<div dir="ltr">Milki suggests we add this option to GPG_OPTS.<div><br></div><div> --no-secmem-warning</div><div> Suppress the warning about "using insecure memory".</div><div><br></div><div>It would make the output more consistent, and make reencryption work on FreeBSD.</div>
<div><br></div><div>Thoughts?</div><div><br></div><br><div class="gmail_quote"><span style="font-size:large;font-weight:bold">Forwarded conversation</span><br>Subject: <b class="gmail_sendername">I've made pass bsd friendly</b><br>
------------------------<br><br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>></span><br>Date: Mon, May 5, 2014 at 6:33 AM<br>
To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br></font><br></span><br>sysutils/tree to 1.7.0 patch has been submitted and is awaiting for approval.<br>
<br>
These re-encryption tests don't pass on FreeBSD from master:<br>
<br>
<br>
ok 1 - Setup initial key and git<br>
not ok 2 - Root key encryption<br>
#<br>
# "$PASS" insert -e folder/cred1 <<<"$INITIAL_PASSWORD" &&<br>
# [[ $(canonicalize_gpg_keys "$KEY1") == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 3 - Reencryption root single key<br>
#<br>
# "$PASS" init $KEY2 &&<br>
# [[ $(canonicalize_gpg_keys "$KEY2") == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 4 - Reencryption root multiple key<br>
#<br>
# "$PASS" init $KEY2 $KEY3 $KEY1 &&<br>
# [[ $(canonicalize_gpg_keys $KEY2 $KEY3 $KEY1) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 5 - Reencryption root multiple key with string<br>
#<br>
# "$PASS" init $KEY2 $KEY3 $KEY1 "pass test key 4" &&<br>
# [[ $(canonicalize_gpg_keys $KEY2 $KEY3 $KEY1 $KEY4) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 6 - Reencryption root group<br>
#<br>
# "$PASS" init group1 &&<br>
# [[ $(gpg_keys_from_group group1) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 7 - Reencryption root group with spaces<br>
#<br>
# "$PASS" init "big group" &&<br>
# [[ $(gpg_keys_from_group "big group") == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 8 - Reencryption root group with spaces and other keys<br>
#<br>
# "$PASS" init "big group" $KEY3 $KEY1 $KEY2 &&<br>
# [[ $(canonicalize_gpg_keys $KEY3 $KEY1 $KEY2 $(gpg_keys_from_group "big group")) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 9 - Reencryption root group and other keys<br>
#<br>
# "$PASS" init group2 $KEY3 $KEY1 $KEY2 &&<br>
# [[ $(canonicalize_gpg_keys $KEY3 $KEY1 $KEY2 $(gpg_keys_from_group group2)) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/folder/cred1.gpg")" ]]<br>
#<br>
not ok 10 - Reencryption root group to identical individual with no file change<br>
#<br>
# oldfile="$SHARNESS_TRASH_DIRECTORY/$RANDOM.$RANDOM.$RANDOM.$RANDOM.$RANDOM" &&<br>
# "$PASS" init group1 &&<br>
# cp "$PASSWORD_STORE_DIR/folder/cred1.gpg" "$oldfile" &&<br>
# "$PASS" init $KEY4 $KEY2 &&<br>
# test_cmp "$PASSWORD_STORE_DIR/folder/cred1.gpg" "$oldfile"<br>
#<br>
not ok 11 - Reencryption subfolder multiple keys, copy<br>
#<br>
# "$PASS" init -p anotherfolder $KEY3 $KEY1 &&<br>
# "$PASS" cp folder/cred1 anotherfolder/ &&<br>
# [[ $(canonicalize_gpg_keys $KEY1 $KEY3) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/anotherfolder/cred1.gpg")" ]]<br>
#<br>
not ok 12 - Reencryption subfolder multiple keys, move, deinit<br>
#<br>
