Consider changing keyserver to hkp://keyserver.ubuntu.com:80
Metadata
Current evaluation
Fixed by craft-archives PR #189 (commit daf89a2): key retrieval now retries via hkp://keyserver.ubuntu.com:80 with proxy handling. Downstream snapcraft PR #5670 merged.
Resolution: closed resolved
Reason: PR #189 was merged as commit daf89a2, adding the TCP/80 fallback for the default Ubuntu keyserver. The downstream snapcraft PR #5670 was also merged.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### What needs to get done
Message from Christopher Bartz in Hosted Runner chat:
```
its probably than an egress issue for runners on ps7, can you adapt your workflow to use port 80 , so e.g. --keyserver hkp://keyserver.ubuntu.com:80 instead of keyserver.ubuntu.com which goes via port 11371 that is blocked on ps7
```
Also see this port:
https://superuser.com/questions/620765/sudo-apt-key-adv-keyserver-keyserver-ubuntu-com-recv-7f0ceb10-command-return
### Why it needs to get done
Hosted runners on PS7 appears to block this port, and we have been observing intermittent CI failures because more and more tasks are hitting PS7 instances.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed by craft-archives PR #189 (commit daf89a2): key retrieval now retries via hkp://keyserver.ubuntu.com:80 with proxy handling. Downstream snapcraft PR #5670 merged. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by craft-archives PR #189 (commit daf89a2), adding a port-80 keyserver fallback and explicit HTTP proxy configuration. Downstream snapcraft PR #5670 was merged. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved by implementing a fallback to port 80 and explicitly configuring the HTTP proxy via --keyserver-options http-proxy to bypass PS7 runner port blocks and resolve gpg proxy timeout issues. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed after identifying GPG ignores proxy env vars. Resolution proposed to explicitly pass --keyserver-options http-proxy=value in the fallback case to handle PS7 egress restrictions. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved by implementing a port 80 fallback with explicit --keyserver-options http-proxy to bypass GPG default proxy handling, addressing PS7 runner connectivity issues and CI failures. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/craft-archives#189
(confidence 100%)
Merged commit daf89a2 implements the port-80 keyserver fallback and proxy handling.
-
Related To:
canonical/snapcraft#5670
(confidence 95%)
Merged downstream hotfix consuming the craft-archives change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #189 fix: retry key receiving on port TCP/80 if using default keyserver | craft-archives | merged | Merged in craft-archives#189 (daf89a2), adding a TCP/80 fallback for default HKP keyserver timeouts and removing obsolete apt-key-era work; fixes #165. | |
| #5716 Use hkps by default | snapcraft | open | Triaged documentation gap: explain that hkps://keyserver.ubuntu.com can work around GPG key-fetch failures on core22/core24; Snapcraft 8.12 inherits craft-archives PR #189's fallback. | |
| #5670 fix: hkp://keyserver.ubuntu.com:80 as default keyserver | snapcraft | merged | Merged PR #5670 changed the default GPG keyserver to hkp://keyserver.ubuntu.com:80, resolving proxy-related key retrieval failures tracked by #5635. | |
| #5635 Fail to run snapcraft using a proxy | snapcraft | closed | Proxy-related GPG key retrieval was fixed in craft-archives#189 (daf89a2) and adopted by snapcraft#5670; the reporter confirmed the failure no longer occurs. |