[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Torbjorn SVENSSON]

Hi Andrew,

On 2026-10-08 19:39, Andrew Gallagher wrote:
> Hi, Torbjörn.
> 
> On 08/10/2026 16:11, Torbjorn SVENSSON wrote:
>> I understand that some proxy solutions might allow DNS lookup, but the scenario that I have does not.
> 
> Got it, thanks. Would it not be better then to have a separate option for this, rather than modifying the behaviour of all proxied clients whether they need it or not?. We could add heavy caveats to the documentation of this new option ("beware that SRV and round-robin will not work") so that the change in behaviour does not take anyone by surprise.

Sure, that could be done, but how would a user understand the difference between a proxy with local DNS lookup and a proxy that does the DNS lookup for the client?
Also, not sure why round-robin would not work with a proxy server in the middle. The proxy server will still look up, at least, the A/AAAA record in order to know where to connect. What other type of round-robin are you talking about?
If it's the explicit SRV record, then I suppose that will not be quivered...

Since there were no response from this list, I managed to avoid the urgency with this workaround:
https://github.com/SonarSource/sonarqube-scan-action/commit/6abe0a79df7d9decfbdd73f06e1a7cac404a8562#diff-c8da56253811b1775e3a73059d9b3caedb3c385029c8639c083b823dd0b47d8dR258
It's not pretty, but it avoids the failure in our CI at least.

Note, the current version of gpg is still not working in our dev. environment since those computers have the same restriction, i.e., they only have access to the internet via a proxy server. So even with the workaround for our CI, the pain is still real from this bug.

So, going back to your question; What would the option be named and how would a user be able to understand the difference?

Kind regards,
Torbjörn