archlinux: fix: NO_PROXY=127.0.0.1#189
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #189 +/- ##
==========================================
+ Coverage 74.69% 74.88% +0.18%
==========================================
Files 51 51
Lines 5865 5945 +80
==========================================
+ Hits 4381 4452 +71
- Misses 1484 1493 +9 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| # Update archlinux keyring first so that Archlinux can be updated even after a long time | ||
| chroot_cmd /bin/sh -c \ | ||
| "http_proxy='${REPO_PROXY}' pacman -Sy --noconfirm --noprogressbar archlinux-keyring" | ||
| "no_proxy='${NO_PROXY}' http_proxy='${REPO_PROXY}' pacman -Sy --noconfirm --noprogressbar archlinux-keyring" |
There was a problem hiding this comment.
What this no_proxy variable is for, and where NO_PROXY is set? If NO_PROXY is set already, that should be good enough for pacman (at least when it uses curl) already, no?
There was a problem hiding this comment.
By default, it's not set to anything, meaning all connections (including 127.0.0.1, localhost, ::1), will be passed over it.
It's even more non-standard and inconsistently interpreted vs http_proxy/https_proxy/all_proxy. For example, AFAIK there is no way to configure this for PackageKit at all while pacman respects no_proxy (via libcurl, the same way it gets http_proxy).
https://about.gitlab.com/blog/2021/01/27/we-need-to-talk-no-proxy
As this script is often run in a dispvm or container, overriding it can be non-trivial (why else is REPO_PROXY here at all? ;)). I figure setting this sane default while allowing the manual override would make sense?
Is there any use-case for proxying localhost connections? Currently the Qubes proxy is configured to 403 any attempts at doing that.
There was a problem hiding this comment.
why else is
REPO_PROXYhere at all? ;))
It's almost set here: https://github.com/QubesOS/qubes-builderv2/blob/main/qubesbuilder/plugins/build_archlinux/__init__.py#L142
There was a problem hiding this comment.
FWIW, forcing it to use my local apt-cacher-ng works by modifying that, save for the issue resolved by this patch, and still getting spurious 503 mentioned in #188 when running cold.
There was a problem hiding this comment.
But still, something needs to set NO_PROXY, no?
There was a problem hiding this comment.
I guess at this stage it's left as "excercise for the reader" here.. If you need it, at least it's one less package you'll have to patch. (If I understood the question right?)
There was a problem hiding this comment.
I mean, why not set it by default to 127.0.0.1 like in the other place?
There was a problem hiding this comment.
Ah, right, sure, I don't see why not. It even aligns better with PR description 😅 Pushed!
otherwise requests to repos on localhost will be passed via the proxy, which we generally don't want.
73a0daa to
f539987
Compare
|
PipelineRetry |
2 participants
otherwise requests to repos on localhost will be passed via the proxy, which we generally don't want.
Related: