building, using and testing gnupg

[falko-strenzke]

building gnupg

• get and build the dependencies (libraries only) listed at https://gnupg.org/download/index.html
  • libassuan:
    • commit a8c38df6e4611772597dbcae503b294ff44fa424
      • (note: current master of GnuPG seems to require current libassuan master)
      • ./configure --enable-maintainer-mode --prefix=/opt/libassuan-master
      • make install
  • libgpg-error:
    • commit: 885a287a57cf060b4c5b441822c09d23b8dee2bd
    • ./configure --with-libgpg-error-prefix=/opt/libgpg-error --disable-optimization WITH_DEBUG=yes
    • make install
  • npth:
    • commit a075e11080bfdf56293bccead23e4287f18be565
    • ./configure --enable-maintainer-mode --prefix=/opt/npth --enable-install-npth-config
    • make install
  • libgcrypt:
    • use the version from branch all-pqc in git@github.com:pqc-thunderbird/gnupg.git or the version provided in a delivery zip file, resp.
    • ./configure --enable-maintainer-mode --prefix=/opt/libgcrypt-pqc --with-libgpg-error-prefix=/opt/libgpg-error
    • make install
• build GnuPG
  • invoke
    • ./autogen.sh
    • ./configure --enable-maintainer-mode --prefix=/opt/gnupg-pqc --sysconfdir=/opt/gnupg-pqc/etc --with-libgcrypt-prefix=/opt/libgcrypt-pqc --with-libgpg-error-prefix=/opt/libgpg-error --with-npth-prefix=/opt/npth --with-libassuan-prefix=/opt/libassuan-master --disable-optimization WITH_DEBUG=yes --enable-werror
      • make -j8 install
    • When seeing some "texi" related build error invoke touch doc/version.texi
    • Note: For one earlier version of GnuPG it was experienced that one had to use export C_INCLUDE_PATH=/opt/libgpg-error/include:$C_INCLUDE_PATH due to a compilation error since there it seemed to be the erroneous expectation that the ligpgp-error headers are in the default include path.

Test suite

• export LD_LIBRARY_PATH=/opt/libgpg-error/lib:/opt/libgcrypt-pqc/lib:/opt/libassuan-master/lib:/opt/gcc-13.1.0/arch_dep/lib64
• in main gnupg directory: make -C tests/openpgp check
• The tests are apparently written in guile

running the gpg-agent

• Stop the running gpg-agent which is integrated into the Linux distribution. With systemd this is done like this:

  • systemctl --user stop gpg-agent.socket
  • systemctl --user stop gpg-agent-extra.socket
  • systemctl --user list-sockets

• Running the gnupg agent: LD_LIBRARY_PATH=/opt/libgpg-error/lib:/opt/libgcrypt-pqc/lib:/opt/libassuan-master/lib:/opt/gcc-13.1.0/arch_dep/lib64 ./bin/gpg-agent

using gnupg

In the gnupg folder, do the following

• set up the environment
  • export LD_LIBRARY_PATH=/opt/libgpg-error/lib:/opt/libgcrypt/lib:/opt/libassuan-master/lib:$LD_LIBRARY_PATH:$LD_LIBRARY_PATH
  • export PATH=/home/fstrenzke/dev/tb_pqc/gnupg/bin:$PATH
  • export GNUPGHOME=<path/to/gpg-test-home> (the provided folder must exist but may be empty, in which case it will be initialized by GnuPG on the first occasion)
• then the installed binary /opt/gnupg-pqc/bin/gpg still did not not work for in our setup due to a symbol lookup error in libassuan
• but the binary in the local folder ./bin/gpg works then
• use the command ./bin/gpg --full-generate-key to generate a certificate with an ML-KEM composite subkey
• then encrypt and decrypt a file using this key pair

AEAD modes

In order to use the EAD modes proceed as follows:

• /opt/gnupg-2.4.3/bin/gpg --output doc.aead.gpg -a --recipient test --force-aead --encrypt doc.md
• for EAX specify --aead-algo=eax
• use --show-session-key with --decrypt to output the session key

Development

Undo automatic changes to .po files

After building, it may be observed that files under the git-tracked directory po are modified. Here is the code for a script to undo these changes before a commit:

#/bin/bash

find po -name "*.po" -print0 | xargs -n1 -0 git checkout

Running the gpg-agent under valgrind

GNUPGHOME=<path/to/gpg-test-home> LD_LIBRARY_PATH=/opt/libgpg-error/lib:/opt/libgcrypt-pqc/lib:/opt/libassuan-master/lib:/opt/gcc-13.1.0/arch_dep/lib64 PATH=/opt/gnupg-pqc/bin:$PATH valgrind --leak-check=full ./bin/gpg-agent --daemon /bin/sh

and after testing type exit in the agent's shell.
(for more details see #10)

Test setup with the gpg-agent

The following was explained on the GnuPG mailing list and gives some more details in case one has further requirements regarding the test setup for the agent:

Can anyone give me an advice what I can try to get the GnuPG Agent
pinentry working with different home directory specified via
GNUPGHOME?

Run it this way:

mkdir /foo/bar
cd /foo/bar
GNUPGHOME=`pwd` gpg-agent --daemon ~/bin/gnupg-setup-tests

With gnupg-setup-tests being:

--8<---------------cut here---------------start------------->8---
#!/bin/sh

SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
export SSH_AUTH_SOCK
cat >setup-tests.ini <<'EOF'
PS1="$(echo "$PS1" | sed 's,\\\$ $,(GnuPGTest)\\\$ ,')"
export HISTCONTROL=ignoreboth
export HISTFILE=$(pwd)/.bash_history
EOF
exec bash --init-file setup-tests.ini
--8<---------------cut here---------------end--------------->8---

That is a pretty conevient setup and allows to keep test around and
easily switch to them.

The pinentry is searched at

$(gpgconf -L bindir)/pinentry

In case you have a special setup you may put a gpg-agent.conf into
$GNUPGHOME and use the pinentry-program option. "gpg -v" shou.d show
which pinetry is launched, in case of problems, the gpg-agent.conf
should show/log an error.

Salam-Shalom,

Werner

Starting separate GPG-Agent with logging

• logging to file with gpg-agent as daemon

LD_LIBRARY_PATH=/opt/libgpg-error/lib:/opt/libgcrypt-pqc/lib:/opt/libassuan-master/lib:/opt/gcc-13.1.0/arch_dep/lib64 PATH=/opt/gnupg-pqc/bin:$PATH  ./bin/gpg-agent --homedir /home/fstrenzke/Dokumente/Projekte/tb_pqc/gpg-test-home  --log-file agent.log --daemon --debug-all