simp-rake-helpers 5.11.4 → 5.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bde11b6e154b94ae99c983cc5efbc50ee72bfd5e4fff43752f3bde5a1fe9383
-  data.tar.gz: 1f20976af7376822f6d4ab663b2d5f4b01bab9c85cc71a3f86035d586771e443
+  metadata.gz: 4da7d0cf624209586f4a159cd06bf86cc61da199ddecc3d2730e53a267225316
+  data.tar.gz: 44fcb7049d7a6a39b433e88de24894db6817fc06620fddc6ac7f67d3481c6a42
 SHA512:
-  metadata.gz: bc56ab90f4e83059108725f9750793ba060bac5af618d72e819f095319233ae1229a7f8a153feb4ecd50de46808792fd9c3c2559f02ec632c606a9fdeb3a8659
-  data.tar.gz: 8cdf8f62c251be9bbc3388adaae57516fde2eb0478adf6ec4fd66c09bf411cf1902546ac309a455f87dcef1d30db3f5cd498dcc6838e2a80c0102f1448bc5c1e
+  metadata.gz: 6f4a80dd4864f3ade29b60932b83d87b8d2fd56384fd03bc5df9de9a03f70f54445333e3654b3d2225d67e0ffdc5f1f772c5a23908a0ea40378c648043c00fb2
+  data.tar.gz: 862aaaac472efde1959b314d66ddb254379be34f2ecbfa1f4715fc58882010fcfc14c5caf41a090947b2d3955b2c27eb146bec1b2236a817caebc95ada01f857

data/CHANGELOG.md

@@ -1,3 +1,49 @@
+### 5.12.2 / 2021-06-22
+- Change to '-1' from '-0' as the default RPM release
+
+### 5.12.1 / 2021-05-27
+- Default `@build_dir` to `@distro_build_dir` in build tasks
+- Use  `file --keep-going` in the **unpack** task's ISO validation check.  This
+  allows the check to work from EL8-based systems, where `ISO 9660 CD-ROM
+  filesystem data` is not the first match.
+
+### 5.12.0 / 2021-02-16
+- Ensure that pkg:install_gem uses the correct documentation options for the
+  version of Ruby in use.
+- Disable brp-mangle-shebangs when building RPMs.
+- Mitigated problem where gpg-agent daemon fails to start because
+  its socket path is longer than 108 characters.
+  - Changed the default location of the GPG keys directory used in the
+    pkg:key_prep and pkg:signrpms Rake tasks to <base_dir>/.dev_gpgkeys.
+  - Added a SIMP_PKG_build_keys_dir environment variable that overrides
+    the default location of the GPG keys directory used in the
+    pkg:key_prep and pkg:signrpms Rake tasks.
+- Added SIMP_PKG_rpmsign_timeout environment variable that overrides
+  default timeout in seconds to wait for an individual RPM signing
+  operation to complete.
+  - Default timeout is 30 seconds.
+  - Most relevant when signing on RPMs on EL8 and the gpg-agent
+    started by rpmsign fails to start, but rpmsign does not detect
+    the failure and hangs.
+- Improved pkg:signrpms error handling and reporting.
+- Fixed bug in GPG handling for GPG 2.1+ in which an existing
+  GPG key that was not cached internally was not detected.
+- Fixed bug where pkg:signrpms failed to sign RPMs on EL8.
+- Fixed bug where pkg:checksig reported failure on EL8, even when
+  the signatures were valid.
+- Deprecated the following top-level Rake tasks for Puppet modules:
+  - compare_latest_tag: use pkg:compare_latest_tag instead
+  - changelog_annotation: use pkg:create_tag_changelog instead
+
+### 5.11.6 / 2021-02-03
+* Fix GPG handling for GPG 2.1+
+
+### 5.11.5 / 2020-12-02
+* Add support for Puppet 7
+* Work around issues with querying RPM spec file changelogs using RPM version 4.15.0+
+* Switch between 'with_unbundled_env' and 'with_clean_env' based on which one
+  Bundler supports.
+
 ### 5.11.4 / 2020-08-03
 * Permit *.md files in `rake pkg:compare_latest_tag`
 

