← Back to issue list

Use hkps by default

View original Github issue

Metadata

Project
snapcraft
Number
#5716
Type
issue
State
open
Author
dilyn-corner
Labels
Status: Triaged Type: Documentation
Created
Updated
Closed
—

Current evaluation

Suggests hkps:// for GPG keyservers to fix fetch failures in some networks. Triaged as docs task; maintainer confirmed port-80 fallback exists (craft-archives #189), deferred default change to Snapcraft 9. No hkps docs or code added since.

Suggested action: keep open

Reason: The issue is triaged (labels: Status: Triaged, Type: Documentation) and maintainer @mr-cal explicitly acknowledged it, stating 'Adding that to the documentation (perhaps a how-to) seems like a great short-term improvement' and confirming the port-80 fallback from craft-archives PR #189 covers core22/core24. A Jira ticket (SNAPCRAFT-1213) was created. Although inactive for ~12 months, the problem remains valid — no hkps references exist in either snapcraft or craft-archives code or docs — and the issue is clearly scoped as a documentation how-to, so it should stay open until addressed.

Impact: 35 Quick Win: 26.25 Staleness: 65 Complexity: 25 Confidence: 78 Support Request: 10

Issue body

https://github.com/canonical/snapcraft/blob/df4ec6775a28d4a345c93d9f83a1193c0abc1c9d/snapcraft_legacy/internal/repo/apt_key_manager.py#L148-L149 I think there are some circumstances where networks may fail to fetch a key unless `hkps://` is specified instead of the (presumed, usually working) `https://`. There's at least one observed instance where specifying the keyserver as `hkps://keyserver.ubuntu.com` instead of just `keyserver.ubuntu.com` resulted in a successful key fetch instead of the error being hit previously (something about "unable to fetch GPG key"). While technically hkps is served over port 443 like https, it's possible that some networking setups may not like this. This is largely speculation on my part, but from what I've seen it appears to be good practice to specify hkps. This may also impact craft-archives here https://github.com/canonical/craft-archives/blob/92c37a25d8efa7136223222d30043bf3e8d3fd12/craft_archives/repo/apt_key_manager.py#L301 I'm uncertain if this is better off as a code-change or a documentation update. It's probably easier in the documentation to explain that if a GPG key fetch error happens, specifying `key-server: hkps://keyserver.ubuntu.com` or the like may resolve the issue - @medubelko this kind of hits on https://github.com/canonical/craft-archives/issues/190, although some things may be hard-coded...

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 35
Quick Win: 26.25
Staleness: 65
Complexity: 25
Confidence: 78
Support Request: 10
keep open Suggests hkps:// for GPG keyservers to fix fetch failures in some networks. Triaged as docs task; maintainer confirmed port-80 fallback exists (craft-archives #189), deferred default change to Snapcraft 9. No hkps docs or code added since.
qwen/qwen3.6-35b-a3b
Staleness: 45
Complexity: 15
Confidence: 90
Support Request: 10
keep open Suggests using hkps:// for GPG key fetching. Maintainer confirmed a code fix is in progress for Snapcraft 8.12/9 and recommended documentation updates as a short-term workaround. Awaiting documentation update.
qwen3.6-35b-a3b-mtp-q6
Staleness: 45
Complexity: 20
Confidence: 90
Support Request: 10
keep open Suggests using hkps:// for GPG key servers to avoid network fetch failures. Maintainer acknowledges a related PR addresses this for newer bases and suggests documentation as a short-term fix. Issue is triaged and under discussion.
qwen3.6-35b-a3b-mtp-q6
Staleness: 65
Complexity: 20
Confidence: 85
Support Request: 10
keep open Proposes defaulting apt key servers to hkps:// to prevent fetch failures. Triaged and under discussion. Documentation updates are planned as a short-term workaround, with a code change targeted for Snapcraft 9.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/craft-archives#189 (confidence 75%)

    PR that added the hkp://keyserver.ubuntu.com:80 fallback on proxy errors; maintainer referenced it directly as the existing mechanism this issue builds on.

  • Related To: canonical/craft-archives#190 (confidence 40%)

    Reporter noted this issue 'hits on' craft-archives#190 (local GPG key docs), but that issue covers a different documentation gap (local keys vs. keyserver protocol).

Related issues

No related issues found above the similarity threshold.