# "$PASS" init -p anotherfolder2 $KEY3 $KEY4 $KEY2 &&<br>
# "$PASS" mv -f anotherfolder anotherfolder2/ &&<br>
# [[ $(canonicalize_gpg_keys $KEY1 $KEY3) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/anotherfolder2/anotherfolder/cred1.gpg")" ]] &&<br>
# "$PASS" init -p anotherfolder2/anotherfolder "" &&<br>
# [[ $(canonicalize_gpg_keys $KEY3 $KEY4 $KEY2) == "$(gpg_keys_from_encrypted_file "$PASSWORD_STORE_DIR/anotherfolder2/anotherfolder/cred1.gpg")" ]]<br>
#<br>
ok 13 - Password lived through all transformations<br>
ok 14 - Git picked up all changes throughout<br>
# failed 11 among 14 test(s)<br>
<span class=""><font color="#888888"><br>
<br>
--<br>
milki<br>
</font></span><br>----------<br><span class=""><font color="#888">From: <b class="">Jason A. Donenfeld</b> <span dir="ltr"><<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>></span><br>Date: Mon, May 5, 2014 at 1:33 PM<br>
To: milki <<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>><br></font><br></span><br><div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote"><div class="">On Mon, May 5, 2014 at 6:33 AM, milki <span dir="ltr"><<a href="mailto:milki@freebsd.org" target="_blank">milki@freebsd.org</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
These re-encryption tests don't pass on FreeBSD from master:</blockquote><div><br></div></div><div>Could you run:</div><div><br></div><div>gmake test PASS_TEST_OPTS=-v</div><div><br></div><div>And send me the output of that? </div>
</div></div></div>
<br>----------<br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>></span><br>Date: Mon, May 5, 2014 at 5:54 PM<br>To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br>
</font><br></span><br><div class="">On 13:33 Mon 05 May , Jason A. Donenfeld wrote:<br>
> Could you run:<br>
><br>
> gmake test PASS_TEST_OPTS=-v<br>
><br>
> And send me the output of that?<br>
<br>
</div>Attached.<br>
<span class=""><font color="#888888"><br>
--<br>
milki<br>
</font></span><br>----------<br><span class=""><font color="#888">From: <b class="">Jason A. Donenfeld</b> <span dir="ltr"><<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>></span><br>Date: Tue, May 6, 2014 at 5:44 PM<br>
To: milki <<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>><br></font><br></span><br><div dir="ltr">I cant seem to reproduce:<br><br><b>[zx2c4@freebsdvm ~]$ uname -a<br></b>FreeBSD freebsdvm 10.0-RELEASE-p1 FreeBSD 10.0-RELEASE-p1 #0: Tue Apr 8 06:45:06 UTC 2014 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64<br>
<div><b>[zx2c4@freebsdvm ~]$ bash --version</b></div><div>GNU bash, version 4.3.11(2)-release (amd64-portbld-freebsd10.0)<br></div><div>Copyright (C) 2013 Free Software Foundation, Inc.</div><div>License GPLv3+: GNU GPL version 3 or later <<a href="http://gnu.org/licenses/gpl.html" target="_blank">http://gnu.org/licenses/gpl.html</a>></div>
<div><br></div><div>This is free software; you are free to change and redistribute it.</div><div>There is NO WARRANTY, to the extent permitted by law.</div><div><div><b>[zx2c4@freebsdvm ~]$ gpg --version</b></div><div>gpg (GnuPG) 2.0.22</div>
<div>libgcrypt 1.5.3</div><div>Copyright (C) 2013 Free Software Foundation, Inc.</div><div>License GPLv3+: GNU GPL version 3 or later <<a href="http://gnu.org/licenses/gpl.html" target="_blank">http://gnu.org/licenses/gpl.html</a>></div>
<div>This is free software: you are free to change and redistribute it.</div><div>There is NO WARRANTY, to the extent permitted by law.</div><div><br></div><div>Home: ~/.gnupg</div><div>Supported algorithms:</div><div>Pubkey: RSA, ELG, DSA, ?, ?</div>
