Signing issues with gnus from CVS

Signing issues with gnus from CVS

[Norman Walsh]

[-- Attachment #1: Type: text/plain, Size: 1116 bytes --]

I've been having sporadic key signing issues so I upgraded from CVS
this morning and tried the latest. It's still happening:

Debugger entered--Lisp error: (error "Sign error")
  signal(error ("Sign error"))
  error("Sign error")
  mml2015-pgg-sign((part (sign . "pgpmime") (tag-location . 477) (contents . "...")))
  mml2015-sign((part (sign . "pgpmime") (tag-location . 477) (contents . "...")))
  mml-pgpmime-sign-buffer((part (sign . "pgpmime") (tag-location . 477) (contents . "...")))
  mml-generate-mime-1((part (sign . "pgpmime") (tag-location . 477) (contents . "...")))
  mml-generate-mime()
  message-encode-message-body()
  gnus-inews-do-gcc()
  gnus-agent-possibly-do-gcc()
  run-hooks(message-sent-hook)
  message-send(nil)
  message-send-and-exit(nil)
* call-interactively(message-send-and-exit)

User error, I presume. Clues solicited.

                                        Be seeing you,
                                          norm

-- 
Norman Walsh <ndw@nwalsh.com> | Everything should be made as simple as
http://nwalsh.com/            | possible, but no simpler.

[-- Attachment #2: Type: application/pgp-signature, Size: 190 bytes --]

Re: Signing issues with gnus from CVS

[Norman Walsh]

[-- Attachment #1: Type: text/plain, Size: 667 bytes --]

/ gdt@work.lexort.com was heard to say:
| I got this once, but usually not.  Actually I just got sign error, but
| didn't look at backtrace.

I don't get it everytime, but definitely several times a day.

                                        Be seeing you,
                                          norm

-- 
Norman Walsh <ndw@nwalsh.com> | Who knows whether the best of men be
http://nwalsh.com/            | known? or whether there be not more
                              | remarkable persons forgot, than any
                              | that stand remembered in the known
                              | account of time.--Sir Thomas Browne

[-- Attachment #2: Type: application/pgp-signature, Size: 190 bytes --]

Re: Signing issues with gnus from CVS

[Bastien]

Norman Walsh <ndw@nwalsh.com> writes:

> / gdt@work.lexort.com was heard to say:
> | I got this once, but usually not.  Actually I just got sign error, but
> | didn't look at backtrace.
>
> I don't get it everytime, but definitely several times a day.

Same here.  The only clue is this: you're not alone.  gnupg complains
about wrong password (sent by pgg?).  This happend with gnus cvs of
this morning as well.

-- 
Bastien

Re: Signing issues with gnus from CVS

[Jochen Küpper]

Bastien <bzg-whniv8GeeGkdnm+yROfE0A@public.gmane.org> writes:

> Same here.  The only clue is this: you're not alone.  gnupg complains
> about wrong password (sent by pgg?).  This happend with gnus cvs of
> this morning as well.

Oh, I see... I had a probably related /two or three/ times over the
last week: When sending a signed copy Gnus complains about a wrong
passphrase, but actually had correctly send the message. Signing the
Gcc for IMAP storage didn't work, however. 

Undo till the "Gcc:" was back, C-c C-c again, saying no to
resend-question did ask me for the passphrase again and worked.

Maybe something with passphrase caching?

Greetings,
Jochen
-- 
Einigkeit und Recht und Freiheit                http://www.Jochen-Kuepper.de
    Liberté, Égalité, Fraternité                GnuPG key: CC1B0B4D
        (Part 3 you find in my messages before fall 2003.)

PGG broken? (was: Signing issues with gnus from CVS)

[Marcus Frings]

* Bastien <bzg@altern.org> wrote:
> Norman Walsh <ndw@nwalsh.com> writes:

>> / gdt@work.lexort.com was heard to say:
>> | I got this once, but usually not.  Actually I just got sign error, but
>> | didn't look at backtrace.

