+ qgjRt^RIt^RIt^RIt^RIt^RIt^RIHt^RIH t H t ^RI H t ]P!]4tRt!RR4tR#)z0gpg.py - Collection of gpg key related functionsN)TemporaryDirectory)DictOptional)subp GNUPGHOMEca]tRt^toRtRt]V3RlRl4tRtV3RlRlt V3RlR lt V3R lR lt RV3R lR llt RV3RlRllt V3RlRltRV3RlRlltV3RlRltRtVtR#)GPGc@RVn/Vn\4VnR#)FN) gpg_started_envrtemp_dirselfs&//usr/lib/python3/dist-packages/cloudinit/gpg.py__init__ GPG.__init__s  *, cV#Nr s&r __enter__ GPG.__enter__s rc6<V^8dQhRS[S[S[3,/#)return)rstr)format __classdict__s"r __annotate__GPG.__annotate__#s  T#s(^ rc VP'd VP#RVn\VPP/VnVP#)zwhen this env property gets invoked, set up our temporary directory, and also set gpg_started to tell the cleanup() method whether or not why put this here and not in __init__? pytest seems unhappy and it's not obvious how to work around it T)r r HOMEr namer s&renvGPG.env"s? 99999 4==--. yyrc&VP4R#r)cleanup)rexc_typ exc_value tracebacks&&&&r__exit__ GPG.__exit__1s  rc<V^8dQhRR/#rrNr)rrs"rrr4s$$$rc VP4VP'dX\PP VPP 4'dVPP 4R#R#R#)z0cleanup the gpg temporary directory and kill gpgN)kill_gpgr ospathisdirr"r&r s&rr& GPG.cleanup4sG  ===RWW]]4==+=+=>> MM ! ! #?=rc6<V^8dQhRS[RS[S[,/#rkeyrrr)rrs"rrr:s   # rc \P!RRRV.RVPR7P# \Pd"p\P RY4Rp?R#Rp?ii;i)z*Export gpg key, armoured key gets returnedgpgz--exportz--armourTcapture update_env&Failed to export armoured key "%s": %sN)rr#stdoutProcessExecutionErrorLOGdebugrr6errors&& r export_armourGPG.export_armour:se L99 J488f   )) L II> K K Ls03A)A$$A)c&<V^8dQhRS[RS[/#r5r)rrs"rrrGs33rc b\P!RR.VRVPR7P#)zvDearmor gpg key, dearmored key gets returned note: man gpg(1) makes no mention of an --armour spelling, only --armor r9z --dearmorF)datadecoder<)rr#r>)rr6s&&rdearmor GPG.dearmorGs, yy K s5TXX & rc&<V^8dQhRS[RS[/#)rkey_filerrG)rrs"rrrPs#crc .ROpV'gVPR4VPV4\P!W0PRR7wrEV'd\P RW4V#)zList keys from a keyring with fingerprints. Default to a stable machine parseable format. @param key_file: a string containing a filepath to a key @param human_output: return output intended for human parsing z --with-colonsT)r<r;r=)r9z --no-optionsz--with-fingerprintz--no-default-keyringz --list-keysz --keyring)appendrr#r@warning)rrN human_outputcmdr>stderrs&&& r list_keys GPG.list_keysPsW  JJ ' 8388TJ  KK8(  rc*<V^8dQhRS[RS[RR/#)rr6 keyserverrNrG)rrs"rrrjs"55C5C5D5rc *\PRW4^pRp\T;'g.4pV^, p\P!RRRV,RV.RVPR7\PR VVV4R# \P d pTpRp?MRp?ii;i\ T4p\PR TPT4\P!T4K \dp\R YYE3,4ThRp?ii;i) aReceive gpg key from the specified keyserver. Retries are done by default because keyservers can be unreliable. Additionally, there is no way to determine the difference between a non-existent key and a failure. In both cases gpg (at least 2.2.4) exits with status 2 and stderr: "keyserver receive failed: No data" It is assumed that a key provided to cloud-init exists on the keyserver so re-trying makes better sense than failing. @param key: a string key fingerprint (as passed to gpg --recv-keys). @param keyserver: the keyserver to request keys from. @param retries: an iterable of sleep lengths for retries. Use None to indicate no retries.z&Importing key '%s' from keyserver '%s'NTr9z--no-ttyz--keyserver=%sz --recv-keysr:z/Imported key '%s' from keyserver '%s' on try %dz6Import failed with exit code %d, will try again in %ssz@Failed to import key '%s' from keyserver '%s' after %d tries: %s) r@rAiterrr#r?next exit_codetimesleep StopIteration ValueError) rr6rXretriestrynumrCsleepsenaplens &&&& rrecv_key GPG.recv_keyjs :CKgmm$ aKF  "(94% !#xx  E  --   f LOO  6"   ),/F+JK s1ABB%B  B%)AC-- D8D  Dc$<V^8dQhRS[RR/#)rr6rNrG)rrs"rrrs B Bc Bd Brc \P!RRRRV.RVPR7R# \Pd"p\P RY4Rp?R#Rp?ii;i) z0Delete the specified key from the local gpg ringr9z--batchz--yesz --delete-keysTr:zFailed delete key "%s": %sN)rr#r?r@rQrBs&& r delete_keyGPG.delete_keysX B II 7OSA88  )) B KK4c A A Bs(,A"AA"c<<V^8dQhRS[RS[RS[S[,/#)rkeyidrXrr7)rrs"rrrs)%( #rc VPV4pV'g9VPWR7VPV4pTP T4T#V# \d\P RT4hi;i TP T4i;i)zget gpg keyid from keyserver)rXzFailed to obtain gpg key %s)rDrfr`r@ exceptionrj)rrmrXarmours&&& r getkeybyidGPG.getkeybyids##E* ' e 9++E2& v   ;UC  &s#A#A77A::B c<V^8dQhRR/#r-r)rrs"rrrs.A.A$.Arc VP'gR#\P!R4'd2\P!.R ORVPR7PpR#\P!.R OR^^.R7Pp\ P !RV4pVUu.uF$q3^,R8XgK\V^,4NK& ppV'd\PRV4VF(p\P!V\P4K* R#uupi \Pd"p\PR T4Rp?R#Rp?ii;i) zkilling with gpgconf is best practice, but when it isn't available failover is possible GH: 4344 - stop gpg-agent/dirmgr daemons spawned by gpg key imports. Daemons spawned by cloud-config.service on systemd v253 report (running) NgpgconfTr:)r;rcsz(?P\d+)\s+(?P\d+)1z&Killing gpg-agent and dirmngr pids: %sz"Failed to clean up gpg process: %s)ruz--killall) psz-ozppid,pid-Ckeyboxdrzdirmngrrzz gpg-agent)r rwhichr#r>refindallintr@rAr0killsignalSIGKILLr?rQ)rgpg_process_outgpg_pidspid root_gpg_pidsgpg_pidrds& rr/ GPG.kill_gpgs & A###zz)$$"&))0 #xx#&  #')) !A#& ::3_,4!+3C1v}KCAK8!!II@- -GGGGV^^4 -!)) A KKrsE7 '! !SASAr