Public bug reported: I discovered this while running the following apt-key command:
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 I was hoping apt-key would pick up the http_proxy environment variable, however it did not. So I had to pass it into gpg manually: sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --keyserver- options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 However, that still didn't work. So I messed around with running gnupg manually and found that the dirmngr has a bug in the implementation of its HTTP client. Essentially, dirmngr does not handle the http_proxy quite right, as it is still trying to resolve the hostname of the keyserver instead of just proxying the request through the HTTP proxy defined with the http-proxy argument. I configured dirmngr to show all debugging output: $ cat ~/.gnupg/dirmngr.conf log-file /home/wlaw/.gnupg/dirmngr.log verbose debug all Output of running gpg manually: $ gpg --debug-level guru --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 gpg: enabled debug flags: packet mpi crypto filter iobuf memory cache memstat trust hashing ipc clock lookup extprog gpg: DBG: [not enabled in the source] start gpg: DBG: chan_3 <- # Home: /home/wlaw/.gnupg gpg: DBG: chan_3 <- # Config: /home/wlaw/.gnupg/dirmngr.conf gpg: DBG: chan_3 <- OK Dirmngr 2.2.4 at your service gpg: DBG: connection to the dirmngr established gpg: DBG: chan_3 -> GETINFO version gpg: DBG: chan_3 <- D 2.2.4 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION http-proxy=http://localhost:3128/ gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> KEYSERVER --clear hkp://keyserver.ubuntu.com:80 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823 gpg: DBG: chan_3 <- ERR 167772346 No keyserver available <Dirmngr> gpg: keyserver receive failed: No keyserver available gpg: DBG: chan_3 -> BYE gpg: DBG: [not enabled in the source] stop gpg: keydb: handles=0 locks=0 parse=0 get=0 gpg: build=0 update=0 insert=0 delete=0 gpg: reset=0 found=0 not=0 cache=0 not=0 gpg: kid_not_found_cache: count=0 peak=0 flushes=0 gpg: sig_cache: total=0 cached=0 good=0 bad=0 gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0 outmix=0 getlvl1=0/0 getlvl2=0/0 gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0 gpg: secmem usage: 0/65536 bytes in 0 blocks Output of dirmngr.log: $ cat ~/.gnupg/dirmngr.log 2018-08-21 10:18:41 dirmngr[22513.0] permanently loaded certificates: 139 2018-08-21 10:18:41 dirmngr[22513.0] runtime cached certificates: 0 2018-08-21 10:18:41 dirmngr[22513.0] trusted certificates: 139 (138,0,0,1) 2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 started 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Home: /home/wlaw/.gnupg 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Config: /home/wlaw/.gnupg/dirmngr.conf 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK Dirmngr 2.2.4 at your service 2018-08-21 10:18:41 dirmngr[22513.6] connection from process 22512 (1000:1000) 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- GETINFO version 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> D 2.2.4 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- OPTION http-proxy=http://localhost:3128/ 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KEYSERVER --clear hkp://keyserver.ubuntu.com:80 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: libdns initialized 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name 2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name 2018-08-21 10:18:41 dirmngr[22513.6] number of system provided CAs: 138 2018-08-21 10:18:41 dirmngr[22513.6] DBG: http.c:connect_server: trying name='localhost' port=3128 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(localhost): Success 2018-08-21 10:18:41 dirmngr[22513.6] can't connect to 'localhost': no IP address for host 2018-08-21 10:18:41 dirmngr[22513.6] error connecting to 'http://keyserver.ubuntu.com:80': Unknown host 2018-08-21 10:18:41 dirmngr[22513.6] marking host 'keyserver.ubuntu.com' as dead 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name 2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name 2018-08-21 10:18:41 dirmngr[22513.6] host 'keyserver.ubuntu.com' marked as dead 2018-08-21 10:18:41 dirmngr[22513.6] command 'KS_GET' failed: No keyserver available 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> ERR 167772346 No keyserver available <Dirmngr> 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- BYE 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK closing connection 2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 terminated This is only a problem when you're on a network that does not resolve DNS of internet