Restoring a duplicity backup with Dejà Dup from a different computer

Asked by dr.spock

I'm making some scheduled encrypted backups from an Ubuntu Server to a remote computer, using duplicity.

What I'd like to do is to access that remote computer from a third machine, Ubuntu Desktop in this case, and being able to use the Dejà Dup GUI to restore backups.

I select "sftp://user@remotecomputer:/home/user/backups" as source and it does find the backups and I can select the day to restore, but it complains about encryption and not having a secret key. Shouldn't it ask for the key then?

GPGError: GPG Failed, see log below:
===== Begin GnuPG log =====
gpg: AES256 encrypted data
gpg: gcry_kdf_derive failed: Invalid data
gpg: encrypted with 1 passphrase
gpg: decryption failed: No secret key
===== End GnuPG log =====

I know I can use duplicity command line to restore, but I just want to know if there's something I can do to use this graphical front end.

Thanks!

Question information

Language:
English Edit question
Status:
Answered
For:
Déjà Dup Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Michael Terry (mterry) said :
#1

What version of Ubuntu on the server and the desktop? How did you encrypt the backup? Via a password or a gpg key?

This looks a bit like https://bugs.launchpad.net/duplicity/+bug/1828869?

Revision history for this message
dr.spock (dr.spock) said :
#2

Machine doing backups: Ubuntu Server: 20.04.2 LTS
Machine storing backups: Ubuntu Server: 20.04.2 LTS
Machine trying to recover via Déjà Dup: Ubuntu Desktop: 21.04

The script using duplicity sets the variable PASSPHRASE before backing up and unsets it when the backup is done, so I assume it's a simple password. I never set up anything regarding a gpg key.

Revision history for this message
Michael Terry (mterry) said :
#3

Sorry for the slow responses. Can you share what the duplicity backup command looks like on the server? Would help me reproduce this.

Revision history for this message
dr.spock (dr.spock) said :
#4

backup command:

duplicity full /home/FILE/documents rsync://copies:********@nessus::backup/documents >>/var/log/duplicity/documents.log

Previously, I have set the PASSPHRASE environment variable with the key to encrypt the backup, and I unset it when the backup is finished.

Revision history for this message
Launchpad Janitor (janitor) said :
#5

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
dr.spock (dr.spock) said (last edit ):
#6

I don't know what else can I try. The issue seems clear: Dejà Dup needs the secret key but it doesn't ask for it.

Revision history for this message
Michael Terry (mterry) said :
#7

Oh interesting, it never even prompts for a password? Just gives you that error straight away?

What is your desktop language? I know that's an odd question, but it's possible a language confusion is preventing us from noticing this gpg message and acting accordingly.

Revision history for this message
dr.spock (dr.spock) said :
#8

Straight away to the error. After that I can even select a different date from the date drop-down menu, but just to get the error again.

The desktop language is Catalan (ca_ES). The UI is just partially translated: just a few words in the title bar and top menu, and some other labels and buttons of the restore wizard. The translation state shouldn't have to do with the functionality, BUT:

I have tried to launch it from terminal with

LANGUAGE=en_US deja-dup

and... it detects an encryption password is needed and it shows a button to enter it!

So, for some reason it's skipping the password dialog at least in my language.

Revision history for this message
Michael Terry (mterry) said :
#9

Fascinating. OK, I've committed what should be a fix for this. You can see the change here, but explanation below:

https://gitlab.gnome.org/World/deja-dup/-/commit/6c9c060b40ba67475b8d16ac6c933f181e79d78a

We don't talk directly to gpg, but through duplicity (the underlying backup tool). And we don't get a machine-parsable error code or anything.

So normally, we ask a gpg library "hey, what is the translated error string for password-needed or bad-password?" and look for that string when we run duplicity and it gives back a gpg error.

But for some reason, in your case, that gpg library is giving us a string that gpg itself isn't actually giving us back. That is, the gpg library and gpg executable disagree about what language they're running under, or maybe what translations are available.

So that commit above tries to work around situations like that by also always looking for the untranslated English string. :shrug:

Thanks for working through that with me!

Revision history for this message
dr.spock (dr.spock) said :
#10

No, thanks to you for the close following of this issue! I'm looking forward to get an update from the Ubuntu repos and test your patch. Awesome! 😊

Revision history for this message
Michael Terry (mterry) said :
#11

In the meantime does running Deja Dup in English work well enough for you?

Revision history for this message
dr.spock (dr.spock) said :
#12

Confirmed, it works as expected.

Can you help with this problem?

Provide an answer of your own, or ask dr.spock for more information if necessary.

To post a message you must log in.