X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=plc.d%2Fgpg;h=9576c4093d222113f25e97cfc8ebc979cf0219d1;hb=039b8b04f1e3e9f584abf83797ae3f1a8c421e23;hp=7f146a994e4af97cfadd14e98d1bfa58a216bb43;hpb=391310e122de0536c08f62bd46acd3b3b7b13964;p=myplc.git

diff --git a/plc.d/gpg b/plc.d/gpg
index 7f146a9..9576c40 100755
--- a/plc.d/gpg
+++ b/plc.d/gpg
@@ -1,14 +1,12 @@
 #!/bin/bash
 #
-# priority: 500
+# priority: 400
 #
 # Generate GPG keys
 #
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id: gpg 129 2007-03-20 12:04:03Z thierry $
-#
 
 # Source function library and configuration
 . /etc/plc.d/functions
@@ -22,6 +20,15 @@ case "$1" in
 	# Make temporary GPG home directory
 	homedir=$(mktemp -d /tmp/gpg.XXXXXX)
 
+	# in case a previous gpg invocation failed in some weird way
+	# and left behind a zero length gpg key (pub or priv).
+	if [ -f $PLC_ROOT_GPG_KEY_PUB -a ! -s $PLC_ROOT_GPG_KEY_PUB ] ; then
+	    rm -f $PLC_ROOT_GPG_KEY_PUB 
+	fi
+	if [ -f $PLC_ROOT_GPG_KEY -a ! -s $PLC_ROOT_GPG_KEY ] ; then
+	    rm -f $PLC_ROOT_GPG_KEY
+	fi
+
 	if [ ! -f $PLC_ROOT_GPG_KEY_PUB -o ! -f $PLC_ROOT_GPG_KEY ] ; then
 	    # Generate new GPG keyring
 	    MESSAGE=$"Generating GPG keys"
@@ -32,8 +39,20 @@ case "$1" in
 
 	    # Temporarily replace /dev/random with /dev/urandom to
 	    # avoid running out of entropy.
-	    rm -f /dev/random
-	    mknod /dev/random c 1 9
+	    # (1 9 is /dev/urandom, 1 8 is /dev/random)
+	    #
+	    # a former version of this was rm'ing /dev/random and re-creating it afterwards
+	    # however in 1.0.4 libvirt won't allow the use of mknod at all, so let's work around that
+	    # by moving things around instead
+	    #
+	    # if we find this file it's probably that a previous run has failed..
+	    [ -f /dev/random.preserve ] && { echo "Unexpected file /dev/random.preserve - exiting" ; exit 1; }
+	    mv -f /dev/random /dev/random.preserve
+	    # doesn't hurt to check 
+	    check
+	    ln -s /dev/urandom /dev/random
+	    # again 
+	    check
 	    gpg --homedir=$homedir --no-permission-warning --batch --no-tty --yes \
 		--gen-key <<EOF
 Key-Type: DSA
@@ -49,8 +68,8 @@ Expire-Date: 0
 %commit
 EOF
 	    check
-	    rm -f /dev/random
-	    mknod /dev/random c 1 8
+	    mv -f /dev/random.preserve /dev/random
+	    check
 	else
 	    # Update GPG UID
 	    MESSAGE=$"Updating GPG keys"
@@ -101,7 +120,12 @@ EOF
 	    rpm --allmatches -e gpg-pubkey
 	    check
 	fi
-	rpm --import /etc/pki/rpm-gpg/*
+	# starting with rpm-4.6, this fails when run a second time
+	# it would be complex to do this properly based on the filename, 
+	# as /etc/pki/rpm-gpg/ typically has many symlinks to the same file
+	# see also http://fedoranews.org/tchung/gpg/
+	# so just ignore the result
+	rpm --import /etc/pki/rpm-gpg/* || :
 	check
 
 	# Make GPG key readable by apache so that the API can sign peer requests