data/CONTRIBUTING.md

@@ -1,4 +1,4 @@
 ## Contributing
 
-Please refer to the main [SIMP Project Contributing Guide](https://github.com/NationalSecurityAgency/SIMP/blob/master/CONTRIBUTING.md)
+Please refer to the main [SIMP Project Contributing Guide](https://simp-doc.readthedocs.io/en/stable/contributors_guide/index.html)
 for details on contributing to this project.

data/Gemfile

@@ -2,7 +2,7 @@
 #
 # SIMP_GEM_SERVERS | a space/comma delimited list of rubygem servers
 # PUPPET_VERSION   | specifies the version of the puppet gem to load
-puppetversion = ENV.key?('PUPPET_VERSION') ? "#{ENV['PUPPET_VERSION']}" : '~> 5'
+puppetversion = ENV.key?('PUPPET_VERSION') ? "#{ENV['PUPPET_VERSION']}" : '~> 6'
 gem_sources   = ENV.key?('SIMP_GEM_SERVERS') ? ENV['SIMP_GEM_SERVERS'].split(/[, ]+/) : ['https://rubygems.org']
 
 gem_sources.each { |gem_source| source gem_source }
@@ -13,6 +13,7 @@ gem 'simp-build-helpers'
 gem 'simp-beaker-helpers'
 gem 'beaker-puppet_install_helper'
 gem 'rake', '>= 12.3.3'
+gem 'beaker-docker'
 
 if puppetversion
   gem 'puppet', puppetversion

data/README.md

@@ -26,7 +26,6 @@
     * [`rake pkg:rpm`](#rake-pkgrpm)
     * [`rake pkg:tar`](#rake-pkgtar)
 * [Limitations](#limitations)
-  * [Some versions of bundler fail on FIPS-enabled Systems](#some-versions-of-bundler-fail-on-fips-enabled-systems)
 * [Development](#development)
   * [License](#license)
   * [History](#history)
@@ -39,7 +38,7 @@ The `simp-rake-helpers` gem provides common Rake tasks to support the SIMP build
 
 ### This gem is part of SIMP
 
-This gem is part of (the build tooling for) the [System Integrity Management Platform](https://github.com/NationalSecurityAgency/SIMP), a compliance-management framework built on [Puppet](https://puppetlabs.com/).
+This gem is part of (the build tooling for) the [System Integrity Management Platform](https://simp-project.com), a compliance-management framework built on [Puppet](https://puppetlabs.com/).
 
