[14:02:55] hello, I'm going to start the depools for eqiad rack D2 maintenance - https://phabricator.wikimedia.org/T419647 [14:12:40] ACK [14:15:28] depools done, downtime set, doing the BGP bounce shortly (cc claime, elukey) [14:15:38] ack [14:19:09] all done, 7 pings lost [16:49:03] btullis: your last commit is breaking puppet fleet wide [16:49:30] useradd: group '935' does not exist [16:49:48] oh, sorry. please revert. [16:50:04] I'm 3 mins from keyboard. [16:50:07] ack [16:52:53] btullis: done.. a quick check shows that the group has gid 953 but the user refers to it as 935 [16:54:37] yes. many thanks. I had originality tried adding the group as 935 but it failed CI. I changed the group, but forgot to change the reference in the user, but it passed CI. [17:04:06] So clinic duty is now changing at the middle of the week?? [17:21:20] btullis: also don't simply merge sudo changes, it's estalished policy that these are reviewed in the weekly SRE IF meeting (a review which would also caught this error) [17:21:52] Yes, apologies. I will be sure to adhere to that in future. [17:22:10] ack, thanks [18:02:58] denisse: yeah, it rotates on Thursday like oncall rotation [18:07:31] Nice, it was a good change, it felt less intense and than it previously was. Or maybe it was not such a busy week CD wise. [18:07:38] Or maybe both. :) [18:22:06] moritzm or jhathaway: pwstore is not working for me, it complains about Alex's key "Warning: No key found for keyid C0E45DAD009346A1" -- any idea if that's happening to everyone or just to me? [18:41:42] andrewbogott: looking [18:41:49] ty [18:45:35] are you trying to add a new secret or decrypt something? [18:45:58] if you try to add something you need to run pws update-keyring first [18:48:46] I can view files fine, but adding a new one threw an error on 50E3655873A2266C6E1AAA157509CEA4650AE684, even after updating the keyring [18:50:32] Here is what I am seeing: [18:50:35] https://www.irccloud.com/pastebin/rw3QgXlh/ [18:51:23] One of the people with keys in .pws-trusted-users has to re-encrypt the .users file ? [18:53:15] jynus: your PGP in pwstore.git expired, please extend it (and ideally add one w/o expiry) https://office.wikimedia.org/wiki/Pwstore#Updating_your_own_key [18:53:56] volans|off: ^ same [18:54:24] I tried on a second machine, same behavior. Surely that warning about alex's key isn't because of different people's keys expiring? [18:54:36] yes, see abive [18:55:00] I was able to view the file andrewbogott, even with the expired keys [18:55:25] viewing is fine, adding or updating a secret will fail in the presence of expired keys [18:55:48] nod, though I'm not sure why andrewbogott's attempt failed [18:56:33] is 'ed' not the same thing as 'view the file'? [18:57:21] yes, I ran the same command `pws ed rackspace` [18:57:59] any chance the two of you need to pull and update keys to get what I'm getting? Or did you do that too? [18:58:13] I pulled as well [18:58:18] it's just a warning, you can say Y and see the file [18:58:39] when I hit 'y' it opens an empty editor [18:58:47] hmm, what editor? [18:58:56] vim [18:59:23] nevermind, you shouldn't see "Warning: gpg returned non-zero exit status 2 when decrypting rackspace." [18:59:50] that one should be more than a warning ;) [19:01:07] andrewbogott: do you have the pws from wmf-laptop? [19:01:35] * andrewbogott scowls at 'pws --version' not working [19:01:44] no, one machine is a mac with a fresh pws install from brew [19:01:50] the other is a bookworm debian host [19:02:04] gotta fetch our version that is patched, afair [19:02:33] is that new? This has definitely worked for me, historically. [19:02:44] https://gerrit.wikimedia.org/r/plugins/gitiles/operations/debs/wmf-laptop/+/refs/heads/master/scripts/pws [19:02:57] "The upstream version of pwstore fetches keys from public servers, so can't be used until we submit our patches upstream." [19:03:02] it's about not using key servers [19:08:28] andrewbogott: you can also try "gpg -d rackspace" [19:08:40] like just skip the wrapper [19:08:51] as long as it's only for viewing [19:09:31] same behavior with that wrapper [19:09:43] gpg -d rackspace ends with "gpg: decryption failed: No secret key" [19:09:55] full output is [19:09:57] https://www.irccloud.com/pastebin/CthueVsf/ [19:10:12] and yet... [19:10:28] gpg --list-secret-keys --keyid-format=long shows my key [19:11:23] did it ever ask you to input your passphrase? [19:11:51] I don't think my key has a passphrase. [19:13:27] sorry, I'm sure I'm doing something goofy but also sure this is not my first time using pws [19:15:29] I can paste the output of 'gpg --list-secret-keys' without leaking anything? [19:15:57] hrmm.. gpgconf --kill gpg-agent [19:16:03] to restart the agent [19:16:09] yes [19:16:13] then see again if it does not ask for a passphrase [19:22:43] so -- I'm seeing the same behavior on my laptop and on a vm on my laptop. So I doubt it's anything to do with agent state. [19:22:50] I have rebooted the VM, no change in behavior. [19:23:10] I see my key in --list-secret-keys but maybe I'm misinterpreting the output; is that something I can paste here? [19:23:22] yes [19:25:06] https://www.irccloud.com/pastebin/DtQyacK7/ [19:27:59] that looks the same as your pub key in keys/andrew.key [19:28:54] is there a way to tell if it has a passphrase or not? I think it doesn't but would like to be sure [19:29:29] if "gpg --decrypt rackspace" fails as well, then the issue is not in pwstore, but in your gpg setup [19:29:41] pwstore is essentially just a wrapper around basic gpg commands [19:30:26] yes, agreed [19:35:51] Andrew prepares to log into rackspace, support team at the ready https://ca-times.brightspotcdn.com/dims4/default/2c3a3a1/2147483647/strip/true/crop/1024x575+0+0/resize/1200x674!/format/webp/quality/75/?url=https%3A%2F%2Fcalifornia-times-brightspot.s3.amazonaws.com%2F01%2F59%2F94e4592ab75a7b2925873a7529ce%2Fla-1495211430-c18joms2x8-snap-image [19:36:33] any chance my key uses an algo that's no longer supported? [19:38:30] no, its rsa4096 [19:39:21] do you get a gpg agent passphrase window? [19:40:06] you could do this test: copy/paste the message from here: https://phabricator.wikimedia.org/P89850 into a file and "gpg -d" that. it is just "test" encrypted for your key [19:42:50] I do not get a prompt for a passphrase [19:42:59] that file is in foo.whatever: [19:43:02] andrew@bookworm:~/pw$ export GPG_TTY=$(tty) [19:43:02] andrew@bookworm:~/pw$ gpg -d ./foo.whatever [19:43:02] gpg: encrypted with 4096-bit RSA key, ID 87C658BDF3020AEE, created 2015-05-04 [19:43:02] "Andrew Bogott " [19:43:02] gpg: public key decryption failed: No pinentry [19:43:03] gpg: decryption failed: No secret key [19:43:19] So, 'no pinentry' seems like the interesting bit there. Maybe I /do/ need a passphrase [19:44:25] it could have switched from asking on terminal to a GUI and the GUI window is behind the terminal or something like that [19:45:47] on my system I have pinentry-curses and pinentry-gnome3 [19:46:01] had something similar with the passphrase for yubikey and ssh-askpass [19:46:20] maybe check which pinentry package, if any, you have [19:47:32] yep, heading down the pinentry rabbit hole... [19:48:48] ok, I can decrypt! On at least the linux box [19:48:58] thanks all [19:49:07] nice! [20:17:02] weird, I don't see an expiration on that identity- I wonder if it is an algorithm issue rather than expiration [20:47:02] yeah, it is a gpg deprecation, not an expiration, I have pushed my new keypair to the repo and to key servers