gnupg: 2.4.0 -> 2.4.1

[afh]

Description of changes

Please let me know if this PR's merge base should rather be master than staging.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[marsam]

LGTM

Release notes: https://dev.gnupg.org/T6454

[afh]

Thanks for merging, @vcunat, I look forward to the ADSK support GnuPG 2.4.1 brings.

[vcunat]

Something around pinentry input changed apparently. Our VM tests regressed around that point.
https://hydra.nixos.org/build/218897070
https://hydra.nixos.org/build/218931684
Also mentioned on #229429 (comment)

[afh]

Thanks for raising this, @vcunat, I'll have a look.

[afh]

What I gather from the logs is this:

1. nixos/tests/sway (log) times out hinting at a configuration or installation issue regarding pinentry.

2. nixos/tests/gnupg.nix (log) fails due to: gpg: agent_genkey failed: No pinentry.

At this point I'm uncertain what the underlying cause is, i.e. is pinentry not installed for some reason or is the gpg-agent misconfigured and it does not find any pinentry binaries.

How can the test environment be inspected for debugging?

• It would be helpful to see the output of gpgconf --check-programs
• and the gpg.conf and gpg-agent.conf files used when running the tests

[vcunat]

I'm not very good with NixOS VM tests. They can be run easily, e.g. nix-build -QA nixosTests.gnupg but I know basically nothing about real debugging them.

[vcunat]

I noticed a passphrase-related change in 2.4.1, but not like I've looked into details: https://dev.gnupg.org/T6093

[afh]

Being on macOS I'll look into spinning up a NixOS VM to run the tests. I'm not sure I see the connection between the pinentry issue and https://dev.gnupg.org/T6093 can you please elaborate bit?

[vcunat]

Either way, I think I should ping maintainers of the broken NixOS tests (sway + gnupg): @primeos, @Synthetica9, @rnhmjoj. Maybe they'll have an idea, too.

[rnhmjoj]

I guess this release includes https://dev.gnupg.org/rGeae28f1bd4a5632e8f8e85b7248d1c4d4a10a5ed.
I would revert and postpone the update until the NixOS module is fixed, otherwise gpg is essentially unusable.

Anyway, please, don't ignore the tests: the gnupg one was even linked to the package.

[vcunat]

Hmm, so that was apparently a breaking change? Merged in a period when breaking changes were disallowed in nixpkgs.

[afh]

Thanks for chiming in and providing the additional context, @rnhmjoj very much appreciated. A patch release seemed innocent at the time and I wasn't aware of the profile changes and their implications for NixOS (praises sandro for their comments over on the GnuPG issue).

I assumed that any tests are triggered from changes in PRs and would catch breaking changes, this does not seem to be the case. Where would I need to look to see if nixpkgs changes from a PR break NixOS related tests?

[vcunat]

There's no such place for these particular cases. Changing package like gnupg requires really lots of CPU to even get to building such tests.

[vcunat]

So I reverted it to 2.4.0 for now.

[corngood]

I didn't see this issue before, but I have a change that adds the units back: #231108.

[corngood]

Here's a PR to un-revert this #231110