[SOLVED] Binhost failing with pubring.kbx':Permission denied

Message

Massimo B. · Post by **Massimo B.** » Sun Mar 16, 2025 11:55 pm

Hi, I'm new to Binhost and followed https://wiki.gentoo.org/wiki/Gentoo_Bin ... tart:[code]# cat /etc/portage/binrepos.conf/gentoobinhost.conf
[binhost]
priority = 9999
sync-uri = https://ftp.halifax.rwth-aachen.de/gent ... x86-64-v3/[/code]

Code: Select all

# ls -al /etc/portage/gnupg/
total 212K
drwxr-xr-x 1 root    root     274 Mar 17 00:47 ./
drwxr-x--- 1 portage portage  528 Mar 17 00:46 ../
-rw-r--r-- 1 root    root       0 Mar 17 00:47 .getuto.last
drwx------ 1 root    root      14 Mar 17 00:46 crls.d/
-rw-r--r-- 1 root    root      70 Mar 17 00:46 dirmngr.conf
-rw-r--r-- 1 root    root      17 Mar 17 00:46 gpg-agent.conf
-rw-r--r-- 1 root    root      12 Mar 17 00:46 gpg.conf
-rw-r--r-- 1 root    root      82 Mar 17 00:46 mykeyid
drwx------ 1 root    root      88 Mar 17 00:46 openpgp-revocs.d/
-rw------- 1 root    root      45 Mar 17 00:46 pass
drwx------ 1 root    root     176 Mar 17 00:46 private-keys-v1.d/
-rw-r--r-- 1 root    root     67K Mar 17 00:47 pubring.kbx
-rw-r--r-- 1 root    root     66K Mar 17 00:47 pubring.kbx~
-rw-r--r-- 1 root    root     48K Mar 17 00:47 tofu.db
-rw-r--r-- 1 root    root    1.7K Mar 17 00:47 trustdb.gpg

Code: Select all

# emerge -atv1 -g openssh

Local copy of remote index is up-to-date and will be used.

These are the packages that would be merged, in reverse order:

Calculating dependencies... done!
Dependency resolution took 13.51 s (backtrack: 0/20).

[binary     U  ] net-misc/openssh-9.9_p2-2::gentoo [9.9_p1::gentoo] USE="pam pie ssl -audit (-debug) -kerberos -ldns -legacy-ciphers -libedit -livecd -security-key (-selinux) -static -test -verify-sig (-xmss)" 1.140 KiB

Total: 1 package (1 upgrade, 1 binary), Size of downloads: 1.140 KiB

Would you like to merge these packages? [Yes/No] 

>>> Running pre-merge checks for net-misc/openssh-9.9_p2
--2025-03-17 00:48:55--  https://ftp.halifax.rwth-aachen.de/gentoo/releases/amd64/binpackages/23.0/x86-64-v3/net-misc/openssh/openssh-9.9_p2-2.gpkg.tar
Resolving ftp.halifax.rwth-aachen.de... 137.226.34.46
Connecting to ftp.halifax.rwth-aachen.de|137.226.34.46|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1167360 (1,1M) [application/octet-stream]
Saving to: ‘/var/cache/portage/packages/net-misc/openssh-9.9_p2.gpkg.tar.partial’

/var/cache/portage/packages/net-misc/openssh-9.9_p2.gpkg.tar.partia 100%[==================================================================================================================================================================>]   1,11M   224KB/s    in 5,1s    

2025-03-17 00:49:03 (224 KB/s) - ‘/var/cache/portage/packages/net-misc/openssh-9.9_p2.gpkg.tar.partial’ saved [1167360/1167360]

 * openssh-9.9_p2.gpkg.tar MD5 SHA1 size ;-) ...                         [ ok ]
!!!
gpg: keyblock resource '/etc/portage/gnupg/pubring.kbx': Permission denied
[GNUPG:] ERROR add_keyblock_resource 33587201
gpg: can't open `/etc/portage/gnupg/random_seed': Permission denied
[GNUPG:] PLAINTEXT 74 0 
[GNUPG:] NEWSIG
gpg: Signature made Sa 08 Mär 2025 11:57:11 CET
gpg:                using RSA key 534E4209AB49EEE1C19D96162C44695DB9F6043D
[GNUPG:] ERROR keydb_search 33554445
[GNUPG:] ERROR keydb_search 33554445
[GNUPG:] ERRSIG 2C44695DB9F6043D 1 10 01 1741431431 9 534E4209AB49EEE1C19D96162C44695DB9F6043D
[GNUPG:] NO_PUBKEY 2C44695DB9F6043D
gpg: Can't check signature: No public key
[GNUPG:] FAILURE gpg-exit 33554433
gpg: note: random_seed file not updated
!!! Invalid binary package: '/var/cache/portage/packages/net-misc/openssh-9.9_p2.gpkg.tar.partial', GPG verify failed
 * Binary package is not usable