<div>Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,</div><div> CAMELLIA128, CAMELLIA192, CAMELLIA256</div><div>Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224</div><div>Compression: Uncompressed, ZIP, ZLIB, BZIP2</div>
</div><b>[zx2c4@freebsdvm ~]$ git clone git://<a href="http://git.zx2c4.com/password-store" target="_blank">git.zx2c4.com/password-store</a><br></b>Cloning into 'password-store'...<br>remote: Counting objects: 1537, done.<br>
remote: Compressing objects: 100% (1376/1376), done.<br>
remote: Total 1537 (delta 851), reused 195 (delta 115)<br>Receiving objects: 100% (1537/1537), 271.90 KiB | 0 bytes/s, done.<br>Resolving deltas: 100% (851/851), done.<br>Checking connectivity... done.<br><b>[zx2c4@freebsdvm ~]$ cd password-store/<br>
[zx2c4@freebsdvm ~/password-store]$ gmake test<br></b>ok 1 - Make sure we can run pass<br>ok 2 - Make sure we can initialize our test store<br># passed all 2 test(s)<br>1..2<br>ok 1 - Test "generate" command<br>
ok 2 - Test replacement of first line<br># passed all 2 test(s)<br>1..2<br>ok 1 - Test "show" command<br>ok 2 - Test "show" command with spaces<br>ok 3 - Test "show" of nonexistant password<br>
# passed all 3 test(s)<br>1..3<br>ok 1 - Basic move command<br>ok 2 - Directory creation<br>ok 3 - Directory creation with file rename and empty directory removal<br>ok 4 - Directory rename<br>ok 5 - Directory move into new directory<br>
ok 6 - Multi-directory creation and multi-directory empty removal<br>ok 7 - Password made it until the end<br>ok 8 - Git is consistent<br># passed all 8 test(s)<br>1..8<br>ok 1 - Test "rm" command<br>ok 2 - Test "rm" command with spaces<br>
ok 3 - Test "rm" of non-existent password<br># passed all 3 test(s)<br>1..3<br>ok 1 - Test "insert" command<br># passed all 1 test(s)<br>1..1<br>ok 1 - Test "edit" command<br># passed all 1 test(s)<br>
1..1<div class=""><br>ok 1 - Setup initial key and git<br></div><div class="">ok 2 - Root key encryption<br></div><div class="">ok 3 - Reencryption root single key<br></div><div class="">ok 4 - Reencryption root multiple key<br>
</div><div class="">ok 5 - Reencryption root multiple key with string<br></div><div class="">ok 6 - Reencryption root group<br></div><div class="">
ok 7 - Reencryption root group with spaces<br></div><div class="">ok 8 - Reencryption root group with spaces and other keys<br></div><div class="">ok 9 - Reencryption root group and other keys<br></div><div class="">ok 10 - Reencryption root group to identical individual with no file change<br>
</div><div class="">
ok 11 - Reencryption subfolder multiple keys, copy<br></div><div class="">ok 12 - Reencryption subfolder multiple keys, move, deinit<br></div><div class="">ok 13 - Password lived through all transformations<br>ok 14 - Git picked up all changes throughout<br>
</div># passed all 14 test(s)<br>
1..14<br>ok 1 - Make sure grep prints normal lines<br># passed all 1 test(s)<br>1..1<br>ok 1 - Make sure find resolves correct files<br># passed all 1 test(s)<br>1..1</div>
<br><span class=""><br></span><br><div dir="ltr">I can also confirm the non-broken behavior in gpg1:<div><br></div><div><div>[zx2c4@freebsdvm ~/password-store]$ gpg --version</div><div>gpg (GnuPG) 1.4.16</div><div class="">
<div>Copyright (C) 2013 Free Software Foundation, Inc.</div>
<div>License GPLv3+: GNU GPL version 3 or later <<a href="http://gnu.org/licenses/gpl.html" target="_blank">http://gnu.org/licenses/gpl.html</a>></div><div>This is free software: you are free to change and redistribute it.</div>
<div>
