FYI: fix gnupload (Was: Re: [PATCH] Fix releasing procedure)

[Alexandre Duret-Lutz]

>>> "Scott" == Scott James Remnant <address@hidden> writes:

 Scott> On Tue, 2004-01-27 at 10:40, Alexandre Duret-Lutz wrote:
 >> On Tue, Jan 27, 2004 at 10:17:52AM +0000, Scott James Remnant wrote:
 >> > *gulps* it stores my GPG passphrase in a shell variable?!
 >> 
 >> Yep.  Just like mailcrypt stores it in an emacs variable, or gpg in a
 >> C variable.  What's the difference?
 >> 
 Scott> Here's why you shouldn't store the passphrase in a shell variable:

 Scott> $ export passphrase="something irrelevant"
 Scott> $ ./gnupload

Thanks for catching this!  I'm installing the following fix.

 Scott> 'passphrase' is now an exported shell variable, /proc/*/environ of the
 Scott> gnupload shell script itself will contain "something irrelevant", but
 Scott> once you've read that variable in, the environ of every single process
 Scott> (including GPG, etc.) that that shell script runs will contain whatever
 Scott> your passphrase is.

Worse, on some system you can see the environment of any
process (including those from other users) with `ps e' :(

2004-01-28  Alexandre Duret-Lutz  <address@hidden>

        * lib/gnupload (GPG): Use an absolute path.  Suggestion from Gary
        V. Vaughan.
        (passphrase): Unset it this variable before using it, in case it
        was exported.  Report from Scott James Remnant.

Index: lib/gnupload
===================================================================
RCS file: /cvs/automake/automake/lib/gnupload,v
retrieving revision 1.2
diff -u -r1.2 gnupload
--- lib/gnupload        25 Jan 2004 13:55:50 -0000      1.2
+++ lib/gnupload        28 Jan 2004 16:17:01 -0000
@@ -1,7 +1,7 @@
 #!/bin/sh
 # Sign files and upload them.
 
-scriptversion=2004-01-25.02
+scriptversion=2004-01-28.17
 
 # Copyright (C) 2004  Free Software Foundation
 #
@@ -24,7 +24,7 @@
 
 set -e
 
-GPG='gpg --batch --no-tty'
+GPG='/usr/bin/gpg --batch --no-tty'
 to=
 
 usage="Usage: $0 [OPTIONS]... FILES...
@@ -108,10 +108,15 @@
   fi
 done
 
+# Make sure passphrase is not exported in the environment.
+unset passphrase
+
 # Reset PATH to be sure that echo is a built-in.  We will later use
 # `echo $passphrase' to output the passphrase, so it is important that
 # it is a built-in (third-party programs tend to appear in `ps'
 # listings with their arguments...).
+# Remember this script runs with `set -e', so if echo is not built-in
+# it will exit now.
 PATH=/empty echo -n "Enter GPG passphrase: "
 stty -echo
 read -r passphrase
-- 
Alexandre Duret-Lutz