[Bug] - `gpg` is not working

[herrsergio]

Describe the bug
Using Amazon Linux 2022 latest Docker image, cannot get a key using gpg from a keyserver.

To Reproduce
Steps to reproduce the behavior:

1. docker run -t -i --rm -u 0 public.ecr.aws/amazonlinux/amazonlinux:2022 bash
2. gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
3. The following error appears:

gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: keyserver receive failed: No dirmngr

4. Tried to install dirmngr package:

Amazon Linux 2022 repository                                                                                                                          16 MB/s |  10 MB     00:00
Last metadata expiration check: 0:00:03 ago on Wed Nov 30 23:22:16 2022.
Error:
 Problem: problem with installed package gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64
  - package gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64 conflicts with gnupg2 provided by gnupg2-2.3.7-1.amzn2022.0.2.x86_64
  - conflicting requests
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)

5. Installed it with: yum install dirmngr --allowerasing,

Details of packages installation

Dependencies resolved.
=====================================================================================================================================================================================
 Package                                       Architecture                      Version                                                Repository                              Size
=====================================================================================================================================================================================
Installing:
 gnupg2                                        x86_64                            2.3.7-1.amzn2022.0.2                                   amazonlinux                            2.5 M
Installing dependencies:
 cracklib                                      x86_64                            2.9.6-27.amzn2022.0.1                                  amazonlinux                             82 k
 cyrus-sasl-lib                                x86_64                            2.1.27-18.amzn2022.0.1                                 amazonlinux                            786 k
 dbus                                          x86_64                            1:1.12.20-3.amzn2022.0.1                               amazonlinux                            7.9 k
 dbus-broker                                   x86_64                            29-2.amzn2022.0.1                                      amazonlinux                            173 k
 dbus-common                                   noarch                            1:1.12.20-3.amzn2022.0.1                               amazonlinux                             15 k
 device-mapper                                 x86_64                            1.02.185-1.amzn2022.0.3                                amazonlinux                            140 k
 device-mapper-libs                            x86_64                            1.02.185-1.amzn2022.0.3                                amazonlinux                            181 k
 gnutls                                        x86_64                            3.7.7-356.amzn2022.0.1                                 amazonlinux                            1.1 M
 gzip                                          x86_64                            1.10-5.amzn2022.0.1                                    amazonlinux                            152 k
 kmod-libs                                     x86_64                            29-2.amzn2022.0.4                                      amazonlinux                             62 k
 libargon2                                     x86_64                            20171227-9.amzn2022.0.1                                amazonlinux                             29 k
 libdb                                         x86_64                            5.3.28-49.amzn2022.0.1                                 amazonlinux                            757 k
 libeconf                                      x86_64                            0.4.0-1.amzn2022.0.1                                   amazonlinux                             28 k
 libfdisk                                      x86_64                            2.37.4-1.amzn2022.0.2                                  amazonlinux                            155 k
 libksba                                       x86_64                            1.6.0-1.amzn2022.0.1                                   amazonlinux                            157 k
 libpwquality                                  x86_64                            1.4.4-6.amzn2022.0.1                                   amazonlinux                            106 k
 libseccomp                                    x86_64                            2.5.3-1.amzn2022.0.1                                   amazonlinux                             71 k
 libsecret                                     x86_64                            0.20.4-2.amzn2022.0.1                                  amazonlinux                            158 k
 libsemanage                                   x86_64                            3.4-5.amzn2022.0.1                                     amazonlinux                            121 k
 libusbx                                       x86_64                            1.0.24-2.amzn2022.0.1                                  amazonlinux                             73 k
 libutempter                                   x86_64                            1.2.1-4.amzn2022.0.1                                   amazonlinux                             26 k
 nettle                                        x86_64                            3.8-1.amzn2022.0.1                                     amazonlinux                            417 k
 openldap                                      x86_64                            2.4.57-6.amzn2022.0.2                                  amazonlinux                            257 k
 pam                                           x86_64                            1.5.1-8.amzn2022.0.2                                   amazonlinux                            544 k
 pcsc-lite                                     x86_64                            1.9.1-1.amzn2022.0.2                                   amazonlinux                             92 k
 pcsc-lite-libs                                x86_64                            1.9.1-1.amzn2022.0.2                                   amazonlinux                             28 k
 polkit                                        x86_64                            0.117-10.amzn2022.0.2                                  amazonlinux                            146 k
 polkit-libs                                   x86_64                            0.117-10.amzn2022.0.2                                  amazonlinux                            8.3 M
 polkit-pkla-compat                            x86_64                            0.1-19.amzn2022.0.1                                    amazonlinux                             45 k
 shadow-utils                                  x86_64                            2:4.8.1-9.amzn2022.0.1                                 amazonlinux                            1.1 M
 systemd                                       x86_64                            250.8-1.amzn2022.0.3                                   amazonlinux                            4.2 M
 systemd-libs                                  x86_64                            250.8-1.amzn2022.0.3                                   amazonlinux                            614 k
 systemd-pam                                   x86_64                            250.8-1.amzn2022.0.3                                   amazonlinux                            333 k
 util-linux                                    x86_64                            2.37.4-1.amzn2022.0.2                                  amazonlinux                            2.2 M
 util-linux-core                               x86_64                            2.37.4-1.amzn2022.0.2                                  amazonlinux                            434 k
 xkeyboard-config                              noarch                            2.33-1.amzn2022                                        amazonlinux                            784 k
Installing weak dependencies:
 cryptsetup-libs                               x86_64                            2.4.3-2.amzn2022.0.1                                   amazonlinux                            433 k
 diffutils                                     x86_64                            3.8-1.amzn2022.0.1                                     amazonlinux                            403 k
 gnupg2-smime                                  x86_64                            2.3.7-1.amzn2022.0.2                                   amazonlinux                            250 k
 kernel-libbpf                                 x86_64                            5.15.73-45.135.amzn2022                                amazonlinux                            155 k
 libxkbcommon                                  x86_64                            1.3.0-1.amzn2022.0.1                                   amazonlinux                            141 k
 pcsc-lite-ccid                                x86_64                            1.4.34-1.amzn2022.0.2                                  amazonlinux                            300 k
 pinentry                                      x86_64                            1.2.0-1.amzn2022.0.4                                   amazonlinux                             99 k
 qrencode-libs                                 x86_64                            4.1.1-2.amzn2022.0.1                                   amazonlinux                             66 k
 systemd-networkd                              x86_64                            250.8-1.amzn2022.0.3                                   amazonlinux                            612 k
 systemd-resolved                              x86_64                            250.8-1.amzn2022.0.3                                   amazonlinux                            277 k
Removing dependent packages:
 gnupg2-minimal                                x86_64                            2.3.7-1.amzn2022.0.2                                   @System                                917 k

