Change:
In order to verify the gpg signature on repository, cargo is launching gpg and trying to parse the output for correct verification. This can break in many ways, the simplest one actually being language configuration by the environment. lucab it_IT.utf8 lucab cargo init error: signature verification failed for '' lucab LANG=C cargo init info: initialized .cargo in

Discussion:
} match (src.key, src.keyfp) { (Some(_), Some(f)) => { <del> let r = pgp::verify(&c.root, &pkgfile, &sigfile, f); </del> <ins> let r = pgp::verify(&c.root, &pkgfile, &sigfile); </ins> if !r { <del> error(fmt!("signature verification failed for source %s", name)); </del> <ins> error(fmt!("signature verification failed for source %s with key %s", name, f)); </ins> return false; } if has_src_file { <del> let e = pgp::verify(&c.root, &srcfile, &srcsigfile, f); </del> <ins> let e = pgp::verify(&c.root, &srcfile, &srcsigfile); </ins> if !e { <del> error(fmt!("signature verification failed for source %s", name)); </del> <ins> error(fmt!("signature verification failed for source %s with key %s", name, f)); </ins> return false; } }

} match (src.key, src.keyfp) { (Some(_), Some(f)) => { <del> let r = pgp::verify(&c.root, &pkgfile, &sigfile, f); </del> <ins> let r = pgp::verify(&c.root, &pkgfile, &sigfile); </ins> if !r { <del> error(fmt!("signature verification failed for source %s", name)); </del> <ins> error(fmt!("signature verification failed for source %s with key %s", name, f)); </ins> rollback(name, dir, false); return false; } if has_src_file { <del> let e = pgp::verify(&c.root, &srcfile, &srcsigfile, f); </del> <ins> let e = pgp::verify(&c.root, &srcfile, &srcsigfile); </ins> if !e { <del> error(fmt!("signature verification failed for source %s", name)); </del> <ins> error(fmt!("signature verification failed for source %s with key %s", name, f)); </ins> rollback(name, dir, false); return false; }

return false; } <del> let r = pgp::verify(&c.root, &pkgfile, &sigfile, f); </del> <ins> let r = pgp::verify(&c.root, &pkgfile, &sigfile); </ins> if !r { <del> error(fmt!("signature verification failed for source %s", name)); </del> <ins> error(fmt!("signature verification failed for source %s with key %s", name, f)); </ins> return false; }

return false; } <del> let e = pgp::verify(&c.root, &srcfile, &srcsigfile, f); </del> <ins> let e = pgp::verify(&c.root, &srcfile, &srcsigfile); </ins> if !e { error(~"signature verification failed for " + <del> ~"source " + name); </del> <ins> ~"source " + name + ~" with key " + f); </ins> return false; } }

return; } <del> let r = pgp::verify(&c.root, &srcfile, &sigfile, pgp::signing_key_fp()); </del> <ins> let r = pgp::verify(&c.root, &srcfile, &sigfile); </ins> if !r { error(fmt!("signature verification failed for '%s'", srcfile.to_str()));

<del> fn gpg(args: ~[~str]) -> { status: int, out: ~str, err: ~str } { return run::program_output(~"gpg", args); </del> <ins> fn gpgv(args: ~[~str]) -> { status: int, out: ~str, err: ~str } { return run::program_output(~"gpgv", args); </ins> } fn signing_key() -> ~str {

} fn supported() -> bool { <del> let r = gpg(~[~"--version"]); </del> <ins> let r = gpgv(~[~"--version"]); </ins> r.status == 0 }

} } <del> fn verify(root: &Path, data: &Path, sig: &Path, keyfp: ~str) -> bool { </del> <ins> fn verify(root: &Path, data: &Path, sig: &Path) -> bool { </ins> let path = root.push("gpg"); <del> let p = gpg(~[~"--homedir", path.to_str(), ~"--with-fingerprint", ~"--verify", sig.to_str(), data.to_str()]); let res = ~"Primary key fingerprint: " + keyfp; for str::split_char_each(p.err, 'n') |line| { if line == res { return true; } </del> <ins> let res = gpgv(~[~"--homedir", path.to_str(), ~"--keyring", ~"pubring.gpg", ~"--verbose", sig.to_str(), data.to_str()]); if res.status != 0 { return false; </ins> } <del> return false; </del> <ins> return true; </ins> }