>>> Failed to emerge net-misc/openssh-9.9_p2

 * Messages for package net-misc/openssh-9.9_p2:

 * Binary package is not usable

I have to admit, in the past I tinkered with /etc/portage like

Code: Select all

# chown -Rv portage:portage /etc/portage

and I also had rwxr-s--- set on /etc/portage, the sticky flag was inherited by the new gnupg/ directory. I removed all sticky flags now starting from /etc/portage, removed the gnupg/ directory and let getuto recreate it. But still the same issue. I'm running getuto from the root shell. But I also tried just starting some emerge -g from the root shell which itself calls getuto.

Now the permissions look like

# ls -ald /etc /etc/portage /etc/portage/gnupg
drwxr-xr-x 1 root root 6.0K Mar 17 01:04 /etc/
drwxr-x--- 1 portage portage 528 Mar 17 00:46 /etc/portage/
drwxr-xr-x 1 root root 274 Mar 17 00:47 /etc/portage/gnupg/

Code: Select all

# ls -al /etc/portage/
total 40K
drwxr-x--- 1 portage portage  528 Mar 17 00:46 ./
drwxr-xr-x 1 root    root    6.0K Mar 17 01:05 ../
-rw-r----- 1 root    portage  12K Oct 21 08:18 .bashrc.swp
-rw-r--r-- 1 portage portage   70 Mar 15  2023 .cvsignore
-rw-r----- 1 portage portage  457 Jun 12  2019 bashrc
drwxr-sr-x 1 root    portage   36 Mar 16 00:23 binrepos.conf/
-rw-r----- 1 portage portage   64 Oct 21  2015 categories
drwxr-xr-x 1 portage portage   18 Aug  3  2023 conf-update.d/
drwxr-x--- 1 portage portage  274 Mar  4 00:59 env/
drwxr-xr-x 1 root    root     274 Mar 17 00:47 gnupg/
drwxr-sr-x 1 root    portage   22 Mar 16 21:43 make.conf/
lrwxrwxrwx 1 root    portage   59 Apr 18  2024 make.profile -> ../../usr/portage/profiles/default/linux/amd64/23.0/desktop/
drwxr-x--- 1 portage portage  126 Mar 16 19:18 package.accept_keywords/
drwxr-x--- 1 portage portage  208 Mar  4 01:03 package.env/
drwxr-x--- 1 portage portage   36 Mar  4 01:03 package.license/
drwxr-x--- 1 portage portage   30 Mar  4 01:04 package.mask/
drwxr-x--- 1 portage portage   58 Jan 23 08:23 package.unmask/
drwxr-x--- 1 portage portage  266 Mar 16 19:21 package.use/
drwxr-x--- 1 portage portage   72 Mar 17  2020 patches/
drwxr-xr-x 1 root    root      30 Jan 23 14:58 postsync.d/
drwxr-x--- 1 portage portage  114 Nov 14  2022 profile/
drwxr-x--- 1 portage portage  170 Mar  4 01:08 repos.conf/
-rw-r----- 1 portage portage  208 Jun  5  2012 rsync_excludes
drwxr-x--- 1 portage portage   36 Aug  4  2023 savedconfig/
drwxr-sr-x 1 portage portage   60 Mar 16 20:05 sets/
-rw-r--r-- 1 root    root      46 Jun  4  2024 smart-live-rebuild.conf

I have not found any recommendation how the /etc/portage permissions should look like, but as eix sometimes didn't read parts and just showed ? for some packages, I was successful applying chown portage:portage to the directory tree.

Massimo B. · Post by **Massimo B.** » Mon Mar 17, 2025 12:20 am

Ok, I solved it:

Code: Select all

# chown root:root /etc/portage/
# chmod 755 /etc/portage/
# rm -rf /etc/portage/gnupg

Maybe all that gpg calling is running as some gpg user, which was failing without the others r-x. There is no gpg user, not sure which user was failing on that gpg calls. I might have added it to the portage group. But I'm going to stay with the defaults now.
"Right after doing it correctly, it works".