There is NO WARRANTY, to the extent permitted by law.</div><div><br></div><div>Home: ~/.gnupg</div><div>Supported algorithms:</div></div><div>Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA</div><div class=""><div>Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,</div>
<div> CAMELLIA128, CAMELLIA192, CAMELLIA256</div><div>Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224</div><div>Compression: Uncompressed, ZIP, ZLIB, BZIP2</div></div></div><div><br></div></div>
<br>
<br>----------<br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>></span><br>Date: Sat, May 10, 2014 at 6:56 AM<br>
To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br>Cc: milki <<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>><br></font><br></span><br><div class="">On 17:44 Tue 06 May , Jason A. Donenfeld wrote:<br>
> I cant seem to reproduce:<br>
><br>
><br>
</div>> *[zx2c4@freebsdvm ~]$ uname -a*FreeBSD freebsdvm 10.0-RELEASE-p1 FreeBSD<br>
<div class="">> 10.0-RELEASE-p1 #0: Tue Apr 8 06:45:06 UTC 2014<br>
<br>
</div>I'm on 8.4-RELEASE and 9.2-RELEASE<br>
<div class=""><br>
><br>
> This is free software; you are free to change and redistribute it.<br>
> There is NO WARRANTY, to the extent permitted by law.<br>
</div>> *[zx2c4@freebsdvm ~]$ gpg --version*<br>
<div class="">> gpg (GnuPG) 2.0.22<br>
> libgcrypt 1.5.3<br>
<br>
</div>Same versions as well, but the my output seems different. After sort,<br>
theres an extra newline. I've attached the patch I needed to make the<br>
test suite pass. There must be a discrepency somewhere.<br>
<span class=""><font color="#888888"><br>
--<br>
milki<br>
</font></span><br>----------<br><span class=""><font color="#888">From: <b class="">Jason A. Donenfeld</b> <span dir="ltr"><<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>></span><br>Date: Sat, May 10, 2014 at 6:08 PM<br>
To: milki <<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>><br>Cc: milki <<a href="mailto:milki@freebsd.org">milki@freebsd.org</a>><br></font><br></span><br><div dir="ltr">I don't understand why this fixes anything. The following script behaves the same way on GNU and on FreeBSD 9.2-RELEASE.<div>
<br></div><div>Can you make a simple test case of how behavior differs on GNU and on old FreeBSD, and show a compatible fix?<br>
<div><br></div><div><div>zx2c4@thinkpad ~ $ cat bsd-sorting.sh </div><div>#!/bin/sh</div><div><br></div><div>echo "== sort -u =="</div><div><br></div><div><br></div><div>printf 'millsite\nsubterraneously\ntetrakaidecahedron\nsegregational\nentozoology\nsegregational\nPhilanthus\nPhilanthus\nsegregational\ncelestite\navicolous\ncelestite\nentozoology\nunridiculed\nsegregational\nPhilanthus\nantonym\ntheanthropical\nprotransfer\nsegregational\nprotransfer\nsubterraneously\ntetrakaidecahedron\nultraenthusiastic\nantonym\n' | sort -u</div>
<div>echo</div><div><br></div><div><br></div><div>echo "== sort | uniq =="</div><div><br></div><div>printf 'millsite\nsubterraneously\ntetrakaidecahedron\nsegregational\nentozoology\nsegregational\nPhilanthus\nPhilanthus\nsegregational\ncelestite\navicolous\ncelestite\nentozoology\nunridiculed\nsegregational\nPhilanthus\nantonym\ntheanthropical\nprotransfer\nsegregational\nprotransfer\nsubterraneously\ntetrakaidecahedron\nultraenthusiastic\nantonym\n' | sort | uniq</div>