 
 ### Features
@@ -66,25 +65,6 @@ group :test do
   gem 'puppet', puppetversion
   gem 'beaker-rspec'
   gem 'vagrant-wrapper'
-
-  # Puppet 4+ has issues with Hiera 3.1+
-   if puppetversion.to_s =~ />(\d+)/
-     pversion = $1
-     else
-     pversion = puppetversion
-   end
-
-   if Gem::Dependency.new('puppet', '~> 4.0').match?('puppet', pversion)
-     gem 'hiera', '~> 3.0.0'
-   end
-
-  # simp-rake-helpers does not suport puppet 2.7.X
-  if "#{ENV['PUPPET_VERSION']}".scan(/\d+/).first != '2' &&
-      # simp-rake-helpers and ruby 1.8.7 bomb Travis tests
-      # TODO: fix upstream deps (parallel in simp-rake-helpers)
-      RUBY_VERSION.sub(/\.\d+$/,'') != '1.8'
-    gem 'simp-rake-helpers'
-  end
 end
 ```
 
@@ -164,7 +144,7 @@ directory .  The full list of files considered are:
 ├── CHANGELOG         # OPTIONAL written in RPM's CHANGELOG format
 └── build/            # OPTIONAL
     └── rpm_metadata/ # OPTIONAL
-        ├── release   # OPTIONAL defines the RPM's "-0" release number
+        ├── release   # OPTIONAL defines the RPM's "-<qualifier>" release qualifier
         ├── requires  # OPTIONAL supplementary 'Requires','Provides','Obsoletes'
         └── custom/   # OPTIONAL
           └── *       # OPTIONAL custom snippets in RPM .spec format
@@ -187,7 +167,7 @@ level of the project, if it exists.
 
     Example:
 
-        * Mon Nov 06 2017 Tom Smith <tom.smith@simp.com> - 3.8.0-0
+        * Mon Nov 06 2017 Tom Smith <tom.smith@simp.com> - 3.8.0
         - Add feature x
 
     **Important:** Note the leading zero in "`Nov 05`".  It is a convention
@@ -227,21 +207,6 @@ Build the tar package for the current SIMP project
 
 ## Limitations
 
-### Some versions of bundler fail on FIPS-enabled Systems
-
-This is a limitation of Bundler, not the gem.
-
-If you are running on a FIPS-enabled system, you will need to use
-`bundler '~> 1.14.0'` or `bundler '~> 1.16'`
-
-If you are using RVM, the appropriate steps are as follows:
-
-```shell
-rm Gemfile.lock ||:
-rvm @global do gem uninstall bundler -a -x
-rvm @global do gem install bundler -v '~> 1.14.0'
-```
-
 ## Development
 
 Please see the [SIMP Contribution Guidelines](https://simp-project.atlassian.net/wiki/display/SD/Contributing+to+SIMP).

data/Rakefile

@@ -1,5 +1,3 @@
-# -*- ruby -*-
-
 require "rubygems"
 require 'rake/clean'
 require 'find'
@@ -12,5 +10,6 @@ require 'rspec/core/rake_task'
 require 'simp/rake/rubygem'
 Simp::Rake::Rubygem.new(@package, @rakefile_dir)
 
+require 'simp/rake/beaker'
 
-# vim: syntax=ruby
+Simp::Rake::Beaker.new(Dir.pwd)

data/lib/simp/command_utils.rb

@@ -0,0 +1,21 @@
+module Simp; end
+module Simp::CommandUtils
+  require 'facter'
+
+  def which(cmd, fail=false)
+    @which_cache ||= {}
+
+    if @which_cache.has_key?(cmd)
+      command = @which_cache[cmd]
+    else
+      command = Facter::Core::Execution.which(cmd)
+      @which_cache[cmd] = command
+    end
+
+    msg = "Warning: Command #{cmd} not found on the system."
+
+    ( fail ? raise(msg) : warn(msg) ) unless command
+
+    command
+  end
+end

data/lib/simp/componentinfo.rb

@@ -139,6 +139,23 @@ class Simp::ComponentInfo
     if $?.exitstatus != 0
       fail("Could not extract changelog from #{rpm_spec_files[0]}." +
         " To debug, execute:\n   #{changelog_query}")
+    elsif raw_changelog.strip.empty?
+      changelog_lines = []
+
+      in_changelog = false
+      File.read(rpm_spec_files[0]).lines.each do |line|
+        changelog_lines << line if in_changelog
+
+        if line.start_with?('%')
+          if line.start_with?('%changelog')
