rpm --import <key> "fails with key 1 import failed"

[sshedi]

We discussed about this a bit at #1795 (comment) on-wards.
Creating this new thread based on @pmatilai's suggestion.

Issue details:

I followed https://access.redhat.com/articles/3359321 to generate keys. But after this fix, I'm unable to import the keys.

root [ ~ ]# rpm --import foo.key
error: foo.key: key 1 import failed.

root [ ~ ]# rpm -qi rpm
Name : rpm
Version : 4.16.1.3
Release : 12.ph4
Architecture: x86_64
Install Date: Tue Sep 13 16:57:51 2022

Can you please assist me on generating the keys properly?

Here are my patches where I back ported this CVE fix to 4.16.x

https://github.com/vmware/photon/blob/4.0/SPECS/rpm/CVE-2021-3521-1.patch
https://github.com/vmware/photon/blob/4.0/SPECS/rpm/CVE-2021-3521-2.patch
https://github.com/vmware/photon/blob/4.0/SPECS/rpm/CVE-2021-3521-3.patch

cc: @DemiMarie

Similar issue: #1977

[sshedi]

@DemiMarie I took daeddb0 as well but no progress, issue persists.

[DemiMarie]

That commit is needed for the PR to not cause a regression. It is not going to solve this problem. Please provide the steps you are using to generate the keys.

[sshedi]

Here is the key I'm using:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGNBGMhqWwBDADg1Eynf1irfd42bYQxxwOLoyOpFz3A0UoBDFtqHzx1nRbU5/MG
+e/U6hCrYapCxbmM/1cjRAxjdHN+K6YkgMlu0idRK1AALjwZzkMgSCQA3NHH75s8
paN9DiMjrzGeqILx9IySkmzfNhgufzfZEWQj/uUvGWQonuYZztrPRUxWSC1lVyvV
rhZjFDM4E6gahF+1wmgKSIWUF+3MBgFfjWCdInIfccqi3oippw1g4Z/+20842ndQ
mpmXhbVD27KQkeDujSteU/ErDWqP2yAz0nwTmWnkn2ppdCfbfAu+QT111XF7/av6
wwj+ULe7fe/OcflmpxJEMeWnAL30eIVYgPCczZP4ZYRWJ1CRM+crmrud27lUWjNZ
x70hKpOcg8Cf9ar/hdHBnqrqDvaPHuCx8YG4kqDbBU6OhaiKq/yeKI1W3/odJeLW
Nqqxv6uErIo2z0Vu/zuv9nFD6IaegVABsrIE/STJ7LU2dX6c2P7Ckv3tzaUebQ8V
u99CqW4vDcD6Z3MAEQEAAbQac3NoZWRpIDxzc2hlZGlAdm13YXJlLmNvbT6JAdQE
EwEKAD4WIQTWDAd7Bc/NlBaAxgVQBi9ZQkZ8vgUCYyGpbAIbAwUJA8JnAAULCQgH
AwUVCgkICwUWAgMBAAIeAQIXgAAKCRBQBi9ZQkZ8vuryC/9UNjobLtAffHhDseSd
sBQUu3ecBAmk2hSHTjgUvN3LmQ2iz70sRzMZLOthXKGpaLeIwBCsCndHLhOPT1A5
Yerw/hn8VmFo7mlqgwGQwuC7NsiIGji2rcjDPaY9Y/om7pJFiieQUZn0mxZUuG/F
9BGbvX6mWqU81yDro3q7SeVSUArKjm8f18dkKIP70cRBJC7O3SgI2M3ROUarv3Md
CN5n+KodfJP1bi6IiF5X3w4bI0nWds6XQ2iE5UwIUBeuDD7+VUWGcdshWxGJa8KT
ocsslvgQIS264AJuuUjC0IOIFJUkweSnbEePzF80UTn/krTppRX4w2xVBafnAs3o
1TdvXV2kgPwugn+wzNA1j1C6pe3jXXL78aAFuBxIjuCOQV+ROdyazr5CYj8kn6Vt
e8TQJqupuB6W3Sa4j5bhjgqe6E03QKQD8Q6fZNj+EU9OtfiMrSx8u2W4InxQE4yU
KqVnB4RgxS5i5BFu7ytEplWAVSVUxIL8EdE/oRIw3HwN1ii5AY0EYyGpbAEMAMV9
0/yqSHaIpxshb24ylC3weD2NMyqYUOt0O89vU6o4zlTPs5fk4OghVOjrHtbO7zMd
lEqpo9YrC1/K7wGjy+Xp2tsJbP+3ayp9U4+Dr8AkGNI4RQCR+KD5Hb2nehLnHtIn
WRK+ggnlzFRVFHgT7RnNdwwe/KWhSdEcYICyk0lIC4IAvXwcHqPXUm4OGiAc0dfw
mOm99lMe1DxV8X+ee8sCMpp3OZFaqJBJdGgk594hValOEVxj9bb8+z2GDvbjKgtn
9LWbpy2EWPahwCBkpE42R7vqxeJ0GXpVohpUjcXt5KuwE67VgUpo+THjGqbCvHGP
wPES4LvCswdMwwEPLs0BXIY49q98KMayKovgQHoA85Wg91/LKgx1cAyy12GT1MHF
s1Bg/LvxzSKyZRJV6Q2k66PJX04rf5yTemj/S8PkLPRgg0gIwAaq/sd57y1Uc7k8
OEFz/xtmsmoVKbNo2GzRJrF2mpNY3g/bjJPLOltW8j2SOVlc1hupDUtiJxZ5xQAR
AQABiQG8BBgBCgAmFiEE1gwHewXPzZQWgMYFUAYvWUJGfL4FAmMhqWwCGwwFCQPC
ZwAACgkQUAYvWUJGfL4SOgwAoSdQ5T3SloXsWPQyWk2Q9/D4UKeEo+xUZgAfyxfJ
9FIGr4+Xx1+B5aQuzPTPh09bb4aYHTaOvsLit6yCmXq18Pp1yo+TQTrj5a9MqQjm
tuS+wijV5QzxMBmzqhjNGdSZsWudvstsXlTIZHfWBgtysBG9sWE7l7PUXgv8Dqnj
yBz+aQyELIZJvsVJkN5OL6nSHy+KjWyXtkaRXajNSOflJHCVedcXu/EN9F0YaAty
C503WiXvP/TY/LMHAgfF9cnwypApvNmM619vfH6B6YLZNdCN6riu3lrlcuQRTkzf
+7ikTC7mCcyR0zmut2nvDvk3QmCN4PF2QWWHrFba+tLLr3EzRb1TbEoODLOZseoI
UD7GAyAZJ8rvJtR5Cxzi5EiZR3Pm0ctUW2I4fy+SoNWdHE3Es10KhiHfRxH4KRde
BRxNlM8Wo+IxjLeV6K4h4cVRU6FEpr9Tm9BBCEMk7hQIcEQqHLlCiVDV4SUL070R
z5bLieGF5DVgndeuJjj3WoPP
=r9ap
-----END PGP PUBLIC KEY BLOCK-----

