[MacPorts] #74254: Found one of the reasons for failing to the infamous `Failed to verify signature for MacPorts source`.

[MacPorts]

#74254: Found one of the reasons for failing to the infamous `Failed to verify
signature for MacPorts source`.
-------------------------------------------------+--------------------
 Reporter:  Lisias                               |      Owner:  (none)
     Type:  defect                               |     Status:  new
 Priority:  Not set                              |  Milestone:
Component:  base                                 |    Version:  2.12.5
 Keywords:  TMPDIR checksum signature signature  |       Port:
-------------------------------------------------+--------------------
 I had been plagued with this message for some time, but none of the found
 resolutions I found fixed my problem (like #49233 and #50867): by some
 reason, macports were being unable to check signatures after a SYNC (no
 matter a rsync or https):

 {{{
 --->  Updating MacPorts base sources using rsync
 receiving file list ... done

 sent 36 bytes  received 69 bytes  42.00 bytes/sec
 total size is 27013120  speedup is 257267.81
 receiving file list ... done

 sent 36 bytes  received 76 bytes  44.80 bytes/sec
 total size is 512  speedup is 4.57
 Error: Failed to verify signature for MacPorts source!
 To report a bug, follow the instructions in the guide:
     http://guide.macports.org/#project.tickets
 Error: /opt/local/bin/port: port selfupdate failed: Failed to verify
 signature for MacPorts source!
 }}}

 Similar problem was also preventing me from installing/updating ports.

 The ticket #50867 gave me an idea, however... Reading the tcl
 documentation, I learnt that TCL creats tmp files on the `$TMPDIR` to save
 `stdout` and `stderr` from a `exec` command, and so I dug into macports
 source and voilà: my rig was borking exactly on `run_unprivileged {exec
 {*}$command}` from procs `macports::verify_signature_signify` and
 `macports::verify_signature_openssl`.

 This is an environment problem, i.e., by some reason my rig is not feeding
 MacPorts with `$TMPDIR` and a change somewhere in the 1.12.x line was
 caught by it - assuming it wasn't something I did myself on my rig and
 updating MacPorts at the same time was a coincidence.

 I'm still trying to figure out if it's something I did, or something
 changed on MacPorts, but in the mean time and out of despair :P I brute
 forced my way with two changes in
 `/opt/local/libexec/macports/lib/macports1.0/macports.tcl`:

 {{{
 proc macports::verify_signature_signify {file pubkey signature} {
     set ::env(TMPDIR) "/tmp"
     set verified 0
     <yada yada yada>
 }

 proc macports::verify_signature_openssl {file pubkey signature} {
     set ::env(TMPDIR) "/tmp"
     set openssl [findBinary openssl $macports::autoconf::openssl_path]
     <yada yada yada>
 }
 }}}

 Again, I know this is not a fix, **it's a dirty hack**. But it put my rig
 back on tracks while I try to figure out why it happened at first place -
 available time is always a problem nowadays.

 In a way or another, I aim to document the issue here in the hope to help
 someone else in the future, as #50867 did to me.

 I intend to fully diagnose the root cause of this problem (being a change
 on my rig, being something on MacPorts). Just don't hold your breath. :)

-- 
Ticket URL: <https://trac.macports.org/ticket/74254>
MacPorts <https://www.macports.org/>
Ports system for macOS