<div>echo</div><div><br></div><div>echo "== sort -u | tail -n +2 "</div><div><br></div><div>printf 'millsite\nsubterraneously\ntetrakaidecahedron\nsegregational\nentozoology\nsegregational\nPhilanthus\nPhilanthus\nsegregational\ncelestite\navicolous\ncelestite\nentozoology\nunridiculed\nsegregational\nPhilanthus\nantonym\ntheanthropical\nprotransfer\nsegregational\nprotransfer\nsubterraneously\ntetrakaidecahedron\nultraenthusiastic\nantonym\n' | sort -u | tail -n +2</div>
<div>echo</div></div><div><br></div></div></div>
<br>----------<br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>></span><br>Date: Sat, May 10, 2014 at 6:57 PM<br>
To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br></font><br></span><br><div class="">On 18:08 Sat 10 May , Jason A. Donenfeld wrote:<br>
> I don't understand why this fixes anything.<br>
<br>
</div>I'm not suggesting this as an actual fix. I'm still investigating why<br>
there's a newline at all in the input.<br>
<br>
I was simply printing out the output of gpg_keys_from_encrypted_file<br>
and discovered there was an unexpected blank line. I intend to continue<br>
looking into this.<br>
<br>
In the meantime, sysutils/tree 1.7.0 was committed to ports.<br>
<span class=""><font color="#888888"><br>
--<br>
milki<br>
</font></span><br>----------<br><span class=""><font color="#888">From: <b class="">Jason A. Donenfeld</b> <span dir="ltr"><<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>></span><br>Date: Sat, May 10, 2014 at 7:31 PM<br>
To: milki <<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>><br></font><br></span><br><div dir="ltr">Sorry for the screenshot, but I'm doing this in a VM...<div><br></div><div>It works for me:<br>
<div><br></div><div><img src="cid:ii_145e73006d1e82e6" alt="Inline image 1" width="412" height="203.13888888888889"><br>
</div></div></div>
<span class=""><br></span><br><div dir="ltr">I installed 9.2 from the boot cd. I went to /usr/src/ports and make install'd portmaster. Then I ran "portmaster shells/bash sysutils/tree security/gnupg misc/getopt sysutils/pwgen devel/git devel/gmake". Then I git cloned the git repo. Then I ran the test. It worked.</div>
<br>----------<br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>></span><br>Date: Mon, May 12, 2014 at 9:29 AM<br>
To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br></font><br></span><br><div class=""></div>TESTTESTTESTTESTTESTTESTTESTTESTTESTTEST<br>
Warning: using insecure memory!<br>
gpg: public key is 2EE5CDCE9B368A49<br>
gpg: public key is 4137F8355122C2A5<br>
gpg: public key is BEDE59896B2B2DF9<br>
<br>
2EE5CDCE9B368A49<br>
4137F8355122C2A5<br>
BEDE59896B2B2DF9<br>
TESTTESTTESTTESTTESTTESTTESTTESTTESTTEST<br>
<br>
So the Warning is showing up in the output of gpg of course. I wonder<br>
why your tests aren't seeing this empty line that results from it then.<br>
<br>
I did this patch to look at the gpg output.<br>
<span class=""><font color="#888888"><br>
<br>
--<br>
milki<br>
</font></span><br>----------<br><span class=""><font color="#888">From: <b class="">milki</b> <span dir="ltr"><<a href="mailto:milki@rescomp.berkeley.edu">milki@rescomp.berkeley.edu</a>></span><br>Date: Mon, May 12, 2014 at 9:48 AM<br>
To: "Jason A. Donenfeld" <<a href="mailto:Jason@zx2c4.com">Jason@zx2c4.com</a>><br></font><br></span><br>gnupg provides an option to disable the secmem warning!<br>
<br>
<a href="https://github.com/milki/password-store/tree/no_secmem" target="_blank">https://github.com/milki/password-store/tree/no_secmem</a><br>
<br>
If this option is cross-platform, this should fix this statement.<br>
<span class=""><font color="#888888"><br>
--<br>
milki<br>
</font></span><br></div><br><br clear="all"><div><br></div></div>