Subject: Re: [sup-devel] [PATCH] fix GPG "hang" on malformed PGP message (detached signature)

From: Rich Lane <[email-masked]>
Date: Fri, 08 Oct 2010 16:09:33 -0400

Excerpts from Christopher Bertels's message of Fri Oct 08 10:36:04 -0400 2010:
> Excerpts from Michael Hamann's message of Fr Okt 08 14:53:56 +0200 2010:
> > Hi,
> >
> > Excerpts from Sascha Silbe's message of 2010-10-05 13:25:33 +0200:
> > > -    message = run_gpg "--output #{output_fn.path} --skip-verify --yes --decrypt #{payload_fn.path}", :interactive => true
> > > +    message = run_gpg "--output #{output_fn.path} --multifile --skip-verify --yes --decrypt #{payload_fn.path}", :interactive => true
> >
> > This change breaks GPG decryption completely for me, not a single
> > message I've tried is decrypted anymore. The error message I'm getting
> > is Error while running gpg: gpg: --output doesn't work for this command.
> > I'm using gpg version 1.4.10. The complete gpg command that is executed
> > is:
> 
> Yup, same for me :(
> 
> >
> > LC_MESSAGES=C /usr/bin/gpg --quiet --batch --no-verbose --logger-fd 1 --use-agent --output /tmp/redwood.output20101008-5410-lj1dh3 --multifile --skip-verify --yes --decrypt /tmp/redwood.payload20101008-5410-1qtud0x > /tmp/redwood.output20101008-5410-2rsbb5 2> /dev/null
> >
> > Michael

Reverted.
_______________________________________________
Sup-devel mailing list
[email-masked]
http://rubyforge.org/mailman/listinfo/sup-devel

---

From: Rich Lane <[email-masked]>
Date: Fri, 08 Oct 2010 00:20:52 -0400

Applied to master.

---

From: Christopher Bertels <[email-masked]>
Date: Fri, 08 Oct 2010 16:36:04 +0200

Yup, same for me :(

--
================================
Christopher Bertels
http://www.fancy-lang.org
http://www.adztec-independent.de
GPG Key ID: 0x2345b203
_______________________________________________
Sup-devel mailing list
[email-masked]
http://rubyforge.org/mailman/listinfo/sup-devel

---

From: Michael Hamann <[email-masked]>
Date: Fri, 08 Oct 2010 14:53:56 +0200

Hi,

Michael

---

From: Sascha Silbe <[email-masked]>
Date: Tue, 5 Oct 2010 13:25:33 +0200

A PGP message chunk (bounded by "-----BEGIN PGP MESSAGE-----" and
"-----END PGP MESSAGE-----") can contain a detached signature. By default GPG
will wait for the payload to be supplied on stdin if it gets passed a lone
detached signature. To the user it will appear as GPG (or sup, since they
don't see any output from GPG) hanging.

The best way to solve this would be enabling batch mode, but then passphrase
querying without gpg-agent wouldn't work anymore. So we resort to passing
--multifile which has the side effect of not allowing detached signatures.

Encountered and tested with message
<AANLkTin1Ysn7Fp32Eoyjo3jjhHwVrc=[email-masked]> [1] on the git
mailing list.

[1] http://marc.info/?l=git&m=128623349711269&q=raw

Signed-off-by: Sascha Silbe <[email-masked]>
---
 lib/sup/crypto.rb |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/lib/sup/crypto.rb b/lib/sup/crypto.rb
index 289fb0e..68a57c8 100644
--- a/lib/sup/crypto.rb
+++ b/lib/sup/crypto.rb
@@ -144,7 +144,7 @@ def decrypt payload, armor=false # a RubyMail::Message object
     output_fn = Tempfile.new "redwood.output"
     output_fn.close

     unless $?.success?
       info "Error while running gpg: #{message}"
-- 
1.7.1