Synaptic proxy authentication integration

[Berend De Schouwer]

Binary package hint: synaptic

Synaptic proxy authentication settings result in '407 Authentication Required' when Gnome->Preferences->Network Proxy is set. It happens because the Gnome settings set the http_proxy environment variable, gksu strips out the username and password, and synaptic (or apt->method->http) uses http_proxy environment variable instead of the Synaptic preferences setup.

You can only make Synaptic work by unsetting Gnome->Preferences->Network Proxy (and break Epiphany/Evolution/Other Gnome Apps) and setting up /etc/apt/apt.conf.d/ manually.

This happens with 'gksu synaptic' but not 'sudo synaptic', so it might be a gksu bug instead. I've only been able to fix it with patching the synaptic source (a simple patch.)

[Berend De Schouwer (berend-de-schouwer)]

I'm adding a patch that fixes synaptic 0.57.11.1ubuntu14 for me. It does two things:
1. If Synaptic has proxy preferences, it unsets http_proxy environment variable and related. These seem to override Synaptic settings.
2. It adds a trailing '/' to the proxy settings which appears to be necessary here. This is also necessary if I manually change /etc/apt/apt.conf.d/ to make command-line apt work. So Acquire::http::proxy needs 'http://user:pass@proxy:port/' instead of 'http://user:pass@proxy:port'. (WHY???)

The patch is a whole 33 lines (basically four one-line changes), and should read fairly obviously.

[Michael Vogt (mvo)]

Thanks for your bugreport.

This problem is fixed in my local tree and the fix will be part of the next upload. It will probably go to feisty-updates instead of feisty-final because we are very late in the release cycle.

Cheers,
 Michael

[Michael Vogt (mvo)]

Hm, one problem with this approach is that the old value for http_proxy is not stored and reapplyed. If the user clicks use-proxy, then changes his mind again the old http_proxy setting (that might be inheritet from gksu) is lost. not a major issue though.

[Berend De Schouwer (berend-de-schouwer)]

It doesn't matter that we lose the http_proxy variables. They are wrong anyway: the user/password is stripped off.

[Chakkaradeep (chakkaradeep)]

I connect to internet through Proxy Authentication. I made apt-get to work with this by having the apt.conf at /etc/apt

chaks@chaks-laptop:~$ cat /etc/apt/apt.conf
Acquire::http::Proxy "http://<email address hidden>";
Acquire::ftp::Proxy "ftp://<email address hidden>";
And my http_proxy and ftp_proxy variables to set too,

http_proxy=http://<email address hidden>
ftp_proxy=ftp://<email address hidden>
To even be more safe, I have set the system wide proxy settings in System->Preferences->Network Proxy

Now, In Synaptic, I have set the Proxy again in the Preferences->Network

After all these settings change, Synaptic does not work . It fails to download packages or perform Reload and throws error that Proxy Authentication is needed

apt-get works fine.

And as said in the bug description, If you open synaptic as sudo synaptic it works but not as gksu or gksudo synaptic ! Why is gksu or gksudo does not recognize proxy settings

[fangorious (fangorious-deactivatedaccount)]

Michael, when should we expect the fix to be released? I have synaptic 0.57.11.1ubuntu14 installed, and am currently experiencing this problem.

[apastuszak (amp68)]

I am also awaiting this fix. Will this also fix Update Manager? When will it be released?

[Marco Rodrigues (gothicx)]

synaptic (0.57.11.1ubuntu15) gutsy; urgency=low

  * gtk/rgpreferenceswindow.cc:
    - overwrite the http_proxy environ when the user set the proxy
      explicitely (thanks to Berend De Schouwer, LP#105515)
  * common/rpackagelister.cc:
    - added "Volatile::SetSelectionDoReInstall" to support
      reinstalling from --set-selections too
  * common/rpackage.cc:
    - only show a package as supported if it is authenticated
  * po/eu.po:
    - updated (thanks to dooteo, closes: #368951)
  * gtk/rguserdialog.cc, gtk/rggladewindow.cc:
    - do not crash for invalid parent-window-ids

[apastuszak (amp68)]

0.57.11.1 still does not fix this issue. Will this be fixed in Feisty? It says Fix Released, but I don't have the fix.

