[PING]: [PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

Torbjorn SVENSSON torbjorn.svensson at foss.st.com
Thu Oct 8 10:00:04 CEST 2026 

Gentle ping. :)

Kind regards,
Torbjörn

On 2026-09-23 14:26, Torbjorn SVENSSON via Gnupg-devel wrote:
> 
> 
> On 2026-09-11 18:34, Torbjorn SVENSSON via Gnupg-devel wrote:
>>
>>
>> On 2026-09-11 11:24, Werner Koch wrote:
>>> On Thu, 10 Sep 2026 16:40, Torbjorn SVENSSON said:
>>>
>>>> I'd love to do that, but every attempt that I've done to access
>>>> https://dev.gnupg.org/ has resulted in PR_CONNECT_RESET_ERROR.
>>>
>>> Sorry for this.  Those ^%&%&% AI scrapers just drive us crazy and thus
>>> we still need to blacklist most of the net.  But they have not yet taken
>>> over mailing lists, thus please post bug reports here.
>> I don't know what format you want this in, so I'll just use plain text.
>>
>> Bug report:
>>
>> If the host running gpg has no route to the Internet and the DNS does not
>> resolve any public domains, gpg will fail to download the public key from a
>> keyserver, even if configured to go through a proxy server.
>>
>> In https://lists.gnupg.org/pipermail/gnupg-devel/2026-September/036385.html,
>> I attached a small docker setup where this can be verified. In the demo,
>> there is no custom binary or anything alike. The input to the "run-test.sh"
>> script is a path to a git clone of the gpg source tree and the tree will
>> be copied into the container and built inside.
>> I also added a patch in that email that I'm using below.
>>
>>
>> If I run the demo on the 53ee642e2cc10b6a0bcb69c6d3f788deef2eac7a commit, with
>>
>> debug ipc,network,dns
>> log-file /tmp/dirmngr.log
>>
>> in $work/dirmngr.conf (as requested in
>> https://lists.gnupg.org/pipermail/gnupg-devel/2026-September/036386.html), I
>> get the following in the dirmngr.log file (I've taken the liberty to remove
>> the timestamp):
>>
>>
>> dirmngr[12] listening on socket '/tmp/tmp.lktzYbo0YT/S.dirmngr'
>> dirmngr[13.0] error loading certificate '/etc/ssl/certs/ca-certificates.crt': Certificate expired
>> dirmngr[13.0] error loading certificate '/etc/ssl/certs/ca-certificates.crt': Certificate expired
>> dirmngr[13.0] permanently loaded certificates: 129
>> dirmngr[13.0]     runtime cached certificates: 0
>> dirmngr[13.0]            trusted certificates: 129 (129,0,0,0)
>> dirmngr[13.0] failed to open cache dir file '/tmp/tmp.lktzYbo0YT/crls.d/DIR.txt': No such file or directory
>> dirmngr[13.0] creating directory '/tmp/tmp.lktzYbo0YT/crls.d'
>> dirmngr[13.0] new cache dir file '/tmp/tmp.lktzYbo0YT/crls.d/DIR.txt' created
>> dirmngr[13.6] handler for fd 6 started
>> dirmngr[13.6] DBG: chan_6 -> # Home: /tmp/tmp.lktzYbo0YT
>> dirmngr[13.6] DBG: chan_6 -> # Config: /tmp/tmp.lktzYbo0YT/dirmngr.conf
>> dirmngr[13.6] DBG: chan_6 -> OK Dirmngr 2.5.23-beta6 at your service, process 13
>> dirmngr[13.6] connection from process 1 (0:0)
>> dirmngr[13.6] DBG: chan_6 <- GETINFO version
>> dirmngr[13.6] DBG: chan_6 -> D 2.5.23-beta6
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- OPTION http-proxy=http://172.28.0.2:3128
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- KEYSERVER --clear hkps://keyserver.ubuntu.com
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- KS_GET -- 0x1493269DE61F124AA69A316E3ADF34EBDBB200A4
>> dirmngr[13.6] DBG: dns: libdns initialized
>> dirmngr[13.6] DBG: dns: getsrv(_pgpkey-https._tcp.keyserver.ubuntu.com): Server indicated a failure
>> dirmngr[13.6] command 'KS_GET' failed: Server indicated a failure <Unspecified source>
>> dirmngr[13.6] DBG: chan_6 -> ERR 219 Server indicated a failure <Unspecified source>
>> dirmngr[13.6] DBG: chan_6 <- BYE
>> dirmngr[13.6] DBG: chan_6 -> OK closing connection
>> dirmngr[13.6] handler for fd 6 terminated
>>
>>
>> With my patched applied on top, I instead get this:
>>
>>
>> dirmngr[12] listening on socket '/tmp/tmp.1u46BWZXep/S.dirmngr'
>> dirmngr[13.0] error loading certificate '/etc/ssl/certs/ca-certificates.crt': Certificate expired
>> dirmngr[13.0] error loading certificate '/etc/ssl/certs/ca-certificates.crt': Certificate expired
>> dirmngr[13.0] permanently loaded certificates: 129
>> dirmngr[13.0]     runtime cached certificates: 0
>> dirmngr[13.0]            trusted certificates: 129 (129,0,0,0)
>> dirmngr[13.0] failed to open cache dir file '/tmp/tmp.1u46BWZXep/crls.d/DIR.txt': No such file or directory