+            in_changelog = true
+          else
+            in_changelog = false
+          end
+        end
+      end
+
+      raw_changelog = changelog_lines.join
     end
     @changelog = parse_changelog(raw_changelog, latest_version_only, verbose)
   end

data/lib/simp/local_gpg_signing_key.rb

@@ -1,5 +1,6 @@
 require 'securerandom'
 require 'rake'
+require 'simp/command_utils'
 
 module Simp
   # Ensure that a valid GPG signing key exists in a local directory
@@ -14,49 +15,52 @@ module Simp
   #     - New keys are generated using a temporary GPG agent with its own
   #       settings and socket.
   #
-  #   The local signing key's directory is structured like this:
+  #   The local signing key's directory includes the following:
+  #   gpg < 2.1.0 (EL7):
   #
   #   ```
   #   #{key_name}/                        # key directory
   #     +-- RPM-GPG-KEY-SIMP-#{key_name}  # key file
   #     +-- gengpgkey                     # --gen-key params file **
+  #     +-- gpg-agent-info.env            # Lists location of gpg-agent socket + pid
+  #     +-- run_gpg_agnet                 # Script used to start gpg-agent
   #     +-- pubring.gpg
   #     +-- secring.gpg
-  #     +-- trustring.gpg
+  #     +-- trustdb.gpg
   #   ```
   #
-  #   `**` = `SIMP::RPM.sign_keys` will use the values in the `gengpgkey` file
+  #   gpg >= 2.1.0 (EL8):
+  #   ```
+  #   #{key_name}/                        # key directory
+  #     +-- RPM-GPG-KEY-SIMP-#{key_name}  # key file
+  #     +-- gengpgkey                     # --gen-key params file **
+  #     +-- openpgp-revocs.d/<fingerprint id>.rev
+  #     +-- private-keys-v1.d/<user id>.key
+  #     +-- pubring.kbx
+  #     +-- trustdb.gpg
+  #   ```
+  #
+  #   `**` = `SIMP::RpmSigner.sign_rpms` will use the values in the `gengpgkey` file
   #     for the GPG signing key's email and passphrase
   #
   #   If a new key is required, a project-only `gpg-agent` daemon is momentarily
   #   created to generate it, and destroyed after this is done.  The daemon does
-  #   not interact with any other `gpg-agent` daemons on the system--it is
-  #   launched on a random socket and keeps all its files under the
-  #   #{key_name/} directory.
-  #
-  #   When instantiated, the daemon writes an "env-file" to the #{key_name}
-  #   directory.  This file specifies the location of the daemon's socket and
-  #   pid.
+  #   not interact with any other `gpg-agent` daemons on the system. It is
+  #   launched on random socket(s) whose socket file(s) can be found as follows:
   #
-  #   A typical env-file looks like:
+  #   Location                           Environment
+  #   #{key_name} dir                    Docker container for EL8
+  #   temp dir in /run/user/<uid>/gnupg  EL8
+  #   temp dir in /tmp                   EL7
   #
-  #   ```sh
-  #   GPG_AGENT_INFO=/tmp/gpg-4yhfOB/S.gpg-agent:15495:1
-  #   ```
-  #
-  #   A brand-new gpg-agent daemon will output similar information, with an
-  #   additional export:
-  #
-  #   ```sh
-  #   GPG_AGENT_INFO=/tmp/gpg-4yhfOB/S.gpg-agent:15495:1; export GPG_AGENT_INFO;\n"
-  #   ```
   class LocalGpgSigningKey
     include FileUtils
+    include Simp::CommandUtils
 
-    # `SIMP::RPM.sign_keys` will look for a 'gengpgkey' file to
+    # `SIMP::RpmSigner.sign_rpms` will look for a 'gengpgkey' file to
     #   non-interactively sign packages.
     #
-    #   @see SIMP::RPM.sign_keys
+    #   @see SIMP::RpmSigner.sign_rpms
     GPG_GENKEY_PARAMS_FILENAME = 'gengpgkey'.freeze
 
     # @param dir  [String] path to gpg-agent / key directory
@@ -74,10 +78,27 @@ module Simp
