Can't get rpmbuild to work with gpg-agent

[Michael Schwendt]

On Thu, 22 Nov 2012 20:33:08 +0100, Guido Winkelmann wrote:

> Hi,
> 
> I'm trying to package some software with rpmbuild and signing the packages at 
> the same time. I'm following the guide found here:
> 
> http://www.ibm.com/developerworks/library/l-rpm3/
> 
> It mostly works - I do get properly signed RPMs at the end - however, despite 
> running gpg-agent, rpmbuild keeps asking for my (lengthy) GPG-passphrase every 
> single time it is finished with a spec-file. This can be particularly annoying 
> when building very large packages, because, instead of asking again, rpmbuild 
> will abort the entire process if I mistype the passphrase even once. If I run 
> rpmbuild again after that, it will build the whole package over again...
> 
> I have started gpg-agent (as a normal user) with
> 
> gpg-agent --daemon --enable-ssh-support \
> --write-env-file "${HOME}/.gpg-agent-info"
> 
> I have put the following lines
> 
> if [ -f "${HOME}/.gpg-agent-info" ]; then                                                                                                                                                             
>   . "${HOME}/.gpg-agent-info"                                                                                                                                                                         
>   export GPG_AGENT_INFO                                                                                                                                                                               
>   export SSH_AUTH_SOCK                                                                                                                                                                                
>   export SSH_AGENT_PID                                                                                                                                                                                
> fi                                                                                                                                                                                                    
>                                                                                                                                                                                                       
> GPG_TTY=$(tty)                                                                                                                                                                                        
> export GPG_TTY
> 
> at the end of my .bashrc, and also manually run them in my current shell. The 
> env command tells me it knows of the variables GPG_AGENT_INFO, SSH_AGENT_PID, 
> SSH_AUTH_SOCK, and GPG_TTY, with plausible looking values in all cases. When I 
> just run gpg-agent in my current shell with no parameters, it tells me "gpg-
> agent: gpg-agent running and available". I'm running rpmbuild like this:
> 
> rpmbuild -ba --sign rpmbuild/SPECS/<specfile>
> 
> What am I still missing?

It may be necessary to redefine the RPM macro %__gpg_sign_cmd to add
option --use-agent when executing gpg. That's what I've done for the old
Fedora Extras pushscripts and when testing possible alternatives to
Pexpect/expect.

-- 
Fedora release 18 (Spherical Cow) - Linux 3.6.9-4.fc18.x86_64
loadavg: 0.00 0.02 0.05