Repository: freedomofpress/securedrop

Issue:
SecureDrop GUI updater fails due to keyserver timeout
## Description

The SecureDrop GUI updater is failing with the "Update failed. Please contact your SecureDrop administrator" message. Checking the detailed log, the failure is due to the call to retrieve the release signing key from the keyserver at hkps://hkps.pool.sks-keyservers.net timing out.

## Steps to Reproduce

On a Tails 3.12 Admin or Journalist stick:
 - set the code version to an earlier tag than the current release:
```
cd ~/Persistent/securedrop
git checkout 0.11.0
```
- Restart the Tor network connection (eg. by disconnecting and reconnecting the network connection)
- Wait for the GUI Updater to appear and click *Update Now*

## Expected Behavior

Update completes without error, user prompted for local admin password, tailsconfig phase completes without error.

## Actual Behavior

Update fails as described above

Please provide screenshots where appropriate.

## Comments

The `./securedrop-admin update` command works fine. Maybe pull the key in the same way in the GUI updater?

SecureDrop GUI updater fails due to keyserver timeout
## Description

The SecureDrop GUI updater is failing with the "Update failed. Please contact your SecureDrop administrator" message. Checking the detailed log, the failure is due to the call to retrieve the release signing key from the keyserver at hkps://hkps.pool.sks-keyservers.net timing out.

## Steps to Reproduce

On a Tails 3.12 Admin or Journalist stick:
 - set the code version to an earlier tag than the current release:
```
cd ~/Persistent/securedrop
git checkout 0.11.0
```
- Restart the Tor network connection (eg. by disconnecting and reconnecting the network connection)
- Wait for the GUI Updater to appear and click *Update Now*

## Expected Behavior

Update completes without error, user prompted for local admin password, tailsconfig phase completes without error.

## Actual Behavior

Update fails as described above

Please provide screenshots where appropriate.

## Comments

The `./securedrop-admin update` command works fine. Maybe pull the key in the same way in the GUI updater?



Discussion:
For 0.12.0, we will need to
- verify whether the graphical updater works _at all_ (i.e. intermittently or after repeated retries). If the graphical updater doesn't work at all but the CLI updater does, then that's unexpected and requires further investigation.
- at minimum, document the behavior in the release notes. 

Adding rotation of keyservers or other mitigation is a stretch goal for the release.
Too late to make changes like this for 0.12.0, moving into 0.12.1 milestone
I wanted to create an issue because of this. However, a close read of the logs revealed that gpg couldn't open a /dev/tty during the recv-keys event. When starting the GUI updater from a terminal is a workaround. Please pass --no-tty or --batch as an option as well, and test if this still happens.
For 0.12.0, we will need to
- verify whether the graphical updater works _at all_ (i.e. intermittently or after repeated retries). If the graphical updater doesn't work at all but the CLI updater does, then that's unexpected and requires further investigation.
- at minimum, document the behavior in the release notes. 

Adding rotation of keyservers or other mitigation is a stretch goal for the release.
Too late to make changes like this for 0.12.0, moving into 0.12.1 milestone
I wanted to create an issue because of this. However, a close read of the logs revealed that gpg couldn't open a /dev/tty during the recv-keys event. When starting the GUI updater from a terminal is a workaround. Please pass --no-tty or --batch as an option as well, and test if this still happens.

Resolving patch:
diff --git a/admin/securedrop_admin/__init__.py b/admin/securedrop_admin/__init__.py
--- a/admin/securedrop_admin/__init__.py
+++ b/admin/securedrop_admin/__init__.py
@@ -642,7 +642,8 @@ def check_for_updates(args):
 
 
 def get_release_key_from_keyserver(args, keyserver=None, timeout=45):
-    gpg_recv = ['timeout', str(timeout), 'gpg', '--recv-key']
+    gpg_recv = ['timeout', str(timeout), 'gpg', '--batch', '--no-tty',
+                '--recv-key']
     release_key = [RELEASE_KEY]
 
     # We construct the gpg --recv-key command based on optional keyserver arg.


Test patch: