Re: [PATCH 2/2] isar-bootstrap: Do not let gpg-agent to stay running

[Henning Schild <henning.schild@siemens.com>]

Am Fri,  3 Sep 2021 19:31:05 +0300
schrieb Anton Mikanovich <amikan@ilbers.de>:

> If running gpg-agent as a daemon we make it to run apt-key as a child
> of gpg-agent. After the finish of apt-key parent gpg-agent will be
> also finished in that mode.
> This will allow us not to control start-stop of gpg-agent (which was
> actually broken before this commit) and get rid of any possible issues
> caused by left gpg-agent processes.
> 
> Signed-off-by: Anton Mikanovich <amikan@ilbers.de>
> ---
>  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc index
> e87c091..5f87f10 100644 ---
> a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc +++
> b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc @@ -335,20
> +335,18 @@ do_bootstrap() { MY_GPGHOME="$(chroot "${ROOTFSDIR}"
> mktemp -d /tmp/gpghomeXXXXXXXXXX)" echo "Created temporary directory
> ${MY_GPGHOME} for gpg-agent" export GNUPGHOME="${MY_GPGHOME}"
> -            chroot "${ROOTFSDIR}" gpg-agent --daemon
>              APT_KEY_APPEND="--homedir ${MY_GPGHOME}"
>          fi
>          find ${APT_KEYS_DIR}/ -type f | while read keyfile
>          do
>              kfn="$(basename $keyfile)"
>              cp $keyfile "${ROOTFSDIR}/tmp/$kfn"
> -            chroot "${ROOTFSDIR}" /usr/bin/apt-key \
> +            chroot "${ROOTFSDIR}" /usr/bin/gpg-agent --daemon --
> /usr/bin/apt-key \ --keyring ${THIRD_PARTY_APT_KEYRING}
> ${APT_KEY_APPEND} add "/tmp/$kfn" rm "${ROOTFSDIR}/tmp/$kfn"
>          done
> -        if [ -d "${MY_GPGHOME}" ]; then
> -            echo "Killing gpg-agent for ${MY_GPGHOME}"
> -            chroot "${ROOTFSDIR}" gpgconf --kill gpg-agent &&
> /bin/rm -rf "${MY_GPGHOME}"

Venkata found that /tmp/gpghomeXXXXXXX to be part of the rootfs. It not
being deleted had the same reason the agent was never killed.

> +        if [ "${@get_distro_needs_gpg_support(d)}" = "gnupg" -a -d
> "${ROOTFSDIR}${MY_GPGHOME}" ]; then

Why that new condition on get_distr_needs_gpg_support? I think this can
go away. In fact i think the whole if can go since the rm has a -f.

If the condition needs to stay ... i think
  
  -n "${@get_distro_needs_gpg_support(d)}"

would be better than "= gnupg"

And in fact we can probably keep using daemon mode and pull that kill
out of the if as well

chroot "${ROOTFSDIR}" gpgconf --kill gpg-agent || true
rm -rf "${ROOTFSDIR}${MY_GPGHOME}"

Could be a little more efficient, but probably not worth too much
investigation. Just choose what seems more readable and maintainable.

Henning

> +            rm -rf "${ROOTFSDIR}${MY_GPGHOME}"
>          fi
>  
>          if [ "${@get_distro_suite(d)}" = "stretch" ] && [
> "${@get_host_release().split('.')[0]}" -lt "4" ]; then