Puppet Community

puppetserver injects its `Puppet::Util::Execution.execute` implementation which ultimately calls into clojure. I would expect the stderr output to be logged to puppetserver's log based on <https://github.com/puppetlabs/clj-shell-utils/blob/bf95a25bcd8865c7770f26188b0f25ba9aee0b76/src/java/com/puppetlabs/puppetserver/ShellUtils.java#L100-L102>

You could also setting `combine: true` which would merge stdout &amp; stderr (for short term debugging). Unfortunately the execution API doesn't support popen style methods where the caller can receive independent stdout and stderr streams.

we probably can't easily add puppetserver to the hiera-eyaml-gpg test matrix, but we could extend it with jruby, if that helps

That's a bummer. but yes, that fist thing I changed and so far don't see any additional insight and support is unsupportive :disappointed:

```Executed an external process which logged to STDERR: gpg: decryption failed: No secret key```

there is no way key is not there, otherwise it would have failed every single time

I usually only have `Executed an external process which logged to STDERR:`

yeah that commit with discarding stderr and failing is questionable

I am thinking to downgrade to earlier version

with `failonfail: true`  temp file is never removed

given that stderr was merged in 2019, maybe it's time to revert that

Can you `strace` the java process and follow forks to see how `gpg` is getting called (differently)?

puppetserver prints command though and it works fine when I ran it manually

```Error was Execution of 'gpg --homedir /etc/puppetlabs/puppetserver/keys/gpg --quiet --no-secmem-warning --no-permission-warning --no-tty --yes --decrypt /tmp/puppet-eyaml-hiera-gpg-input20230215-129448-8gat21' returned 2: ```

nowadays gpg runs an agent as a daemon, I suspect some collisions are happening when two decrypt happens at unfortunate time. But why it didn't happen in PE2019, I don't know

Maybe something like `strace -f -e trace=exec -p `pgrep java`` Also check that the `pe-puppet` user has read permission to `/tmp/puppet-eyaml-hiera-gpg-input20230215-129448-8gat21` Also maybe selinux?

selinux would either work or doesn't, not random

```# cat /etc/systemd/system/pe-puppetserver.service.d/limits.conf 
[Service]
LimitNOFILE=32768```