[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Werner Koch]

On Thu,  8 Oct 2026 19:55, Torbjorn SVENSSON said:

> Also, not sure why round-robin would not work with a proxy server in
> the middle. The proxy server will still look up, at least, the A/AAAA
> record in order to know where to connect. What other type of

Many years ago we did it this way but it resulted in a lot of problems
becuase the DNS tells you an address but the server is down.  Thus you
need to wait until a timeout.  Thus the better approach is to do the
round-robin yourself.  This allows to mark dea servers and ignore them
and also to pick a random server.  There is a lot of code in dirmngr for
that and for Tor handling.  Adding another path is not easy but can be
done.

Your contstraints seem to be:

 - No DNS support for any client behind the proxy.
 - The proxy accepts only names and does the resolving itself.

As Steffen already mentioned we have SOCKS support which alloows for
that.  However, the Tor (browser or client) internal resolver is pretty
limited and thus we don't use that one.  What about this:

We allow to entirely disable DNS and in this case the whole keyserver
selection code is bypassed.  This may require a new option.

BTW, I had a brief look at your JS code and it seems that you configure
keyservers and option with gpg - this is deprecated.  All network
related configuraion belongs into dirmngr.conf.  An override --keyserver
when calling gpg is okay but everything else is dirmngr's
responsibility.


Salam-Shalom,

   Werner





-- 
The pioneers of a warless world are the youth that refuse military
service.  - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openpgp-digital-signature.asc
Type: application/pgp-signature
Size: 284 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20261009/ff0f91b4/attachment.sig>