Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SecureDrop GUI updater fails due to keyserver timeout #4100

Closed
zenmonkeykstop opened this issue Feb 5, 2019 · 3 comments
Closed

SecureDrop GUI updater fails due to keyserver timeout #4100

zenmonkeykstop opened this issue Feb 5, 2019 · 3 comments
Milestone
0.12.1

Comments

@zenmonkeykstop
Copy link
Contributor

Description

The SecureDrop GUI updater is failing with the "Update failed. Please contact your SecureDrop administrator" message. Checking the detailed log, the failure is due to the call to retrieve the release signing key from the keyserver at hkps://hkps.pool.sks-keyservers.net timing out.

Steps to Reproduce

On a Tails 3.12 Admin or Journalist stick:

  • set the code version to an earlier tag than the current release:
cd ~/Persistent/securedrop
git checkout 0.11.0
  • Restart the Tor network connection (eg. by disconnecting and reconnecting the network connection)
  • Wait for the GUI Updater to appear and click Update Now

Expected Behavior

Update completes without error, user prompted for local admin password, tailsconfig phase completes without error.

Actual Behavior

Update fails as described above

Please provide screenshots where appropriate.

Comments

The ./securedrop-admin update command works fine. Maybe pull the key in the same way in the GUI updater?
@eloquence
Copy link
Member

For 0.12.0, we will need to

  • verify whether the graphical updater works at all (i.e. intermittently or after repeated retries). If the graphical updater doesn't work at all but the CLI updater does, then that's unexpected and requires further investigation.
  • at minimum, document the behavior in the release notes.

Adding rotation of keyservers or other mitigation is a stretch goal for the release.

@eloquence eloquence added this to the 0.12.0 milestone Feb 6, 2019
@eloquence eloquence mentioned this issue Feb 13, 2019
Closed
@redshiftzero
Copy link
Contributor

Too late to make changes like this for 0.12.0, moving into 0.12.1 milestone

@redshiftzero redshiftzero modified the milestones: 0.12.0, 0.12.1 Feb 19, 2019
@KwadroNaut
Copy link
Contributor

I wanted to create an issue because of this. However, a close read of the logs revealed that gpg couldn't open a /dev/tty during the recv-keys event. When starting the GUI updater from a terminal is a workaround. Please pass --no-tty or --batch as an option as well, and test if this still happens.

KwadroNaut pushed a commit to KwadroNaut/securedrop that referenced this issue Mar 6, 2019
resolves freedomofpress#4100
aee0823
@KwadroNaut KwadroNaut mentioned this issue Mar 6, 2019
Merged
2 tasks
KwadroNaut pushed a commit to KwadroNaut/securedrop that referenced this issue Mar 9, 2019
Resolves freedomofpress#4100
5042837 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.
KwadroNaut pushed a commit to KwadroNaut/securedrop that referenced this issue Mar 9, 2019
Resolves freedomofpress#4100
95ac980 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.
conorsch pushed a commit to KwadroNaut/securedrop that referenced this issue Mar 13, 2019
Resolves freedomofpress#4100
6143a17 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.
heartsucker pushed a commit that referenced this issue Mar 14, 2019
@heartsucker
Resolves #4100
7279086 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.
heartsucker pushed a commit that referenced this issue Mar 14, 2019
@heartsucker
Resolves #4100
664cf23 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.

(cherry picked from commit 6143a17)
emkll pushed a commit that referenced this issue Mar 14, 2019
@emkll
Resolves #4100
102bbbb 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.

(cherry picked from commit 6143a17)
emkll pushed a commit that referenced this issue Mar 14, 2019
@emkll
Resolves #4100
39640a9 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.

(cherry picked from commit 6143a17)
@zenmonkeykstop zenmonkeykstop mentioned this issue Mar 19, 2019
Closed
12 tasks
kushaldas pushed a commit that referenced this issue Sep 25, 2019
@kushaldas
Resolves #4100
fceb7e8 
you don't have an interactive prompt in the gui-updater, so you
shouldn't use a tty and --batch or --no-tty is meant for such tings.

--no-tty
     Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because
     GnuPG sometimes prints warnings to the TTY if if --batch is used.

--batch
Use batch mode.  Never ask, do not allow interactive commands.

The test, which uses a subshell, is looking for errors on the cli, this
should be changed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.12.1
Development

No branches or pull requests
4 participants
@KwadroNaut @eloquence @zenmonkeykstop @redshiftzero