Bug 649642

Summary:	app-portage/gemato-11.2 does not honour http_proxy
Product:	Gentoo Linux	Reporter:	Patrik Osgnach <patrik.osgnach>
Component:	Current packages	Assignee:	Michał Górny <mgorny>
Status:	RESOLVED FIXED
Severity:	normal	CC:	dev-portage, esigra, expert-judiciaire
Priority:	Normal
Version:	unspecified
Hardware:	AMD64
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=657776 https://bugs.gentoo.org/show_bug.cgi?id=659746 https://bugs.gentoo.org/show_bug.cgi?id=661376
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	650144, 912589
Attachments:	emerge --info

Description Patrik Osgnach 2018-03-05 13:13:50 UTC

Portage is not refreshing the gpg keys from keyserver.
I have the http_proxy env var set to my current proxy server.
In my ~/.gnupg/gpg.conf I have this line:

keyserver-options http-proxy="http://proxy-server.mydomain.com:911"

but when I do a sync, I have this output:

INFO:root:Refreshing keys from keyserver...
ERROR:root:OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: Connection timed out

If I look at the processes running during the key refresh step, I see:

root      4000  /usr/bin/python2.7 /usr/lib/python-exec/python2.7/gemato verify -s /usr/portage -K /var/lib/gentoo/gkeys/keyrings/gentoo/release/pubring.gpg
root      4006  gpg-agent --homedir /tmp/tmpj8hA7p --use-standard-socket --daemon
root      4012  gpg2 --batch --refresh-keys

And in that homedir, there is a gpg.conf file but it lacks the keyserver-options parameter.

As a workaround, I added the keyserver-options statement in /usr/lib/python2.7/site-packages/gemato/openpgp.py after line 119

Reproducible: Always

Steps to Reproduce:
1. set http_proxy
2. add keyserver-options statement to ~/.gnupg/gpg.conf
3. emerge --sync
Actual Results:  
INFO:root:Refreshing keys from keyserver...
ERROR:root:OpenPGP keyring refresh failed:
gpg: refreshing 4 keys from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: Connection timed ou

Expected Results:  
INFO:root:Refreshing keys from keyserver...
INFO:root:Keys refreshed.
INFO:root:Manifest timestamp: 2018-03-04 19:38:27 UTC
INFO:root:Valid OpenPGP signature found:
INFO:root:- primary key: DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
INFO:root:- subkey: E1D6ABB63BFCFB4BA02FDF1CEC590EEAC9189250
INFO:root:- timestamp: 2018-03-04 19:38:27 UTC
INFO:root:Verifying /usr/portage...
INFO:root:/usr/portage verified in 14.63 seconds

Comment 1 Patrik Osgnach 2018-03-05 13:15:34 UTC

Created attachment 522450 [details]
emerge --info

Comment 2 Patrik Osgnach 2018-03-15 11:04:49 UTC

app-portage/gemato-12.0 behaves the same

Comment 3 Michał Górny archtester

2018-03-16 07:43:14 UTC

Have you tried setting the customary http_proxy in environment? I have no clue if GnuPG respects that or requires setting everything manually.

Comment 4 Patrik Osgnach 2018-03-16 08:50:30 UTC

Yes, the http_proxy environment variable is always set (also in make.conf) otherwise, I cannot get on the internet.

dirmngr's man page says there is a --honor-http-proxy parameter which makes it follow the http_proxy env var. If no such parameter is used then dirmngr will ignore the proxy settings.

Comment 5 Michał Górny archtester

2018-03-16 08:52:51 UTC

Thanks. So the remaining question is: if gpg doesn't use proxy by default, should gemato override that or should we require users to enable it via /etc.

Comment 6 Patrik Osgnach 2018-03-16 09:01:09 UTC

The user sets the proxy through the environment variable http_proxy and she expects it to be followed. app-crypt/gnupg, on the other hand, does not want to play nice and must be told to follow the environment settings. wget honours http_proxy and rsync honours RSYNC_PROXY, therefore it is not even necessary to set your proxy in make.conf, unless you want to use a different proxy just for portage business.

app-portage/gemato should always write "--honor-http-proxy" in gpg.conf while now it writes only "trust-model always"

Comment 7 Michał Górny archtester

2018-03-16 09:17:05 UTC

That's my thought as well. Want to take credit and submit a PR, or should I just add it?

Comment 8 Michał Górny archtester

2018-03-16 09:17:19 UTC

(against gemato)

Comment 9 Patrik Osgnach 2018-03-16 10:25:40 UTC

Thanks, but I have no clue about how to do that. You do that, please. Just mention my name and I am fine

Comment 10 Michał Górny archtester

2018-03-16 11:47:51 UTC

Now in git. I'll wrap up a release once CI finishes.

Comment 11 Larry the Git Cow gentoo-dev

2018-03-16 13:32:07 UTC

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0fbd2e498a58d3f513c1c02cfad18782d6f230d1

commit 0fbd2e498a58d3f513c1c02cfad18782d6f230d1
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2018-03-16 13:14:57 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2018-03-16 13:31:53 +0000

    app-portage/gemato: Bump to 12.1
    
    Bump to new 12.1 version. Includes mostly a fix to respect http_proxy.
    
    Closes: https://bugs.gentoo.org/649642

 app-portage/gemato/Manifest           |  1 +
 app-portage/gemato/gemato-12.1.ebuild | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

Comment 12 Pierre-Yves Bonnetain-Nesterenko 2023-05-17 15:49:52 UTC

*** Bug 659746 has been marked as a duplicate of this bug. ***