       @key_file  = opts[:file]    || "RPM-GPG-KEY-SIMP-#{@label.capitalize}"
       @verbose   = opts[:verbose] || false
 
+      # for EL7 only
       @gpg_agent_env_file = 'gpg-agent-info.env'
       @gpg_agent_script   = 'run_gpg_agent'
     end
 
+    # Return the version of GPG installed on the system
+    #
+    # @return [Gem::Version]
+    def gpg_version
+      return @gpg_version if @gpg_version
+
+      which('gpg', true)
+      @gpg_version = %x{gpg --version}.lines.first.split(/\s+/).last
+
+      unless @gpg_version.nil? || @gpg_version.empty?
+        @gpg_version = Gem::Version.new(@gpg_version)
+      end
+
+      @gpg_version
+    end
+
     # Returns a gpg-agent's env string, if it can be detected from the
     #   gpg-agent-info file
     #
@@ -95,15 +116,45 @@ module Simp
       info
     end
 
-    # Return the number of days left before the GPG signing key expires
+    # Return the number of days left before the GPG signing key expires or
+    # 0 if the key does not exist or the key is missing an expiration date.
     def dev_key_days_left
+      which('gpg', true)
       ensure_gpg_directory
-      days_left   = 0
-      current_key = %x(GPG_AGENT_INFO='' gpg --homedir=#{@dir} --list-keys #{@key_email} 2>/dev/null)
-      unless current_key.empty?
-        lasts_until = current_key.lines.first.strip.split("\s").last.delete(']')
-        days_left = (Date.parse(lasts_until) - Date.today).to_i
+
+      days_left = 0
+      cmd = "gpg --with-colons --homedir=#{@dir} --list-keys '<#{@key_email}>' 2>&1"
+      puts "Executing: #{cmd}" if @verbose
+      %x(#{cmd}).each_line do |line|
+        # See https://github.com/CSNW/gnupg/blob/master/doc/DETAILS
+        # Index  Content
+        #   0    record type
+        #   6    expiration date
+        #
+        # If expiration date contains a 'T', it is in an ISO 8601 format
+        # (e.g., 20210223T091500). Otherwise it is seconds since the epoch.
+        #
+        fields = line.split(':')
+        if fields[0] && (fields[0] == 'pub')
+          raw_exp_date = fields[6]
+          unless raw_exp_date.nil? || raw_exp_date.strip.empty?
+            require 'date'
+
+            exp_date = nil
+            if raw_exp_date.include?('T')
+              exp_date = DateTime.parse(raw_exp_date).to_date
+            else
+              exp_date = Time.at(raw_exp_date.to_i).to_date
+            end
+
+            days_left = (exp_date - Date.today).to_i
+            days_left = 0 if days_left < 0
+          end
+
+          break
+        end
       end
+
       days_left
     end
 
@@ -135,36 +186,18 @@ module Simp
 
         clean_gpg_agent_directory
         write_genkey_parameter_file
-        write_gpg_agent_startup_script
 
+        agent_info = nil
         begin
-          # Start the GPG agent.
-          gpg_agent_output = %x(./#{@gpg_agent_script}).strip
-
-          # Provide a local socket (needed by the `gpg` command when
-          local_socket     = File.join(Dir.pwd, 'S.gpg-agent')
-
-          # This condition was handled differently in previous logic.
-          #
-          #   a.) As the surrounding logic works now, it will _always_ be a new
-          #       agent by this point, because the directory is cleaned out
-          #   b.) The agent's information will be read from the env-file it
-          #        writes at startup
-          #   c.) The old command `gpg-agent --homedir=#{Dir.pwd} /get serverpid`
-          #       did not work on EL6 or EL7.
-          #
-          warn(empty_gpg_agent_message) if gpg_agent_output.empty?
