Terraform - Downloading GPG Key step gets stuck

[DevSecNinja]

Hello,

Since a few days I notice that the GPG Key download step in the Terraform feature hangs:

=> [internal] load metadata for mcr.microsoft.com/devcontainers/base:j  608.5s
 => => extracting sha256:9a586f3d84de83b25cb9ca6d0e733d37d5283da35a837917  0.8s
 => => extracting sha256:5ac951de24f647413f348bfa4183b92c9962b167e0a3106d  0.3s
 => => extracting sha256:1aa90a4f5c993fd6d1e5f0885a1794ee59253ee8d35463ea  0.0s
 => => extracting sha256:074fbd7f2200028d96665f87580813cabf3361b85a4217ce  0.0s
 => => extracting sha256:ee36e8b50d1a0a2f6169666f26f3938fe1ea3efabfb6df01  0.0s
 => => extracting sha256:9e8c9f9ef24f45765c7592d55a952cbe2d0d4fefcd797237  5.5s
 => [dev_containers_feature_content_normalize 2/3] COPY --from=dev_contai  4.8s
 => [dev_containers_feature_content_normalize 3/3] RUN chmod -R 0700 /tmp  1.7s
 => [dev_containers_target_stage  2/12] COPY --from=dev_containers_featur  0.3s
 => [dev_containers_target_stage  3/12] RUN echo "_CONTAINER_USER_HOME=$(  0.7s
 => [dev_containers_target_stage  4/12] RUN cd /tmp/build-features/azure  61.0s
 => [dev_containers_target_stage  5/12] RUN cd /tmp/build-features/github  6.1s
 => [dev_containers_target_stage  6/12] RUN cd /tmp/build-features/kubec  51.5s
 => [dev_containers_target_stage  7/12] RUN cd /tmp/build-features/power  34.3s
 => [dev_containers_target_stage  8/12] RUN cd /tmp/build-features/terr  431.1s
 => => # Downloading terraform...
 => => # TERRAFORM_GPG_KEY=72D7468F
 => => # GPG_KEY_SERVERS=keyserver hkp://keyserver.ubuntu.com:80
 => => # keyserver hkps://keys.openpgp.org
 => => # keyserver hkp://keyserver.pgp.com
 => => # (*) Downloading GPG key...

Screenshot:

I have tried this on various systems/connections and it seems to consistently hang. As you can see, other features install fine.

Any idea how to fix this? Thanks!

[SoloW1ngPixy]

I have the same issue.
Close remote container on VSCode and choose to rebuild container seem to work, but not very convenient

[sarcasmboy]

I am having the same issue. Closing the remote container in VSCode and rebuilding the container did not solve my issue

[betancourtca]

Same issue with the Python feature getting stuck downloading PGP key

[sarcasmboy]

Here's some additional details. In addition, I have run in a vanilla ubuntu devcontainer without the terraform feature installed and it hangs when executing gpg --verbose --recv-keys 72D7468F which is what appears to be what is executed in the install.sh script during setup.

I've also tried building the devcontainer on multiple different internet connections and am able to visit keyserver.ubuntu.com, keys.openpgp.org, and keyserver.pgp.com in a browser, so I don't believe that it is an external network or routing issue

I am able to reliably reproduce the issues, so if there are any additional debug steps you'd like me to take, let me know.

System Information

Hardware
Processor	12th Gen Intel(R) Core(TM) i7-12700H   2.30 GHz
Installed RAM	32.0 GB (31.7 GB usable)

OS
System type	64-bit operating system, x64-based processor
Edition		Windows 11 Enterprise
Version		22H2
Installed on	‎12/‎4/‎2022
OS build	22621.819
Experience	Windows Feature Experience Pack 1000.22636.1000.0

Docker
Docker Desktop	4.15.0 (93002) 
Backend		WSL 2

devcontainer.json

// For format details, see https://aka.ms/devcontainer.json. For config options, see the
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
{
	"name": "Ubuntu",
	"image": "mcr.microsoft.com/devcontainers/base:jammy",
	"features": {
		"ghcr.io/devcontainers/features/terraform:1": {}
	}

	// Features to add to the dev container. More info: https://containers.dev/features.
	// "features": {},

	// Use 'forwardPorts' to make a list of ports inside the container available locally.
	// "forwardPorts": [],

	// Use 'postCreateCommand' to run commands after the container is created.
	// "postCreateCommand": "uname -a",

	// Configure tool-specific properties.
	// "customizations": {},

	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
	// "remoteUser": "root"
}

[samruddhikhandale]

I couldn't reproduce the issue with the dev config mentioned in #323 (comment) 😓 I've tried multiple times on a Windows and MacOS machine, every time the devcontainer is created/opened fine.

@sarcasmboy Could you provide me information on your Dev Container Extension version & VS Code version?