Transaction Summary
=====================================================================================================================================================================================
Install  47 Packages
Remove    1 Package

Total download size: 29 M
Is this ok [y/N]: y

6. Tried to get the key, but there is a connection timed out

bash-5.1# gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg: no running dirmngr - starting '/usr/bin/dirmngr'
gpg: waiting for the dirmngr to come up ... (5s)
gpg: connection to the dirmngr established
gpg: keyserver receive failed: Connection timed out
bash-5.1#

Expected behavior

bash-4.2# gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: requesting key A1AB005C from hkps server keyserver.ubuntu.com
Comment: Hostname:
gpg: armor header:
Version: Hockeypuck 2.1.0-184-g50f1108
gpg: armor header:
gpg: pub  2048R/A1AB005C 2018-03-26  Beth Griggs <bgriggs@redhat.com>
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: using PGP trust model
gpg: key A1AB005C: public key "Beth Griggs <bgriggs@redhat.com>" imported
gpg: 1 keys cached (12 signatures)
gpg: 0 keys processed (0 validity counts cleared)
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

[pluralistix]

docker run amazonlinux:2022 bash -c 'dnf install -y --allowerasing gnupg2 >/dev/null 2>&1; gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C'
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: no running dirmngr - starting '/usr/bin/dirmngr'
gpg: waiting for the dirmngr to come up ... (5s)
gpg: connection to the dirmngr established
gpg: data source: https://162.213.33.9:443
gpg: armor header: Comment: Hostname:
gpg: armor header: Version: Hockeypuck 2.1.0-184-g50f1108
gpg: key D7062848A1AB005C: number of dropped non-self-signatures: 2
gpg: pub  rsa2048/D7062848A1AB005C 2018-03-26  Beth Griggs <bgriggs@redhat.com>
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bgriggs@redhat.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bgriggs@redhat.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: using pgp trust model
gpg: key D7062848A1AB005C: public key "Beth Griggs <bgriggs@redhat.com>" imported
gpg: no running gpg-agent - starting '/usr/bin/gpg-agent'
gpg: waiting for the agent to come up ... (5s)
gpg: connection to the agent established
gpg: Total number processed: 1
gpg:               imported: 1

Please see https://github.com/amazonlinux/amazon-linux-2022/blob/main/Release-Notes-Amazon-Linux-2022.0.20220719.0.md#major-updates

Just seeing, that you basicly did that with install dirmngr --allowerasing... Hmmm

Is the connection timed out always reproducible?

[herrsergio]

@pluralistix it always times out. I've even changed the server but with the same results.

Using latest from amazonlinux works, but not for amazonlinux:2022, in the same host.

# docker run -t -i --rm -u 0 public.ecr.aws/amazonlinux/amazonlinux bash

Unable to find image 'public.ecr.aws/amazonlinux/amazonlinux:latest' locally
latest: Pulling from amazonlinux/amazonlinux
68028ec3b506: Pull complete
Digest: sha256:f4b5d60ba75876e8a8b02618fd0de3ab796eb210ab37075adf56eab38ec8c3bf
Status: Downloaded newer image for public.ecr.aws/amazonlinux/amazonlinux:latest

# gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: requesting key A1AB005C from hkps server keyserver.ubuntu.com
Version: Hockeypuck 2.1.0-184-g50f1108
gpg: armor header:
Comment: Hostname:
gpg: armor header:
gpg: pub  2048R/A1AB005C 2018-03-26  Beth Griggs <bgriggs@redhat.com>
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: using PGP trust model
gpg: key A1AB005C: public key "Beth Griggs <bgriggs@redhat.com>" imported
gpg: 1 keys cached (12 signatures)
gpg: 0 keys processed (0 validity counts cleared)
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

[stewartsmith]

From the release notes:

The default gnupg is a minimal one, which is limited in functionality, but has the minimal code needed to GPG verify RPMs, and brings a minimal number of packages into AMIs and container images. If you need full gnupg functionality, you can get the full gnupg by running dnf install --allowerasing gnupg2-full

Does running that fix your issue?

