{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/3009","repository_url":"https://api.github.com/repos/coreos/rkt","labels_url":"https://api.github.com/repos/coreos/rkt/issues/3009/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/3009/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/3009/events","html_url":"https://github.com/coreos/rkt/issues/3009","id":168470712,"number":3009,"title":"rkt trust: dial tcp: i/o timeout error","user":{"login":"0xAX","id":2699235,"avatar_url":"https://avatars.githubusercontent.com/u/2699235?v=3","gravatar_id":"","url":"https://api.github.com/users/0xAX","html_url":"https://github.com/0xAX","followers_url":"https://api.github.com/users/0xAX/followers","following_url":"https://api.github.com/users/0xAX/following{/other_user}","gists_url":"https://api.github.com/users/0xAX/gists{/gist_id}","starred_url":"https://api.github.com/users/0xAX/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0xAX/subscriptions","organizations_url":"https://api.github.com/users/0xAX/orgs","repos_url":"https://api.github.com/users/0xAX/repos","events_url":"https://api.github.com/users/0xAX/events{/privacy}","received_events_url":"https://api.github.com/users/0xAX/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-07-30T14:45:18Z","updated_at":"2016-08-02T09:47:34Z","closed_at":"2016-08-02T09:35:58Z","body":"Hello,\r\n\r\n**Environment**\r\n\r\n```\r\nrkt Version: 1.11.0+git57bb218\r\nappc Version: 0.8.5\r\nGo Version: devel +ca8b627 Sun, 1 May 2016 06:29:57 +0000\r\nGo OS/Arch: linux/amd64\r\nFeatures: +TPM +SDJOURNAL\r\n--\r\nLinux 4.7.0-rc7+ x86_64\r\n--\r\nNAME=Fedora\r\nVERSION=\"24 (Workstation Edition)\"\r\nID=fedora\r\nVERSION_ID=24\r\nPRETTY_NAME=\"Fedora 24 (Workstation Edition)\"\r\nANSI_COLOR=\"0;34\"\r\nCPE_NAME=\"cpe:/o:fedoraproject:fedora:24\"\r\nHOME_URL=\"https://fedoraproject.org/\"\r\nBUG_REPORT_URL=\"https://bugzilla.redhat.com/\"\r\nREDHAT_BUGZILLA_PRODUCT=\"Fedora\"\r\nREDHAT_BUGZILLA_PRODUCT_VERSION=24\r\nREDHAT_SUPPORT_PRODUCT=\"Fedora\"\r\nREDHAT_SUPPORT_PRODUCT_VERSION=24\r\nPRIVACY_POLICY_URL=https://fedoraproject.org/wiki/Legal:PrivacyPolicy\r\nVARIANT=\"Workstation Edition\"\r\nVARIANT_ID=workstation\r\n--\r\nsystemd 229\r\n+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN\r\n```\r\n\r\n**What did you do?**\r\n\r\nI'm trying to add trusted key as it described in the [documentation](https://coreos.com/rkt/docs/latest/subcommands/trust.html):\r\n\r\n```\r\nsudo build-rkt-1.11.0+git/target/bin/rkt --debug trust --prefix=coreos.com/etcd\r\n```\r\n\r\n**What did you expect to see?**\r\n\r\nExpected result is downloaded key.\r\n\r\n**What did you see instead?**\r\n\r\nInstead, I see following error:\r\n\r\n```\r\ntrust: error determining key location\r\n  └─prefix meta discovery error\r\n    └─discovery failed\r\n```\r\n\r\nFirst view shows that actual error:\r\n\r\n```\r\nGet https://coreos.com/etcd?ac-discovery=1: dial tcp: i/o timeout\r\n```\r\n\r\nand it is occured in the [discovery/http.go](https://github.com/appc/spec/blob/master/discovery/http.go#L101)\r\n\r\nAcutally I expected that `rkt` will go to the `https://coreos.com/etcd?ac-discovery=1`\r\nand download a trusted key. And the most interesting thing for me here that I've\r\nexpected that [httpDoInsecureTLS.Do](https://github.com/appc/spec/blob/master/discovery/http.go#L98) will be called instead. As we deal with `https`.\r\nIf I'm wrong here, what's actual path of the:\r\n\r\n```go\r\nif insecure&InsecureTLS != 0 {\r\n\tres, err = httpDoInsecureTLS.Do(req)\r\n\treturn\r\n}\r\n```\r\n\r\n? The `InsecureTLS` has value `2`, and the value of the `insecure` is `0` or `4` depends on `--insecure-allow-http` flag. Maybe I've missed something, but under what conditions `insecure&InsecureTLS` will be not equal to zero?\r\n\r\nI already saw #2783 issue which describes similar error, but it didn't help.\r\n\r\nThank you.\r\n"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/236856691","html_url":"https://github.com/coreos/rkt/issues/3009#issuecomment-236856691","issue_url":"https://api.github.com/repos/coreos/rkt/issues/3009","id":236856691,"user":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"created_at":"2016-08-02T09:47:34Z","updated_at":"2016-08-02T09:47:34Z","body":"@0xAX no problem, nice to see it is solved. Regarding your previous questions, I don't think a `--timeout` flag is feasible as discovery may happen in several places. According to `man resolv.conf` the default timeout for a resolver is 5s, perhaps we may consider a small increase in appc/spec discovery just to cross that bar, but I'm not sure that hiding issues is a good way forward. @iaguis?"}}
{"actor":{"display_login":"lucab"}}