Merge branch 'bugfix/17807-restore-pubring' into 'stable'

Detect corrupt GnuPG public keyring and restore its backup

Closes #17807

See merge request tails/tails!275

config/chroot_local-includes/usr/local/sbin/live-persist

@@ -120,6 +120,22 @@ migrate_persistence_preset()
 	fi
 }
 
+maybe_restore_gnupg_pubring()
+{
+	local KEYRING="/home/amnesia/.gnupg/pubring.kbx"
+	local KEYRING_BAK="${KEYRING}~"
+	local KEYRING_SIZE="$(stat -c %s ${KEYRING} || echo 0)"
+
+	if [ ! -f "${KEYRING}" ] || [ "${KEYRING_SIZE}" -le 32 ]; then
+		warning "It seems the GnuPG keyring is corrupt"
+		if [ -f "${KEYRING_BAK}" ]; then
+			warning "Restoring backup of GnuPG keyring"
+			cp "${KEYRING_BAK}" "${KEYRING}"
+			chmod u=rw,go= "${KEYRING}"
+		fi
+	fi
+}
+
 # We override live-boot's logging facilities to get more useful error messages
 log_warning_msg ()
 {
@@ -463,6 +479,11 @@ activate_volumes ()
 			echo "  - ${vol}"
 		done
 	fi
+
+	if mountpoint -q /home/amnesia/.gnupg; then
+		maybe_restore_gnupg_pubring
+	fi
+
 	exit ${ret}
 }