't worry about the warning. It means I've never been invited to the sort of party where people who've met Patrick swap driving licences.

Lastly, I have vague memories of gpg verification failing because the system clock or timezone was badly wrong, but that could be just an hallucination...

ponce · 01-20-2014, 09:25 AM

Quote:

Originally Posted by theCalcaholic

Do you have any ideas why I still recieve this error?

are you, by any chance, using a partial install?

theCalcaholic · 01-20-2014, 11:47 AM

Ok thanks for the replies. I tried your suggestions and did not get much further but recieved another bunch of strange behaviour... Which is well for determining the source of evil, I guess.

Quote:

I'm wondering whether you did 'su -', or just 'su'.

You got me. I indeed did 'su'. But when I tried it with 'su -' today there were no different results.

Quote:

and you should have the gnupg packgage installed

I have it installed but following your further instructions I noticed that my gnupg doesn't seem to work properly.

Quote:

why everybody here says you should have a *full* install of Slackware

and

Quote:

are you, by any chance, using a partial install?

I should have a full installation as long as there went nothing wrong installing it which I do not have any hints for except of the strange errors I'm currently receiving.

Quote:

You can check whether your previous 'slackpkg update gpg' worked by doing 'gpg --list-keys'

When I do 'gpg --list-keys' after having done 'slackpkg update' I receive the following:

Code:

gpg: failed to create temporary file `/root/.gnupg/.#lk0x9711b48.thecalcaholic/server.19064': No such file or directory
gpg: fatal: can't create lock for `/root/.gnupg/trustdb.gpg'
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768

If I manually execute 'gpg --verify /tmp/slackpkg.mSrmun/CHECKSUMS.md5.asc' I get this:

Code:

gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

Quote:

Lastly, I have vague memories of gpg verification failing because the system clock or timezone was badly wrong

I read about it too, but my date is well - I checked it already.

Thankyou again for the suggestions so far.

55020 · 01-21-2014, 03:40 AM

Quote:

Originally Posted by theCalcaholic

When I do 'gpg --list-keys' after having done 'slackpkg update' I receive the following:

Code:

gpg: failed to create temporary file `/root/.gnupg/.#lk0x9711b48.thecalcaholic/server.19064': No such file or directory
gpg: fatal: can't create lock for `/root/.gnupg/trustdb.gpg'
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768

This seems to be the cause of your problems. Something is wrong with gpg's database locking. Maybe it's been caused by a previous crash of something like gnome-keyring. Or maybe it's an owner or permission problem -- you could try to check that /root/.gnupg and everything under it is owned by root:root (chown -R root:root /root/.gnupg) and has the correct permissions. Or maybe you have /root on a read-only filesystem. Or maybe there are some unusual options set in /root/.gnupg/gpg.conf (maybe swaret set something stupid in there?).

Maybe you could try to use the gpg --lock-never option as a workround, if you can't find what is wrong.

theCalcaholic · 01-21-2014, 01:24 PM

THank you, this seems to be the right track...

At first I did as you suggested and changed the owner of the directory (recursively) to root:root.

When I execute gpg --lock-never --list-keys it indeed gives me the result I want.
When I took a look at the '/root/.gnupg' directory I found permissions which don't seem to be ok. I only don't know exactly how they should look like.

These are the permissions at the moment (I set '/root/.gnupg' to 0700 already):

Code:

>> ls -l /root/.gnupg/
total 20
-rw------- 1 root root 9188 Nov 20 13:44 gpg.conf
-rw------- 1 root root  926 Nov 20 13:44 pubring.gpg
-rw------- 1 root root    0 Nov 20 13:44 pubring.gpg~
-rw------- 1 root root    0 Nov 20 13:44 secring.gpg
-rw------- 1 root root 1200 Nov 20 13:44 trustdb.gpg

EDIT: I forgot this: The gnupg.conf file seems to be pretty default since there is everything commented out except of the keyserver which is the standard 'hkp://keys.gnupg.net'.

Regards, thecalcaholic

UPDATE: I tried nearly all possible permission setups now; and sometimes recieved gpg security warnings when I opened read write and execute permissions for everyone but I also still recieved the initial error described in the posts before...
I removed gpg and gpg2 and deleted all related directories manually and reinstalled everything afterwards but no changes were noticeable.
I'm running out of ideas... :/

theCalcaholic · 01-25-2014, 06:48 AM

Anybody? I'm sorry for pushing.

55020 · 01-25-2014, 02:03 PM

If the gpg.conf file is 9188 bytes, it looks unmodified. But why are all the files dated 'Nov 20'? In particular, why is pubring.gpg still dated Nov 20, if you have recently done 'slackpkg update gpg'? Are you sure your system clock is correct?

It would be interesting to know what shows up when you do 'ls -alR .gnupg/' to show whether there are any hidden temporary lock directories and files in .gnupg. If there are any, remove them.

Your secring.gpg is empty, so you haven't yet run 'gpg --gen-key'. You probably should do that: it's unlikely to be the cause of your problems, but not impossible.

I hope you're not running gpg-agent or gnome-keyring or kwallet or enigmail, or any unusual daemons or applications? I hope you don't have any of the GPG environment variables set, particularly GNUPGHOME or GPG_AGENT_INFO?

If you know what strace is, you might want to try that -- for example, compare the output of 'strace gpg --list-keys' with 'strace gpg --lock-never --list-keys'.

theCalcaholic · 02-17-2014, 06:37 PM

Thankyou again for all the help.

Since I received another bunch of errors lately I decided to reinstall the whole thing. Thankyou nonetheless.

Regards, theCalcaholic