GPG key not found

[andyneff]

@MaxBazik and I were just rebuilding dockers today got a GPG failure for gosu. It looks like the keyserver might down.

Steps to reproduce

1. docker run -it --rm centos:7
2. gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4

Erroneous results

gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: requesting key BF357DD4 from hkp server ha.pool.sks-keyservers.net
gpgkeys: key B42F6819007F00F88E364FD4036A9C25BF357DD4 can't be retrieved
gpg: no valid OpenPGP data found.

Expected Results

[root@gpg_error /]# gpg --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4gpg: requesting key BF357DD4 from hkp server keys.gnupg.net
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key BF357DD4: public key "Tianon Gravi <tianon@tianon.xyz>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

[andyneff]

Update: It's working intermittently...

[tianon]

Yeah, the keyservers occasionally have issues. One method of overcoming this that I've seen be particularly successful is to try several explicit servers in sequence, ala:

for server in 
	ha.pool.sks-keyservers.net \
	hkp://p80.pool.sks-keyservers.net:80 \
	keyserver.ubuntu.com \
	hkp://keyserver.ubuntu.com:80 \
	pgp.mit.edu \
; do
	if gpg --keyserver "$server" --recv-keys "$key"; then
		exit 0
	fi
done
exit 1

Since this isn't really an issue with gosu itself, I'm going to close. 👍 (Hopefully that gives you something you can work with to help mitigate?)

[andyneff]

Thanks tianon!

For posterity, this is what my Docker RUN command looks like now

ENV GOSU_VERSION 1.10
RUN set -x && \
    curl -Lo /usr/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" && \
    curl -Lo /tmp/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64.asc" && \
    export GNUPGHOME="$(mktemp -d)" && \
    for server in $(shuf -e ha.pool.sks-keyservers.net \
                            hkp://p80.pool.sks-keyservers.net:80 \
                            keyserver.ubuntu.com \
                            hkp://keyserver.ubuntu.com:80 \
                            pgp.mit.edu) ; do \
        gpg --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
    done && \
    gpg --batch --verify /tmp/gosu.asc /usr/bin/gosu && \
    rm -r "$GNUPGHOME" /tmp/gosu.asc && \
    chmod +x /usr/bin/gosu && \
    # Allow user to become root
    #chmod u+s /usr/bin/gosu && \
    gosu nobody true

[mrodriguezrPSL]

GPG key B42F6819007F00F88E364FD4036A9C25BF357DD4 not found on ha.pool.sks-keyservers.net

[tianon]

See https://github.com/tianon/pgp-happy-eyeballs for how I combat this problem these days.