Enigmail 2.0 update breaks qubes-gpg-split

[TFQOS]

Qubes OS version:

R3.2, fedora 26, testing repos enabled

Affected component(s):

qubes-gpg-split

---

Steps to reproduce the behavior:

Use Enigmail 2.0 (on Thunderbird 52.7.0 x64) with qubes-gpg-split

Expected behavior:

qubes-gpg-split should support '--no-auto-check-trustdb' option

Actual behavior:

Thunderbird stays frozen indefinitely trying the command:
/usr/bin/qubes-gpg-client-wrapper --charset utf-8 --display-charset utf-8 --no-auto-check-trustdb --batch --no-tty --status-fd 2 --with-fingerprint --fixed-list-mode --with-colons --list-keys
The command returns:
qubes-gpg-client: unrecognized option '--no-auto-check-trustdb

General notes:

Enigmail 2.0 use a new command-line option '--no-auto-check-trustdb'.
qubes-gpg-split should support this option.

Temporary fix: patching /usr/bin/qubes-gpg-client-wrapper with

--no-auto-check-trustdb)
shift
;;

to ignore the option.

---

Related issues:

Not found

[holiman]

Can confirm the same on 4.0 (R4.0). Can also confirm that the fix above works.

[holiman]

Can confirm the same on 4.0 (R4.0). Can also confirm that the fix above works.

[mfc]

thanks @TFQOS for investigating the root cause.

I would bump up the priority of this and get the quick fix out, as this bug will break the most common split-gpg setups for all Qubes users.

related threads:
qubes-users: https://groups.google.com/d/msg/qubes-users/G2ii-BBOQgE/G5QV1w_1CQAJ
enigmail-users: https://admin.hostpoint.ch/pipermail/enigmail-users_enigmail.net/2018-March/004854.html

[mfc]

thanks @TFQOS for investigating the root cause.

I would bump up the priority of this and get the quick fix out, as this bug will break the most common split-gpg setups for all Qubes users.

related threads:
qubes-users: https://groups.google.com/d/msg/qubes-users/G2ii-BBOQgE/G5QV1w_1CQAJ
enigmail-users: https://admin.hostpoint.ch/pipermail/enigmail-users_enigmail.net/2018-March/004854.html

[TFQOS]

@@ -10,6 +10,10 @@
 while [[ $1 ]]; do
     if ! ((eoo)); then
         case "$1" in
+            # https://github.com/QubesOS/qubes-issues/issues/3750
+            --no-auto-check-trustdb)
+                shift
+                ;;
             --import)
                 # ignore all the options and only collect file name(s) - if any
                 shift

This patch should be applied to /usr/bin/qubes-gpg-client-wrapper (preferably in the template, or at each start of the VM)

'--no-auto-check-trustdb' seems related to performance concerns, should we just ignore it in qubes wrapper?
Or should we patch qubes-gpg-client binary?

[TFQOS]

@@ -10,6 +10,10 @@
 while [[ $1 ]]; do
     if ! ((eoo)); then
         case "$1" in
+            # https://github.com/QubesOS/qubes-issues/issues/3750
+            --no-auto-check-trustdb)
+                shift
+                ;;
             --import)
                 # ignore all the options and only collect file name(s) - if any
                 shift

This patch should be applied to /usr/bin/qubes-gpg-client-wrapper (preferably in the template, or at each start of the VM)

'--no-auto-check-trustdb' seems related to performance concerns, should we just ignore it in qubes wrapper?
Or should we patch qubes-gpg-client binary?

[marmarek]

After reading https://dev.gnupg.org/T2019, I'd go with adding the option to the whitelist.

[marmarek]

After reading https://dev.gnupg.org/T2019, I'd go with adding the option to the whitelist.

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.29-1.fc23 has been pushed to the r3.2 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.29-1.fc23 has been pushed to the r3.2 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.29-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.29-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.29-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.29-1.fc26) has been pushed to the r3.2 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.29-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.29-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb10u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing buster-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb10u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing buster-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb10u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing buster-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb10u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing buster-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.29-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[cooperq]

for those who are hand patching this I also had to add the following line to /usr/bin/qubes-gpg-client-wrapper:

--sender)
shift
;;

[cooperq]

for those who are hand patching this I also had to add the following line to /usr/bin/qubes-gpg-client-wrapper:

--sender)
shift
;;

[Cyrixo]

Hello,
I use Qubes r4.0 and thunderbird, enigmail on fedora 26.
I installed the update under dom0 and fedora but the body of the message in thunderbird remains white.

[Cyrixo]

Hello,
I use Qubes r4.0 and thunderbird, enigmail on fedora 26.
I installed the update under dom0 and fedora but the body of the message in thunderbird remains white.

[andrewdavidwong]

I use Qubes r4.0 and thunderbird, enigmail on fedora 26.
I installed the update under dom0 and fedora but the body of the message in thunderbird remains white.

The problem you're describing sounds different from the bug that this issue is about. If that's correct, please file a separate issue for your problem. If it's incorrect, please explain how the problem you're describing is the same as the one this issue is about.

[andrewdavidwong]

I use Qubes r4.0 and thunderbird, enigmail on fedora 26.
I installed the update under dom0 and fedora but the body of the message in thunderbird remains white.

The problem you're describing sounds different from the bug that this issue is about. If that's correct, please file a separate issue for your problem. If it's incorrect, please explain how the problem you're describing is the same as the one this issue is about.

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[grote]

I am now having a similar issue with Enigmail adding --sender address@example.org to the command. Anybody else seeing this?

[grote]

I am now having a similar issue with Enigmail adding --sender address@example.org to the command. Anybody else seeing this?

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.30-1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.30-1.fc25 has been pushed to the r4.0 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.30-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.30-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[cubi7]

Will the be a plan to add the updated qubes-gpg-split to r3.2 stable? It is still on 2.0.28 and can not work with new enigmail and never version are nearly 2 months old. This will stop user be able to update enigmail to fix coming GPG secuity issues

https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now

[cubi7]

Will the be a plan to add the updated qubes-gpg-split to r3.2 stable? It is still on 2.0.28 and can not work with new enigmail and never version are nearly 2 months old. This will stop user be able to update enigmail to fix coming GPG secuity issues

https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now

[marmarek]

GPG update is not the same as enigmail update or qubes-gpg-split update.

[marmarek]

GPG update is not the same as enigmail update or qubes-gpg-split update.

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.30-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split_2.0.30-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.30-1.fc23 has been pushed to the r3.2 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-gpg-split-dom0-2.0.30-1.fc23 has been pushed to the r3.2 stable repository for dom0.
To install this update, please use the standard update command:

sudo qubes-dom0-update

Or update dom0 via Qubes Manager.

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r3.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r3.2 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component app-linux-split-gpg (including package qubes-gpg-split-2.0.30-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package app-linux-split-gpg has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update