hostnames (i.e. some sort of split-horizon setup). However, that shouldn't matter, because dirmngr should not be trying to resolve the address on its own if a proxy server has been defined and provided as an argument. I can curl the hostname just fine using the HTTP proxy: $ curl keyserver.ubuntu.com -o keyserver -vvv * Rebuilt URL to: keyserver.ubuntu.com/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 3128 (#0) > GET http://keyserver.ubuntu.com/ HTTP/1.1 > Host: keyserver.ubuntu.com > User-Agent: curl/7.58.0 > Accept: */* > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 OK < Date: Tue, 21 Aug 2018 12:15:44 GMT < Server: sks_www/1.1.6 < Content-Length: 5004 < Content-Type: text/html; charset=UTF-8 < Access-Control-Allow-Origin: * < Vary: Accept-Encoding < Warning: 110 squid/3.5.12 "Response is stale" < X-Cache: HIT from cassava.canonical.com < X-Cache-Lookup: HIT from cassava.canonical.com:3128 < Via: 1.1 cassava.canonical.com (squid/3.5.12) < Proxy-Connection: Keep-Alive < Connection: Keep-Alive < Age: 7534 < { [3595 bytes data] 100 5004 100 5004 0 0 56224 0 --:--:-- --:--:-- --:--:-- 56224 * Connection #0 to host localhost left intact ProblemType: Bug DistroRelease: Ubuntu 18.04 Package: gnupg2 2.2.4-1ubuntu1.1 ProcVersionSignature: Ubuntu 4.15.0-30.32-generic 4.15.18 Uname: Linux 4.15.0-30-generic x86_64 NonfreeKernelModules: talpa_vfshook talpa_pedconnector talpa_pedevice talpa_vcdevice talpa_core talpa_linux talpa_syscallhook wl nvidia_modeset nvidia ApportVersion: 2.20.9-0ubuntu7.2 Architecture: amd64 CurrentDesktop: ubuntu:GNOME Date: Tue Aug 21 10:04:02 2018 InstallationDate: Installed on 2018-04-06 (136 days ago) InstallationMedia: Ubuntu 16.04.4 LTS "Xenial Xerus" - Release amd64 (20180228) PackageArchitecture: all ProcEnviron: TERM=xterm-256color PATH=(custom, no user) XDG_RUNTIME_DIR=<set> LANG=en_US.UTF-8 SHELL=/bin/bash SourcePackage: gnupg2 UpgradeStatus: Upgraded to bionic on 2018-05-11 (101 days ago) ** Affects: gnupg2 (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug bionic ** Description changed: I discovered this while running the following apt-key command: sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 I was hoping apt-key would pick up the http_proxy environment variable, however it did not. So I had to pass it into gpg manually: sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --keyserver- options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 However, that still didn't work. So I messed around with running gnupg manually and found that the dirmngr has a bug in the implementation of its HTTP client. Essentially, dirmngr does not handle the http_proxy quite right, as it is still trying to resolve the hostname of the keyserver instead of just proxying the request through the HTTP proxy defined with the http-proxy argument. I configured dirmngr to show all debugging output: - $ cat ~/.gnupg/dirmngr.conf + $ cat ~/.gnupg/dirmngr.conf log-file /home/wlaw/.gnupg/dirmngr.log verbose debug all Output of running gpg manually: - $ gpg --debug-level guru --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 + $ gpg --debug-level guru --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823 gpg: enabled debug flags: packet mpi crypto filter iobuf memory cache memstat trust hashing ipc clock lookup extprog gpg: DBG: [not enabled in the source] start gpg: DBG: chan_3 <- # Home: /home/wlaw/.gnupg gpg: DBG: chan_3 <- # Config: /home/wlaw/.gnupg/dirmngr.conf gpg: DBG: chan_3 <- OK Dirmngr 2.2.4 at your service gpg: DBG: connection to the dirmngr established gpg: DBG: chan_3 -> GETINFO version gpg: DBG: chan_3 <- D 2.2.4 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION http-proxy=http://localhost:3128/ gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> KEYSERVER --clear hkp://keyserver.ubuntu.com:80 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823 gpg: DBG: chan_3 <- ERR 167772346 No keyserver available <Dirmngr> gpg: keyserver receive failed: No keyserver available gpg: DBG: chan_3 -> BYE gpg: DBG: [not enabled in the source] stop gpg: keydb: handles=0 locks=0 parse=0 get=0 gpg: build=0 update=0 insert=0 delete=0 gpg: reset=0 found=0 not=0 cache=0 not=0 gpg: kid_not_found_cache: count=0 peak=0 flushes=0 gpg: sig_cache: total=0 cached=0 good=0 bad=0 gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0 - outmix=0 getlvl1=0/0 getlvl2=0/0 + outmix=0 getlvl1=0/0 getlvl2=0/0 gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0 gpg: secmem usage: 0/65536 bytes in 0 blocks - Output of dirmngr.log: - $ cat ~/.gnupg/dirmngr.log + $ cat ~/.gnupg/dirmngr.log 2018-08-21 10:18:41 dirmngr[22513.0] permanently loaded certificates: 139 2018-08-21 