>> dirmngr[13.0] creating directory '/tmp/tmp.1u46BWZXep/crls.d'
>> dirmngr[13.0] new cache dir file '/tmp/tmp.1u46BWZXep/crls.d/DIR.txt' created
>> dirmngr[13.6] handler for fd 6 started
>> dirmngr[13.6] DBG: chan_6 -> # Home: /tmp/tmp.1u46BWZXep
>> dirmngr[13.6] DBG: chan_6 -> # Config: /tmp/tmp.1u46BWZXep/dirmngr.conf
>> dirmngr[13.6] DBG: chan_6 -> OK Dirmngr 2.5.23-beta6 at your service, process 13
>> dirmngr[13.6] connection from process 1 (0:0)
>> dirmngr[13.6] DBG: chan_6 <- GETINFO version
>> dirmngr[13.6] DBG: chan_6 -> D 2.5.23-beta6
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- OPTION http-proxy=http://172.28.0.2:3128
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- KEYSERVER --clear hkps://keyserver.ubuntu.com
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- KS_GET -- 0x1493269DE61F124AA69A316E3ADF34EBDBB200A4
>> dirmngr[13.6] DBG: dns: libdns initialized
>> dirmngr[13.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): Server indicated a failure
>> dirmngr[13.6] resolving 'keyserver.ubuntu.com' failed: Server indicated a failure
>> dirmngr[13.6] number of system provided CAs: 131
>> dirmngr[13.6] DBG: Using TLS library: GNUTLS 3.8.12
>> dirmngr[13.6] DBG: http.c:connect_server: trying name='172.28.0.2' port=3128
>> dirmngr[13.6] DBG: dns: resolve_dns_name(172.28.0.2): Success
>> dirmngr[13.6] DBG: http.c:2893:socket_new: object 0x000075ca0435dcb0 for fd 7 created
>> dirmngr[13.6] DBG: http.c:proxy:request:
>> dirmngr[13.6] DBG: >> CONNECT keyserver.ubuntu.com:443 HTTP/1.1\r\n
>> dirmngr[13.6] DBG: >> Host: keyserver.ubuntu.com:443\r\n
>> dirmngr[13.6] DBG: >> Connection: keep-alive\r\n
>> dirmngr[13.6] DBG: http.c:request-header:start_data:
>> dirmngr[13.6] DBG: network read: 39/8192
>> dirmngr[13.6] DBG: http.c:response:
>> dirmngr[13.6] DBG: >> HTTP/1.1 200 Connection established\r\n
>> dirmngr[13.6] http.c:RESP: ''
>> dirmngr[13.6] DBG: http.c:request:
>> dirmngr[13.6] DBG: >> GET /pks/lookup?op=get&options=mr&search=0x1493269DE61F124AA69A316E3ADF34EBDBB200A4 HTTP/1.0\r\n
>> dirmngr[13.6] DBG: >> Host: keyserver.ubuntu.com\r\n
>> dirmngr[13.6] DBG: http.c:request-header:start_data:
>> dirmngr[13.6] DBG: http.c:response:
>> dirmngr[13.6] DBG: >> HTTP/1.1 200 OK\r\n
>> dirmngr[13.6] http.c:RESP: 'Date: Fri, 11 Sep 2026 15:53:49 GMT'
>> dirmngr[13.6] http.c:RESP: 'Server: Hockeypuck/2.2'
>> dirmngr[13.6] http.c:RESP: 'Access-Control-Allow-Origin: *'
>> dirmngr[13.6] http.c:RESP: 'Content-Type: application/pgp-keys'
>> dirmngr[13.6] http.c:RESP: 'Content-Length: 948'
>> dirmngr[13.6] http.c:RESP: 'Connection: close'
>> dirmngr[13.6] http.c:RESP: ''
>> dirmngr[13.6] DBG: chan_6 -> S SOURCE https://keyserver.ubuntu.com:443
>> dirmngr[13.6] DBG: (948 bytes sent via D lines not shown)
>> dirmngr[13.6] DBG: chan_6 -> OK
>> dirmngr[13.6] DBG: chan_6 <- BYE
>> dirmngr[13.6] DBG: chan_6 -> OK closing connection
>> dirmngr[13.6] handler for fd 6 terminated
>>
>>
>> The command that was executed:
>>
>> gpg \
>>      --homedir "$work" \
>>      --batch \
>>      --keyserver hkps://keyserver.ubuntu.com \
>>      --keyserver-options "http-proxy=$http_proxy" \
>>      --recv-keys 1493269DE61F124AA69A316E3ADF34EBDBB200A4
>>
>> Where "$work" is a temporary directory and "http_proxy" is the proxy
>> server to connect to.
>> In a real world scenario, the proxy server will likely also have
>> authentication, but I skipped that in the demo to make it easier to follow.
>>
>> Obviously, they keyserver can be any URL and also the key to fetch.
>> Above are just two examples.
>>
>>
>> I've verified that issue exists in 2.4.5, 2.5.22 and on the master branch
>> (53ee642e2cc10b6a0bcb69c6d3f788deef2eac7a).
>>
>>
>> -- 
>>
>> Hope this covers all areas. If there is something that I'm missing, please
>> don't hesitate to request more details.
> 
> I've been able to see the index a few time over the past 2 weeks, but never
> any report about my issue mentioned above.
> 
> @Werner, do you have everything you need to create the bug report and
> submit my patch for it?
> 
> Kind regards,
> Torbjörn
> 
> 
> _______________________________________________
> Gnupg-devel mailing list
> Gnupg-devel at gnupg.org
> https://lists.gnupg.org/mailman/listinfo/gnupg-devel

More information about the Gnupg-devel mailing list