[Uberground (uberground)]

This is still a problem in the ubuntu-8.04-desktop-i386.iso release of Gutsy 8.04.
The proxy username/password is lost to Gnome applications, thus resulting in:
Synaptic Package Manager: Clicking Reload results in a "Could not download all repository indexes" window with a 407 Proxy Authentication Required message for each repository index.
Firefox: On first open, Firefox will recognise that authentication is buggered and ask for username and password twice (I assume this is because it's makes 2 requests to Live bookmarks or similar on load). Then it's fine.

Will update if it still occurs after all updates are made to 8.04. I just need to get some workaround in order to get those updates.

[Uberground (uberground)]

Ok, correction. This bug appears to be about overriding the Gnome Proxy settings in Synaptic. That, indeed, does now work; but it appears to be needed because Gnome proxy (System > Preferences > Network Proxy) doesn't pass authentication information - and this is still broken. Sure, I understand that overriding Gnome proxy in Synaptic package manager is useful, but why wasn't Gnome proxy authentication passing fixed first?

Does any application work with the Gnome Network Proxy authentication setting?
Sound Juicer 2.22.0 isn't working with it, Rhythmbox 0.11.5 isn't either
http://bugzilla.gnome.org/show_bug.cgi?id=537571 (Banshee using proxy, but doesn't get/use the authentication info)

[Berend De Schouwer (berend-de-schouwer)]

Liferea doesn't use it properly either. I think the only app that does
is epiphany. And "automatic proxy" doesn't get used correctly by most
apps either -- although that requires Javascript interpretation, and is
much more complex.

[arencinosa (arencinosa)]

There is something more about proxy configuration and installing software through (at least) synaptic:
I used to have a direct connection to Internet, so I didn't need a proxy configuration :)
But... some minutes ago I moved (along with my laptop) to a private network. I reinstalled my Hardy (Ubuntu) system and tried to install msttcorefonts package. Of course, I couldn't: I needed to configure my proxy settings in order to get those required *.exe files from Internet (yes, my Ubuntu repository is local). I did, and I tried again, but something went wrong: I did set the right authentication, however, I got a '407 Authentication Required' response. "Odd, ...but it's ok, I will try again, now with the global proxy settings setted" ...and then, the same result. I tried any combination between global network proxy settings and synaptic proxy settings (direct connection and proper proxy configuration), but always the same behavior: '407 Authentication Required'. I gave up. I just thought "enough, I just want those fonts installed right now", and then I ssh-ed to a NAT-ed pc, and I wget-ed the whole list of *.exe files needed to get msttcorefonts package installed (I found the *.exe files needed inspecting into the .deb file). Once I got those files, I copied them to my laptop into /var/www/sourceforge/corefonts and set "127.0.0.1 surfnet.dl.sourceforge.net" into /etc/hosts in order to get those *.exe files fetched from localhost. I thought it will be enough, but I was wrong: synaptic still was using my previous proxy settings to download those files!! Unbelievable. I tried aptitude, apt-get, but nothing new. I looked for 'proxy' on ~/ (grep -ri proxy ~/) but nothing. I even did it for /etc (grep -ri proxy /etc/) and nothing. Odd, really odd. When I almost gave up, I got a new idea: cache. I looked into /var/cache/debconf/config.dat and I found this:

Name: msttcorefonts/http_proxy
Template: msttcorefonts/http_proxy
Value: <my_proxy_host_and_port>
Owners: msttcorefonts

"Wow!!" I unfilled the "Value" field, and then everything went ok. So, no matter I decided later, once I configured a proxy for installing a package, that configuration will be persisted to be used on future (at least, while the package is not successfully installed). Is that ok?? I mean, am I the only one who doesn't like that??