[rt-users] Gnupg interaction with speedycgi in RT 3.8.1

[Niko Tyni]

On Mon, Nov 24, 2008 at 11:23:55PM +0300, Ruslan Zakirov wrote:
> On Mon, Nov 24, 2008 at 9:48 PM, Niko Tyni
> <ntyni+rt-users at mappi.helsinki.fi> wrote:
> > On Wed, Nov 19, 2008 at 07:45:35PM +0000, Dominic Hargreaves wrote:
> >
> >> I can easily imagine that gnupg tickles some file descriptor bug
> >> somewhere though.
> >>
> >> Attached is an strace showing the sequence of events in the backend,
> >> resulting in the output going to STDERR rather than STDOUT, including an
> >> exec of gnupg (note; does this mean that every request will hit exec gpg?)
> >>
> >> Presumably the backend receiving EPIPE when writing the output is going
> >> to be related, but I can't quite follow the strace well enough to see
> >> why. If anyone else fancies digging a bit deeper, feel free :)
> >
> > Sounds like Mail::GnuPG 0.15 might fix this. Earlier versions had
> > significant problems in the interaction with the gpg process, including
> > deadlocks and unexpected SIGPIPEs.

> However Mail::GnuPG is not used in new implementation of RT's gpg
> interaction, but it's 100% about sig handlers or std{in, out, err}.

Right, sorry for my confusion.

As penance, I actually looked into this. It's a bug in
SpeedyCGI, triggered by the FastCGI filehandle wrapping code in
RT::Util::safe_run_child(). See http://bugs.debian.org/506957 for a
minimal test script.

A workaround would be

diff --git a/lib/RT/Util.pm b/lib/RT/Util.pm
index 544618b..bf6eb2d 100644
--- a/lib/RT/Util.pm
+++ b/lib/RT/Util.pm
@@ -56,7 +56,7 @@ our @EXPORT = qw/safe_run_child/;
 sub safe_run_child (&) {
     local @ENV{ 'LANG', 'LC_ALL' } = ( 'C', 'C' );
 
-    return shift->() if $ENV{'MOD_PERL'};
+    return shift->() if $ENV{'MOD_PERL'} || $CGI::SpeedyCGI::i_am_speedy;
 
     # We need to reopen stdout temporarily, because in FCGI
     # environment, stdout is tied to FCGI::Stream, and the child

which fixes the immediate problem for me. I haven't tested actually
using the gpg support with this, though. Dominic, can you do that easily?

I should probably mention that I'm the one to blame for keeping SpeedyCGI
alive in this context. The project has been inactive since 2003, and I've
patched the Debian speedy-cgi-perl package for the Perl 5.10 and Apache 2.2
transitions.

I still like the way it gives persistent perl script speedups with
minimal or no web server configuration.
-- 
Niko Tyni   ntyni at debian.org