Windows CI occasionally fails because Chocolately cannot install Gpg4win

[twpayne]

Describe the bug

chezmoi's Windows continuous integration test occasionally fails because Chocolatey is unable to install Gpg4win, for example here. The error message looks like:

Run $env:PATH = "C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\ProgramData\chocolatey\bin"
  $env:PATH = "C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\ProgramData\chocolatey\bin"
  [Environment]::SetEnvironmentVariable("Path", $env:PATH, "Machine")
  choco install --no-progress --yes gpg4win
  echo "C:\Program Files (x86)\GnuPG\bin" >> $env:GITHUB_PATH
  shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
  env:
    AGE_VERSION: 1.0.0
    GO_VERSION: 1.17.3
    GOLANGCI_LINT_VERSION: 1.43.0
    GOROOT: C:\hostedtoolcache\windows\go\1.17.3\x64
Chocolatey v0.11.3
Installing the following packages:
gpg4win
By installing, you accept licenses for the packages.

Gpg4win v3.1.16 [Approved]
gpg4win package files install completed. Performing other installation steps.
Installing gpg4win...
gpg4win has been installed.
ERROR: The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Access is denied
  gpg4win may be able to be automatically uninstalled.
Environment Vars (like PATH) have changed. Close/reopen your shell to
 see the changes (or in powershell/cmd.exe just type `refreshenv`).
The install of gpg4win was NOT successful.
Error while running 'C:\ProgramData\chocolatey\lib\Gpg4win\tools\chocolateyInstall.ps1'.
 See log for details.

Chocolatey installed 0/1 packages. 1 packages failed.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

Failures
 - gpg4win (exited -1) - Error while running 'C:\ProgramData\chocolatey\lib\Gpg4win\tools\chocolateyInstall.ps1'.
 See log for details.
Error: Process completed with exit code 1.

Here's chocolatey.log from the above run.

The relevant lines from chezmoi's GitHub Actions are https://github.com/twpayne/chezmoi/blob/master/.github/workflows/main.yml#L345-L350.

To reproduce

This is not easy to reproduce, it happens on GitHub Actions, and only occasionally. Each time it happens, the failure message is the same.

Expected behavior

Chocolately should reliably install Gpg4win each time.

Output of command with the --verbose flag

n/a

Output of chezmoi doctor

n/a

Additional context

n/a

cc @rasmuskriest as Chocolately expert

[rasmuskriest]

Thanks for tagging me!

From what I can see in the logs, the installer for gpg4win (this script) successfully finishes the Install-ChocolateyInstallPackage function as that one outputs an "$packageName has been installed." upon completion.

That would mean that line 24 from the installation script is where the error lies (this is coming up due to the explicitly set $ErrorActionPreference = 'Stop' in that same file):

Get-ChildItem $toolsPath\*.exe | ForEach-Object { Remove-Item $_ -ea 0; if (Test-Path $_) { New-Item -ItemType File -Path "$_.ignore" '' }}

I would think that there should be no "access denied" when listing the directory content (it is Windows, after all), but rather when removing items or creating new ones. I am too unfamiliar with GitHub workflows though to have a good idea on why this would not appear to be problematic every run.

[felipecrs]

Perhaps one option would be to not use Chocolatey at all:

winget install --exact GnuPG.Gpg4win --source winget

[rasmuskriest]

Perhaps one option would be to not use Chocolatey at all:

winget install --exact GnuPG.Gpg4win --source winget

This would definitely be an option as soon as winget starts targeting Windows Server. This appears not to be the case in the near future though: microsoft/winget-cli#754 (comment)

[felipecrs]

The "offline" installation method, as said in the mentioned comment, should be enough:

$ curl.exe -fsSL --output vclibs.appx https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx
$ curl.exe -fsSL --output winget.msixbundle https://github.com/microsoft/winget-cli/releases/download/v1.1.12653/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle
$ Add-AppxPackage -Path winget.msixbundle -DependencyPath vclibs.appx 

[twpayne]

GPG on Windows seems to be regularly flaky, with all recent tests failing with what seems to be a change in GPG's output (example):

--- FAIL: TestScript (0.02s)
    --- FAIL: TestScript/gpgencryption (0.88s)
        testscript.go:397: 
            > [!exec:gpg] skip 'gpg not found in $PATH'
            > mkhomedir
            > mkgpgconfig
            FAIL: testdata\scripts\gpgencryption.txt:4: key not found in "gpg: keybox 'C:\\\\Users\\\\RUNNER~1\\\\AppData\\\\Local\\\\Temp\\\\test-gpg-homedir95822276\\\\pubring.kbx' created\r\ngpg: C:\\\\Users\\\\RUNNER~1\\\\AppData\\\\Local\\\\Temp\\\\test-gpg-homedir95822276\\\\trustdb.gpg: trustdb created\r\ngpg: directory 'C:\\\\Users\\\\RUNNER~1\\\\AppData\\\\Local\\\\Temp\\\\test-gpg-homedir95822276\\\\openpgp-revocs.d' created\r\ngpg: revocation certificate stored as 'C:\\\\Users\\\\RUNNER~1\\\\AppData\\\\Local\\\\Temp\\\\test-gpg-homedir95822276\\\\openpgp-revocs.d\\\\790221281B3E9559038FEEC26F2EBE203375AD50.rev'\r\n"       

For now, I've disabled these tests, so this issue is no longer relevant.

[twpayne]

GPG on Windows seems to be regularly flaky, with all recent tests failing with what seems to be a change in GPG's output (example):

For info, this is because the output of gpg --quick-generate-key changed in GnuPG 2.3.4 and Chocolately was installing this version.

[twpayne]

...except that GPG on Windows doesn't like long paths 😢

--- FAIL: TestScript (0.02s)
    --- FAIL: TestScript/gpgencryptionsymmetric (7.61s)
        testscript.go:397: 
            # test that chezmoi add --encrypt encrypts (6.635s)
            > cp golden/.encrypted $HOME
            > chezmoi add --encrypt $HOME${/}.encrypted
            [stderr]
            gpg: can't connect to the gpg-agent: Filename too long
            gpg: problem with the agent: No agent running
            chezmoi: exit status 2
            [exit status 1]
            FAIL: testdata\scripts\gpgencryptionsymmetric.txt:8: unexpected command failure