10:18:41 dirmngr[22513.0] runtime cached certificates: 0 2018-08-21 10:18:41 dirmngr[22513.0] trusted certificates: 139 (138,0,0,1) 2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 started 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Home: /home/wlaw/.gnupg 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Config: /home/wlaw/.gnupg/dirmngr.conf 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK Dirmngr 2.2.4 at your service 2018-08-21 10:18:41 dirmngr[22513.6] connection from process 22512 (1000:1000) 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- GETINFO version 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> D 2.2.4 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- OPTION http-proxy=http://localhost:3128/ 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KEYSERVER --clear hkp://keyserver.ubuntu.com:80 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: libdns initialized 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name 2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name 2018-08-21 10:18:41 dirmngr[22513.6] number of system provided CAs: 138 2018-08-21 10:18:41 dirmngr[22513.6] DBG: http.c:connect_server: trying name='localhost' port=3128 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(localhost): Success 2018-08-21 10:18:41 dirmngr[22513.6] can't connect to 'localhost': no IP address for host 2018-08-21 10:18:41 dirmngr[22513.6] error connecting to 'http://keyserver.ubuntu.com:80': Unknown host 2018-08-21 10:18:41 dirmngr[22513.6] marking host 'keyserver.ubuntu.com' as dead 2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name 2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name 2018-08-21 10:18:41 dirmngr[22513.6] host 'keyserver.ubuntu.com' marked as dead 2018-08-21 10:18:41 dirmngr[22513.6] command 'KS_GET' failed: No keyserver available 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> ERR 167772346 No keyserver available <Dirmngr> 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- BYE 2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK closing connection 2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 terminated This is only a problem when you're on a network that does not resolve DNS of internet hostnames (i.e. some sort of split-horizon setup). However, that shouldn't matter, because dirmngr should not be trying to resolve the address on its own if a proxy server has been defined and provided as an argument. + I can curl the hostname just fine using the HTTP proxy: + + $ curl keyserver.ubuntu.com -o keyserver -vvv + * Rebuilt URL to: keyserver.ubuntu.com/ + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 127.0.0.1... + * TCP_NODELAY set + * Connected to localhost (127.0.0.1) port 3128 (#0) + > GET http://keyserver.ubuntu.com/ HTTP/1.1 + > Host: keyserver.ubuntu.com + > User-Agent: curl/7.58.0 + > Accept: */* + > Proxy-Connection: Keep-Alive + > + < HTTP/1.1 200 OK + < Date: Tue, 21 Aug 2018 12:15:44 GMT + < Server: sks_www/1.1.6 + < Content-Length: 5004 + < Content-Type: text/html; charset=UTF-8 + < Access-Control-Allow-Origin: * + < Vary: Accept-Encoding + < Warning: 110 squid/3.5.12 "Response is stale" + < X-Cache: HIT from cassava.canonical.com + < X-Cache-Lookup: HIT from cassava.canonical.com:3128 + < Via: 1.1 cassava.canonical.com (squid/3.5.12) + < Proxy-Connection: Keep-Alive + < Connection: Keep-Alive + < Age: 7534 + < + { [3595 bytes data] + 100 5004 100 5004 0 0 56224 0 --:--:-- --:--:-- --:--:-- 56224 + * Connection #0 to host localhost left intact + + ProblemType: Bug DistroRelease: Ubuntu 18.04 Package: gnupg2 2.2.4-1ubuntu1.1 ProcVersionSignature: Ubuntu 4.15.0-30.32-generic 4.15.18 Uname: Linux 4.15.0-30-generic x86_64 NonfreeKernelModules: talpa_vfshook talpa_pedconnector talpa_pedevice talpa_vcdevice talpa_core talpa_linux talpa_syscallhook wl nvidia_modeset nvidia ApportVersion: 2.20.9-0ubuntu7.2 Architecture: amd64 CurrentDesktop: ubuntu:GNOME Date: Tue Aug 21 10:04:02 2018 InstallationDate: Installed on 2018-04-06 (136 days ago) InstallationMedia: Ubuntu 16.04.4 LTS "Xenial Xerus" - Release amd64 (20180228) PackageArchitecture: all ProcEnviron: - TERM=xterm-256color - PATH=(custom, no user) - XDG_RUNTIME_DIR=<set> - LANG=en_US.UTF-8 - SHELL=/bin/bash + TERM=xterm-256color + PATH=(custom, no user) + XDG_RUNTIME_DIR=<set> + LANG=en_US.UTF-8 + SHELL=/bin/bash SourcePackage: gnupg2 UpgradeStatus: Upgraded to bionic on 2018-05-11 (101 days ago) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1788190 Title: gnupg2 not honoring http-proxy argument To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnupg2/+bug/1788190/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
