Sonarqube-scan-action fails to fetch public key from keyserver when https proxy is required

SonarQube Server / Community Build
1

When running the sonarqube-scan-action action in an environment where the only way out on the Internet is through a proxy server, the downloading of the public key for GPG verification fails.

I’ve reported the problem to the GPG maintainers in [PATCH GnuPG] dirmngr: Fix HKP keyserver access via HTTP proxy.

SonarQube server: 2026.4.1
sonarqube-scan-action: v7.2.0 or later

I can provide the error message if needed, but I think that the above should make it clear what is the problem.

2

I’ve opened Fix GPG key retrieval through HTTPS proxies by Torbjorn-Svensson · Pull Request #265 · SonarSource/sonarqube-scan-action · GitHub as a possible work around for the problem.

3

Hey @Torbjorn-Svensson, thanks for the deep dive into the issue! I will flag this for the team.

6

Hey @Torbjorn-Svensson,

Thanks for reaching out and thanks for the PR.

For me to understand your issue a bit better, do you have a workaround on your end or does this bug block you completely?

On the PR itself, principally the PR seems good. The new verifying logic seems a bit brittle to me, and as such, I’m hesitant merging it. That being said, I don’t really have a better solution. I’ll leave a separate review on the PR.

Best,
Sebastian Zumbrunn

7

Sorry for the late response.

The only solution that I have currently is to replace “gpg” on $PATH to be a script that would check the arguments and override to do the sequence that was put in the PR to the action.

Since that fix is even more hackish than fixing it in the action, I have, for now disable verification, but will as soon as there is a tag publicly available, switch to it and enable it again.

While I did the above PR, I noticed that the keyserver is not configurable from the workflows. Is this something you would like me to contribute or something that would be easier for your developers to handle internally? (just provide an option to the action.yml)

8

Hey @Torbjorn-Svensson,

Making the keyserver configurable isn’t currently on our roadmap. Is this something you need? If yes, what is your use case?

Regarding your current PR, it has been merged and I’m planning to create a release soon.

Best,
Sebastian Zumbrunn

10

Hey y’all,

@Torbjorn-Svensson’s PR has been merged and released as part of version v8.3.0 with the commit hash d209202bc7d53ff1cc128f7f907dac145c9d6ae9.

Best,
Sebastian Zumbrunn