X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=plc.d%2Fgpg;h=23428850609ef8924795564780e53edd54855da9;hb=732a0fd6d8d7f94ee2ed99ddd3b5b9a41d8ea0e3;hp=60617e39809c7f73b03eafce9c60d9fe07077b44;hpb=effaa2138be88157b2322de42fe9395694918acf;p=myplc.git

diff --git a/plc.d/gpg b/plc.d/gpg
index 60617e3..2342885 100755
--- a/plc.d/gpg
+++ b/plc.d/gpg
@@ -1,14 +1,14 @@
 #!/bin/bash
+# $Id$
+# $URL$
 #
-# priority: 500
+# priority: 400
 #
 # Generate GPG keys
 #
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id$
-#
 
 # Source function library and configuration
 . /etc/plc.d/functions
@@ -22,6 +22,15 @@ case "$1" in
 	# Make temporary GPG home directory
 	homedir=$(mktemp -d /tmp/gpg.XXXXXX)
 
+	# in case a previous gpg invocation failed in some weird way
+	# and left behind a zero length gpg key (pub or priv).
+	if [ -f $PLC_ROOT_GPG_KEY_PUB -a ! -s $PLC_ROOT_GPG_KEY_PUB ] ; then
+	    rm -f $PLC_ROOT_GPG_KEY_PUB 
+	fi
+	if [ -f $PLC_ROOT_GPG_KEY -a ! -s $PLC_ROOT_GPG_KEY ] ; then
+	    rm -f $PLC_ROOT_GPG_KEY
+	fi
+
 	if [ ! -f $PLC_ROOT_GPG_KEY_PUB -o ! -f $PLC_ROOT_GPG_KEY ] ; then
 	    # Generate new GPG keyring
 	    MESSAGE=$"Generating GPG keys"
@@ -33,7 +42,10 @@ case "$1" in
 	    # Temporarily replace /dev/random with /dev/urandom to
 	    # avoid running out of entropy.
 	    rm -f /dev/random
+	    # 1 9 is /dev/urandom
 	    mknod /dev/random c 1 9
+	    # sometimes mknod fails within an improperly setup vserver
+	    check
 	    gpg --homedir=$homedir --no-permission-warning --batch --no-tty --yes \
 		--gen-key <<EOF
 Key-Type: DSA
@@ -101,7 +113,12 @@ EOF
 	    rpm --allmatches -e gpg-pubkey
 	    check
 	fi
-	rpm --import /etc/pki/rpm-gpg/*
+	# starting with rpm-4.6, this fails when run a second time
+	# it would be complex to do this properly based on the filename, 
+	# as /etc/pki/rpm-gpg/ typically has many symlinks to the same file
+	# see also http://fedoranews.org/tchung/gpg/
+	# so just ignore the result
+	rpm --import /etc/pki/rpm-gpg/* || :
 	check
 
 	# Make GPG key readable by apache so that the API can sign peer requests