`gpg: keyserver receive failed: No keyserver available` since sks-keyservers.net no longer publishes DNS addresses

[gabegorelick]

Environment

• Platform: debian
• Docker Version: 20.10.6
• Node.js Version: 12, 14, 16
• Image Tag: n/a

Expected Behavior

Building image succeeds.

Current Behavior

Building fails due to failure to fetch GPG keys. The errors look like this:

gpg --batch --keyserver hkp://ipv4.pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
gpg: keyserver receive failed: No name

And then later on you get a gpg: keyserver receive failed: No keyserver available.

Some keys succeed if they're mirrored at pgp.mit.edu, but all keys that are only hosted on sks-keyservers.net will fail to download. https://sks-keyservers.net explains why:

Update 2021-06-21: Due to even more GDPR takedown requests, the DNS records for the pool will no longer be provided at all.

Possible Solution

• Use a specific keyserver directly instead of pool address
• Get Node releasers to permit their user IDs be hosted on keys.openpgp.org (otherwise the key can't be received by gpg)

Steps to Reproduce

docker build 16/buster-slim, but I assume this affects all Dockerfiles.

Additional Information

Fixing Nodejs release key distribution is tracked in nodejs/admin#456 and its linked issues.

[gabegorelick]

Also reported as #1499.

[karanpratapsingh]

Thank you for the context. Is there something we can do to help? Do you have an time estimate on the fix? @gabegorelick

[gabegorelick]

I'm not a maintainer, but to workaround this you can add a keyserver from https://sks-keyservers.net/status/ (pick whichever one works for you).

[tianon]

Looks like it's time to push harder for https://keys.openpgp.org/ among the Node release team? 😬

[nschonni]

Ping @nodejs/releasers

[tianon]

Another sane option would be to switch to a reasonably reliable single keyserver like keyserver.ubuntu.com

[targos]

FWIW I uploaded my key to https://keys.openpgp.org/

[karanpratapsingh]

These two seem to work for now @targos

      gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys "$key" || \
      gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" ; \

[gabegorelick]

Progress is finally being made on https://github.com/nodejs/release-keys. Seems like that can probably be used instead of a keyserver.