Steps:

$ gpg --gen-key

Provide all the info needed in the prompts.

$ gpg --export -a 'sshedi' > RPM-GPG-KEY-pmanager

Now try importing.
$ rpm --import RPM-GPG-KEY-pmanager

[sshedi]

I used sq-keyring-linter RPM-GPG-KEY-pmanager and it's showing no issues with the key file.

[sshedi]

I think I got it. Off the top of my head, I took one of your fix related to pgp parsing, it was an embargo issue or something like it where we were supposed to fix it within given time.

https://github.com/vmware/photon/blob/4.0/SPECS/rpm/Fix-OpenPGP-parsing-bugs.patch

After removing this patch and consuming a bunch of other patches which does the job of this patch got things back to normal.

I think I took a really early version of that patch and now it's causing this issue. But upstream doesn't contain this code, so I guess the patch that was provided during the deadline and the actual code that went in were different.

[DemiMarie]

That sounds about right :)

[sshedi]

@DemiMarie can you please point me to the right commits for the pgp parsing bugs?

Currently I have taken the following patches:

4657161
d07c6ce
201e383
a44f026

Are these enough to address the pgp bugs?

[DemiMarie]

I will look later, but in generally anything that changed in rpmio/rpmpgp.c might need to be backported.

[sshedi]

Gentle reminder. Thanks for your inputs.

[DemiMarie]

@sshedi: I suggest taking all of my merged PRs to the OpenPGP code.