-
-          agent_info = gpg_agent_info
-
-          # The socket is useful to get back info on the command line.
-          unless File.exist?(File.join(Dir.pwd, File.basename(agent_info[:socket])))
-            ln_s(agent_info[:socket], local_socket, :verbose => @verbose)
+          if gpg_version < Gem::Version.new('2.1')
+            agent_info = start_gpg_agent_old
+          else
+            agent_info = start_gpg_agent
           end
-          generate_key(agent_info[:info])
         ensure
-          kill_agent(agent_info[:pid])
+          kill_agent(agent_info[:pid]) if agent_info
         end
+
         agent_info
       end
     end
@@ -174,7 +207,7 @@ module Simp
     #
     # @return [String] Warning message
     def empty_gpg_agent_message
-      <<-WARNING.gsub(/^\s{8}/,'')
+      <<~WARNING
         WARNING: Tried to start an project-only gpg-agent daemon on a random socket by
                  running the script:
 
@@ -195,7 +228,6 @@ module Simp
     #
     # @param pid [String] The GPG Agent PID to kill
     def kill_agent(pid)
-      rm('S.gpg-agent') if File.symlink?('S.gpg-agent')
       if pid
         Process.kill(0, pid)
         Process.kill(15, pid)
@@ -209,11 +241,18 @@ module Simp
     # @param gpg_agent_info_str [String] value to set the GPG_AGENT_INFO
     #   environment variable to use in order to use the correct `gpg-agent`.
     def generate_key(gpg_agent_info_str)
+      which('gpg', true)
+
       puts "Generating new GPG key#{@verbose ? " under '#{@dir}'" : ''}..."
       gpg_cmd = %(GPG_AGENT_INFO=#{gpg_agent_info_str} gpg --homedir="#{@dir}")
+
       pipe    = @verbose ? '| tee' : '>'
-      sh %(#{gpg_cmd} --batch --gen-key #{GPG_GENKEY_PARAMS_FILENAME})
-      sh %(#{gpg_cmd} --armor --export #{@key_email} #{pipe} "#{@key_file}")
+      %x(#{gpg_cmd} --batch --gen-key #{GPG_GENKEY_PARAMS_FILENAME})
+      %x(#{gpg_cmd} --armor --export '<#{@key_email}>' #{pipe} "#{@key_file}")
+
+      if File.stat(@key_file).size == 0
+        fail "Error: Something went wrong generating #{@key_file}"
+      end
     end
 
     # Return a data structure from a gpg-agent env-file formatted string.
@@ -225,6 +264,62 @@ module Simp
       { info: info.strip, socket: matches[:socket], pid: matches[:pid].to_i }
     end
 
+    # Start the gpg-agent
+    # @return Hash of agent info
+    # @raise if gpg-agent fails to start
+    def start_gpg_agent
+      which('gpg', true)
+      which('gpg-agent', true)
+      which('gpg-connect-agent', true)
+
+      # Start the GPG agent, if it is not already running
+      check_agent = "gpg-agent -q --homedir=#{Dir.pwd} >&/dev/null"
+      start_agent = "gpg-agent --homedir=#{Dir.pwd} --daemon >&/dev/null"
+      cmd = "#{check_agent} || #{start_agent}"
+      puts "Executing: #{cmd}" if @verbose
+      %x(#{cmd})
+      if $? && ($?.exitstatus != 0)
+        err_msg = [
+          'Failed to start gpg-agent during key creation.',
+          "  Execute '#{start_agent.gsub(' >&/dev/null','')}' to debug."
+        ].join("\n")
+        raise(err_msg)
+      end
+
+      agent_info = {}
+
+      # Provide a local socket (needed by the `gpg` command when
+      agent_info[:socket] = %x{echo 'GETINFO socket_name' | gpg-connect-agent --homedir=#{Dir.pwd}}.lines.first[1..-1].strip
+
+      # Get the pid
+      agent_info[:pid] = %x{echo 'GETINFO pid' | gpg-connect-agent --homedir=#{Dir.pwd}}.lines.first[1..-1].strip.to_i
+
+      generate_key(%{#{agent_info[:socket]}:#{agent_info[:pid]}:1})
+
+      agent_info
+    end
+
