[PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy

[Torbjorn SVENSSON]

On 2026-10-09 09:42, Werner Koch wrote:
> On Thu,  8 Oct 2026 19:55, Torbjorn SVENSSON said:
> 
>> Also, not sure why round-robin would not work with a proxy server in
>> the middle. The proxy server will still look up, at least, the A/AAAA
>> record in order to know where to connect. What other type of
> 
> Many years ago we did it this way but it resulted in a lot of problems
> becuase the DNS tells you an address but the server is down.  Thus you
> need to wait until a timeout.  Thus the better approach is to do the
> round-robin yourself.  This allows to mark dea servers and ignore them
> and also to pick a random server.  There is a lot of code in dirmngr for
> that and for Tor handling.  Adding another path is not easy but can be
> done.
> 
> Your contstraints seem to be:
> 
>   - No DNS support for any client behind the proxy.
>   - The proxy accepts only names and does the resolving itself.

The proxy accepts both names and IPs, but there is no means to lookup an
external domain to retrieve the IP.
Also, there is only http/https proxies available, no socks proxy!
> As Steffen already mentioned we have SOCKS support which alloows for
> that.  However, the Tor (browser or client) internal resolver is pretty
> limited and thus we don't use that one.  What about this:
> 
> We allow to entirely disable DNS and in this case the whole keyserver
> selection code is bypassed.  This may require a new option.

I guess one option would be to do what is done today, and if all DNS
lookup fails, then, in the proxy case, fall back to let the proxy do the
DNS lookup and hope it works better.
> BTW, I had a brief look at your JS code and it seems that you configure
> keyservers and option with gpg - this is deprecated.  All network
> related configuraion belongs into dirmngr.conf.  An override --keyserver
> when calling gpg is okay but everything else is dirmngr's
> responsibility.

It's not my JS code, I just patched the part that was not working in our CI.
The code is owned by Sonar Source (https://www.sonarsource.com/).

Kind regards,
Torbjörn