It is strange that in the original post, the container was able to download gpg keys for the github-cli Feature but couldn't for the terraform Feature 🤔

@joshspicer / @edgonmsft any thoughts on how to fix this? or could you reproduce?

[sarcasmboy]

vscode details

Version: 1.73.1 (user setup)
Commit: 6261075646f055b99068d3688932416f2346dd3b
Date: 2022-11-09T04:27:29.066Z
Electron: 19.0.17
Chromium: 102.0.5005.167
Node.js: 16.14.2
V8: 10.2.154.15-electron.0
OS: Windows_NT x64 10.0.22621
Sandboxed: No

code --list-extensions --show-versions

ms-vscode-remote.remote-containers@0.266.1
ms-vscode-remote.remote-ssh@0.92.0
ms-vscode-remote.remote-ssh-edit@0.84.0
ms-vscode.remote-explorer@0.0.3

[samruddhikhandale]

I have the same exact configuration. Still can't reproduce.

@sarcasmboy by any change do you have gpg installed on your machine?

I wonder if this could be an issue? 🤔
https://wiki.archlinux.org/title/GnuPG#gpg_hanged_for_all_keyservers_(when_trying_to_receive_keys)

[vnextcoder]

I have same issue. Below is devcontainer.json

and it stucks only at Terraform Stage.

{
	"build": {
		"dockerfile": "./Dockerfile",
		"context": "."
	},
	"features": {
		"ghcr.io/devcontainers/features/common-utils:1": {
			"installZsh": "true",
			"username": "vscode",
			"uid": "1000",
			"gid": "1000",
			"upgradePackages": "true"
		},
		"ghcr.io/devcontainers/features/git:1": {
			"version": "latest",
			"ppa": "false"
		},
		"ghcr.io/devcontainers/features/azure-cli:1": {
			"version": "latest"
		},
		"ghcr.io/devcontainers/features/terraform:1": {
			"version": "1.1.0",
			"tflint": "0.43.0",
			"tfgrunt": "0.42.3"
		}
	},
	"remoteUser": "vscode"
}

[sarcasmboy]

@samruddhikhandale I copied the install.sh script into my repository and ran it within a vanilla mcr.microsoft.com/devcontainers/base:jammy devcontainer. When I kill the dirmngr process during the hang, I see the script render an error and then retry until it gives up

output

TERRAFORM_VERSION=1.3.6
TFLINT_VERSION=0.43.0
TERRAGRUNT_VERSION=0.42.3
Downloading terraform...
TERRAFORM_GPG_KEY=72D7468F
GPG_KEY_SERVERS=keyserver hkp://keyserver.ubuntu.com:80
keyserver hkps://keys.openpgp.org
keyserver hkp://keyserver.pgp.com
(*) Downloading GPG key...
gpg: keyserver receive failed: End of file
(*) Failed getting key, retring in 10s...
(*) Downloading GPG key...
gpg: keyserver receive failed: End of file
(*) Failed getting key, retring in 10s...
(*) Downloading GPG key...
gpg: keyserver receive failed: End of file
(*) Failed getting key, retring in 10s...
(*) Downloading GPG key...
gpg: keyserver receive failed: End of file
(*) Failed getting key, retring in 10s...
(*) Downloading GPG key...
gpg: keyserver receive failed: End of file
(*) Failed getting key, retring in 10s...
(!) Failed to get gpg key.

[edgonmsft]

I've been trying to think here but without a repro not sure what the issue could be, does it maybe repro localy with Devcontainers extension?

[sarcasmboy]

@edgonmsft I'm not sure that I understand what you mean by "repro locally with Devcontainers extension". Could you elaborate?

[vnextcoder]

There are so many people able to reproduce this issue. Even running install.sh on plain vanilla container in interactive mode renders same error

[chrmarti]

The feature script succeeds for me. Using the key id gpg --verbose --recv-keys 72D7468F fails. Using the fingerprint from https://www.hashicorp.com/security gpg --verbose --recv-keys "C874 011F 0AB4 0511 0D02 1055 3436 5D94 72D7 468F" on the other hand succeeds.

Maybe something with the lookup on the key servers changed. E.g., https://keys.openpgp.org/search?q=72D7468F complains that "Search by Short Key ID is not supported.". Not sure why the feature script still succeeds.

[austindimmer]

I am observing a similar issue trying to install Python. I tried originally via Python install script which has worked for me for 1+ years. Yesterday/today the script started hanging at "Downloading GPG key..." so I migrated to use the feature instead and now I am observing that the Python feature is hanging at "Downloading GPG key..."

[samruddhikhandale]

@sarcasmboy Can you append --verbose flag to the install script in here? Wondering if that might provide error details.

( echo "${keys}" | xargs -n 1 gpg --verbose -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"