← Back to issue list

Use hkps by default

View original Github issue

Metadata

Project
snapcraft
Number
#5716
Type
issue
State
open
Author
dilyn-corner
Labels
Status: Triaged Type: Documentation
Created
Updated
Closed
—

Current evaluation

Triaged documentation gap: explain that hkps://keyserver.ubuntu.com can work around GPG key-fetch failures on core22/core24; Snapcraft 8.12 inherits craft-archives PR #189's fallback.

Suggested action: keep open

Reason: Maintainer mr-cal explicitly called documentation a short-term improvement and confirmed the fallback will cover core22 and core24, but the workaround remains absent from Snapcraft's package-repository documentation. Changing the default is still under consideration for Snapcraft 9, while the observation about hkps and affected networks is not fully reproduced.

Evaluated by: mr-cal-bot

Impact: 42 Quick Win: 27 Complexity: 22 Confidence: 94 Actionability: 82

Issue body

https://github.com/canonical/snapcraft/blob/df4ec6775a28d4a345c93d9f83a1193c0abc1c9d/snapcraft_legacy/internal/repo/apt_key_manager.py#L148-L149 I think there are some circumstances where networks may fail to fetch a key unless `hkps://` is specified instead of the (presumed, usually working) `https://`. There's at least one observed instance where specifying the keyserver as `hkps://keyserver.ubuntu.com` instead of just `keyserver.ubuntu.com` resulted in a successful key fetch instead of the error being hit previously (something about "unable to fetch GPG key"). While technically hkps is served over port 443 like https, it's possible that some networking setups may not like this. This is largely speculation on my part, but from what I've seen it appears to be good practice to specify hkps. This may also impact craft-archives here https://github.com/canonical/craft-archives/blob/92c37a25d8efa7136223222d30043bf3e8d3fd12/craft_archives/repo/apt_key_manager.py#L301 I'm uncertain if this is better off as a code-change or a documentation update. It's probably easier in the documentation to explain that if a GPG key fetch error happens, specifying `key-server: hkps://keyserver.ubuntu.com` or the like may resolve the issue - @medubelko this kind of hits on https://github.com/canonical/craft-archives/issues/190, although some things may be hard-coded...

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 42
Quick Win: 27
Complexity: 22
Confidence: 94
Actionability: 82
keep open Triaged documentation gap: explain that hkps://keyserver.ubuntu.com can work around GPG key-fetch failures on core22/core24; Snapcraft 8.12 inherits craft-archives PR #189's fallback.
qwen/qwen3.6-35b-a3b
Impact: 35
Quick Win: 17
Complexity: 30
Confidence: 75
Actionability: 70
keep open Issue requesting hkps:// as default for GPG key fetching from keyserver.ubuntu.com. Maintainer acknowledged, suggested documentation update as short-term fix while considering code change for Snapcraft 9.
qwen/qwen3.8-27b
Impact: 35
Quick Win: 26
Staleness: 65
Complexity: 25
Confidence: 78
Support Request: 10
keep open Suggests hkps:// for GPG keyservers to fix fetch failures in some networks. Triaged as docs task; maintainer confirmed port-80 fallback exists (craft-archives #189), deferred default change to Snapcraft 9. No hkps docs or code added since.
qwen/qwen3.6-35b-a3b
Staleness: 45
Complexity: 15
Confidence: 90
Support Request: 10
keep open Suggests using hkps:// for GPG key fetching. Maintainer confirmed a code fix is in progress for Snapcraft 8.12/9 and recommended documentation updates as a short-term workaround. Awaiting documentation update.
qwen3.6-35b-a3b-mtp-q6
Staleness: 45
Complexity: 20
Confidence: 90
Support Request: 10
keep open Suggests using hkps:// for GPG key servers to avoid network fetch failures. Maintainer acknowledges a related PR addresses this for newer bases and suggests documentation as a short-term fix. Issue is triaged and under discussion.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/snapcraft#5635 (confidence 97%)

    A related GPG key-fetch/proxy failure was fixed upstream by craft-archives PR #189 and is documented in Snapcraft 8.11.2.

  • Likely Fixed By: canonical/craft-archives#189 (confidence 90%)

    mr-cal says its fallback is coming in Snapcraft 8.12 and answers the affected base-version question, though it does not fully resolve the proposal to default specifically to hkps.

Related issues

Issue Project State Summary Similarity
#165 Consider changing keyserver to hkp://keyserver.ubuntu.com:80 craft-archives closed Fixed by craft-archives PR #189 (commit daf89a2): key retrieval now retries via hkp://keyserver.ubuntu.com:80 with proxy handling. Downstream snapcraft PR #5670 merged.
75%