>> I don't get it everytime, but definitely several times a day.

> Same here.  The only clue is this: you're not alone.  gnupg complains
> about wrong password (sent by pgg?).  This happend with gnus cvs of
> this morning as well.

And I can confirm this, too. PGG or something else seems to be pretty
broken since about 2 or 3 weeks.

My experiences:

1) When I use the set-policy-url option in my gpg.conf I can't sign
   mails anymore ("sign error"). After removing this option I can sign
   mails again.

2) Certain mails fail to decrypt. I'm asked for my passphrase again and
   again (and I *really* typed it correctly). Going back to an official
   Gnus release helped to successfully decrypt this certain mail.

3) I use PGG's passphrase-caching. I want to read an encrypted mail and
   enter my passphrase and the mail gets decrypted. Then I go to another
   encrypted mail and instead of decrypting it, I get:

,----
| [[PGP Encrypted Part:Failed]]
| [1. application/pgp-encrypted]
| 
| Version: 1
| [[End of PGP Encrypted Part]]
`----

  Then I move around in the buffer and enter other messages and then go
  back to the mail which failed to decrypt before and suddenly it gets
  automatically decrypted.

I enabled pgg-gpg-debug but can't find anything useful to report in the
corresponding buffers. I'm also trying to go back and checking out
several CVS versions from the last days/weeks but have been unsucessful
so far to find out when this "behaviour" was introduced.

By the way, I'm using GPG 1.4.3 and fresh CVS versions of Gnus on both
Debian and FreeBSD. CVS Emacs is fresh as well.

Regards,
Marcus
-- 
Suicide is an urban disease
Spread by people and places like these
A quick self destruct from the 21st floor
A smell of gas through the kitchen door

Re: PGG broken?

[Marcus Frings]

* Marcus Frings <iam-est-hora-surgere@despammed.com> wrote:

> 1) When I use the set-policy-url option in my gpg.conf I can't sign
>    mails anymore ("sign error"). After removing this option I can sign
>    mails again.

> 2) Certain mails fail to decrypt. I'm asked for my passphrase again and
>    again (and I *really* typed it correctly). Going back to an official
>    Gnus release helped to successfully decrypt this certain mail.

> 3) I use PGG's passphrase-caching. I want to read an encrypted mail and
>    enter my passphrase and the mail gets decrypted. Then I go to another
>    encrypted mail and instead of decrypting it, I get:

Hm, does really nobody have an idea?

Regards,
Marcus
-- 
"The sun shines on the aluminium
I guess this must be the home of the hitmen"

Re: PGG broken?

[Norman Walsh]

[-- Attachment #1: Type: text/plain, Size: 514 bytes --]

/ Marcus Frings <iam-est-hora-surgere@despammed.com> was heard to say:
[...]
| Hm, does really nobody have an idea?

Ditto :-/

                                        Be seeing you,
                                          norm

-- 
Norman Walsh <ndw@nwalsh.com> | The worst enemy of life, freedom and
http://nwalsh.com/            | the common decencies is total anarchy;
                              | their second worst enemy is total
                              | efficiency.--Aldous Huxley

[-- Attachment #2: Type: application/pgp-signature, Size: 190 bytes --]

Re: PGG broken?

[Andreas Seltenreich]

Marcus Frings schrob:

> * Marcus Frings <iam-est-hora-surgere@despammed.com> wrote:
>
>> 1) When I use the set-policy-url option in my gpg.conf I can't sign
>>    mails anymore ("sign error"). After removing this option I can sign
>>    mails again.

Hmm, did you really get a "sign error" signalled?[1] When I tried to
reproduce it, I got a 'search-failed one from pgg-parse-armor, because
pgg-gpg-sign-region returned successful signing status and an empty
output buffer at the same time.

In my case, GnuPG[2] returned a non-zero exit-status because it couldn't
generate a signature with a policy URL while maintaining PGP
compatibility. Nevertheless, it did the signing without a policy URL
and reported SIG_CREATED.