+    # Start the gpg-agent with options suitable for gpg version < 2.1
+    # @return Hash of agent info
+    def start_gpg_agent_old
+      write_gpg_agent_startup_script
+      gpg_agent_output = %x(./#{@gpg_agent_script}).strip
+
+      # By the time we get here, we can be assured we will be starting a
+      # new agent, because the directory is cleaned out.
+      #
+      # Follow-on gpg actions will read the agent's information from
+      # the env-file the agent writes at startup.
+
+      # We're using the --sh option which will spew out the agent config
+      # when the agent starts. If it is empty, this is a problem.
+      warn(empty_gpg_agent_message) if gpg_agent_output.empty?
+
+      agent_info = gpg_agent_info
+      generate_key(agent_info[:info])
+      agent_info
+    end
+
     # Write the `gpg --genkey --batch` control parameter file
     #
     # @see "Unattended key generation" in /usr/share/doc/gnupg2-*/DETAILS for
@@ -232,38 +327,46 @@ module Simp
     def write_genkey_parameter_file
       now               = Time.now.to_i.to_s
       expire_date       = Date.today + 14
-      passphrase        = SecureRandom.base64(500)
-      genkey_parameters = <<-GENKEY_PARAMETERS.gsub(%r{^ {8}}, '')
-        %echo Generating Development GPG Key
-        %echo
-        %echo This key will expire on #{expire_date}
-        %echo
-        Key-Type: RSA
-        Key-Length: 4096
-        Key-Usage: sign
-        Name-Real: SIMP Development
-        Name-Comment: Development key #{now}
-        Name-Email: #{@key_email}
-        Expire-Date: 2w
-        Passphrase: #{passphrase}
-        %pubring pubring.gpg
-        %secring secring.gpg
-        # The following creates the key, so we can print "Done!" afterwards
-        %commit
-        %echo New GPG Development Key Created
-      GENKEY_PARAMETERS
-      File.open(GPG_GENKEY_PARAMS_FILENAME, 'w') { |fh| fh.puts(genkey_parameters) }
+      passphrase        = SecureRandom.base64(100)
+      genkey_parameters = [
+        '%echo Generating Development GPG Key',
+        '%echo',
+        "%echo This key will expire on #{expire_date}",
+        '%echo',
+        'Key-Type: RSA',
+        'Key-Length: 4096',
+        'Key-Usage: sign',
+        'Name-Real: SIMP Development',
+        "Name-Comment: Development key #{now}",
+        "Name-Email: #{@key_email}",
+        'Expire-Date: 2w',
+        "Passphrase: #{passphrase}",
+      ]
+
+      if gpg_version < Gem::Version.new('2.1')
+        genkey_parameters << '%pubring pubring.gpg'
+        genkey_parameters << '%secring secring.gpg'
+      end
+
+      genkey_parameters << '# The following creates the key, so we can print "Done!" afterwards'
+      genkey_parameters << '%commit'
+      genkey_parameters << '%echo New GPG Development Key Created'
+
+      File.open(GPG_GENKEY_PARAMS_FILENAME, 'w') { |fh| fh.puts(genkey_parameters.join("\n")) }
     end
 
     # Write a local gpg-agent daemon script file
     def write_gpg_agent_startup_script
-      gpg_agent_script = <<-AGENT_SCRIPT.gsub(%r{^ {20}}, '')
+      which('gpg-agent', true)
+      pinentry_cmd = which('pinentry-curses', true)
+
+      gpg_agent_script = <<~AGENT_SCRIPT
         #!/bin/sh
 
         gpg-agent --homedir=#{Dir.pwd} --daemon \
           --no-use-standard-socket --sh --batch \
           --write-env-file "#{@gpg_agent_env_file}" \
-          --pinentry-program /usr/bin/pinentry-curses < /dev/null &
+          --pinentry-program #{pinentry_cmd} < /dev/null &
       AGENT_SCRIPT
 
       File.open(@gpg_agent_script, 'w') { |fh| fh.puts(gpg_agent_script) }