[herrsergio]

That doesn't fix the issue.

…

On Tue, Dec 6, 2022, 2:44 AM Stewart Smith ***@***.***> wrote: From the release notes: The default gnupg is a minimal one, which is limited in functionality, but has the minimal code needed to GPG verify RPMs, and brings a minimal number of packages into AMIs and container images. If you need full gnupg functionality, you can get the full gnupg by running dnf install --allowerasing gnupg2-full Does running that fix your issue? — Reply to this email directly, view it on GitHub <#243 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADD46ORRSNXWUQWI3LIFPDWL34G5ANCNFSM6AAAAAASQFXJ5Y> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[stewartsmith]

Hrrm.... this appears to work for me on the latest images:

$ sudo dnf install --allowerasing gnupg2-full
Last metadata expiration check: 0:45:22 ago on Fri Feb 24 00:22:27 2023.
Dependencies resolved.
==================================================================================================================================================
 Package                             Architecture                Version                                   Repository                        Size
==================================================================================================================================================
Installing:
 gnupg2                              x86_64                      2.3.7-1.amzn2022.0.2                      amazonlinux                      2.5 M
Installing dependencies:
 libksba                             x86_64                      1.6.2-1.amzn2022.0.1                      amazonlinux                      159 k
Removing dependent packages:
 gnupg2-minimal                      x86_64                      2.3.7-1.amzn2022.0.2                      @System                          917 k

Transaction Summary
==================================================================================================================================================
Install  2 Packages
Remove   1 Package

Total download size: 2.7 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): libksba-1.6.2-1.amzn2022.0.1.x86_64.rpm                                                                    1.4 MB/s | 159 kB     00:00
(2/2): gnupg2-2.3.7-1.amzn2022.0.2.x86_64.rpm                                                                     8.2 MB/s | 2.5 MB     00:00
--------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                             4.7 MB/s | 2.7 MB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                          1/1
  Installing       : libksba-1.6.2-1.amzn2022.0.1.x86_64                                                                                      1/3
  Installing       : gnupg2-2.3.7-1.amzn2022.0.2.x86_64                                                                                       2/3
  Erasing          : gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64                                                                               3/3
  Running scriptlet: gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64                                                                               3/3
  Verifying        : libksba-1.6.2-1.amzn2022.0.1.x86_64                                                                                      1/3
  Verifying        : gnupg2-2.3.7-1.amzn2022.0.2.x86_64                                                                                       2/3
  Verifying        : gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64                                                                               3/3

Installed:
  gnupg2-2.3.7-1.amzn2022.0.2.x86_64                                      libksba-1.6.2-1.amzn2022.0.1.x86_64
Removed:
  gnupg2-minimal-2.3.7-1.amzn2022.0.2.x86_64

Complete!
$ gpg -v --keyserver hkps://keyserver.ubuntu.com --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg: directory '/home/ec2-user/.gnupg' created
gpg: keybox '/home/ec2-user/.gnupg/pubring.kbx' created
gpg: no running dirmngr - starting '/usr/bin/dirmngr'
gpg: waiting for the dirmngr to come up ... (5s)
gpg: connection to the dirmngr established
gpg: data source: https://162.213.33.9:443
gpg: armor header: Comment: Hostname:
gpg: armor header: Version: Hockeypuck 2.1.0-189-g15ebf24
gpg: key D7062848A1AB005C: number of dropped non-self-signatures: 2
gpg: pub  rsa2048/D7062848A1AB005C 2018-03-26  Beth Griggs <bgriggs@redhat.com>
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bgriggs@redhat.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bgriggs@redhat.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bgriggs@redhat.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <bethanyngriggs@gmail.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: removing signature from key D7062848A1AB005C on user ID "Beth Griggs <Bethany.Griggs@uk.ibm.com>": signature superseded
gpg: /home/ec2-user/.gnupg/trustdb.gpg: trustdb created
gpg: using pgp trust model
gpg: key D7062848A1AB005C: public key "Beth Griggs <bgriggs@redhat.com>" imported
gpg: no running gpg-agent - starting '/usr/bin/gpg-agent'
gpg: waiting for the agent to come up ... (5s)
gpg: connection to the agent established
gpg: Total number processed: 1
gpg:               imported: 1
$ rpm -q system-release
system-release-2022.0.20230118-0.amzn2022.noarch

Please reopen if still seeing the problem.

[ozbenh]

Or the new cleaner way: sudo dnf swap gnupg2-minimal gnupg2-full :-)