The non-zero exit status caused the pgg-gpg sentinel to discard the
output, pgg-gpg-sign-region however saw the SIG_CREATED on the
status-fd and returned success despite the discarded output.

Switching PGP-compatibility off via "openpgp" in gpg.conf made the
signing succeed with a policy URL set.

Of course, the underdone error handling is still there, and I wonder
if one should fix it by making the sentinel not discard the output on
non-zero exit status, or forcing pgg-gpg to return failure even if
there might be useful output. Anyone?

regards,
andreas

[1] I'm figuring that the " *MML2015 result*" buffer should have
    popped up then, and the problem with the policy-url option should
    have been obvious. OTOH you might have already disabled PGP
    compatibility, and are experiencing a different bug :-/.

[2] 1.4.1

Re: PGG broken?

[Andreas Seltenreich]

Andreas Seltenreich <andreas+ding@gate450.dyndns.org> writes:

> Marcus Frings schrob:
>
>> * Marcus Frings <iam-est-hora-surgere@despammed.com> wrote:
>>
>>> 1) When I use the set-policy-url option in my gpg.conf I can't sign
>>>    mails anymore ("sign error"). After removing this option I can sign
>>>    mails again.
[...]
> Of course, the underdone error handling is still there, and I wonder
> if one should fix it by making the sentinel not discard the output on
> non-zero exit status, or forcing pgg-gpg to return failure even if
> there might be useful output. Anyone?

I've studied the code on the trunk a bit more, and discovered another
major issue: The usage of the same file descriptor for commands and
data fails horribly in some places. This is responsible for the rest
of the bugs I managed to reproduce.

ISTM both problems have already been identified and fixed two months
ago, but didn't make it into the No Gnus CVS:

<http://permalink.gmane.org/gmane.emacs.devel/52470>
<http://www.unixuser.org/~ueno/pgg-20060407.tar.gz>

Re: PGG broken?

[Marcus Frings]

* Andreas Seltenreich <andreas+ding@gate450.dyndns.org> wrote:
> Marcus Frings schrob:

>> * Marcus Frings <iam-est-hora-surgere@despammed.com> wrote:

>>> 1) When I use the set-policy-url option in my gpg.conf I can't sign
>>>    mails anymore ("sign error"). After removing this option I can sign
>>>    mails again.

> Hmm, did you really get a "sign error" signalled?[1] When I tried to
> reproduce it, I got a 'search-failed one from pgg-parse-armor, because
> pgg-gpg-sign-region returned successful signing status and an empty
> output buffer at the same time.

Yes, see
<vita-brevis-breviter-in-brevi-finietur-mors-venit-velociter-quae-neminem-veretur-86mze537am.fsf@shodan.gothgoose.net>.

> In my case, GnuPG[2] returned a non-zero exit-status because it couldn't
> generate a signature with a policy URL while maintaining PGP
> compatibility. Nevertheless, it did the signing without a policy URL
> and reported SIG_CREATED.

Yes, this is reported in the debugging buffer. See my thread mentioned
above.

> Switching PGP-compatibility off via "openpgp" in gpg.conf made the
> signing succeed with a policy URL set.

Yes, this should be a work-around. However, I'm just using a rather
simple and standard gpg.conf.

> Of course, the underdone error handling is still there, and I wonder
> if one should fix it by making the sentinel not discard the output on
> non-zero exit status, or forcing pgg-gpg to return failure even if
> there might be useful output. Anyone?

I think it's something in pgg.el because when I exchange my pgg.el from
CVS with the one from the stable release of Gnus everything works fine
again.

Regards,
Marcus
-- 
"Nur die halbe Welt ist Teflon und Asbest,
der Rest ist brennbar und mitunter 
angezündet ganz munter anzuschaun.
So lichterloh, lichterloh und alles fuer König Feurio!"