text: fingerprint SSL check does not work behind a proxy
  Bug Description
  If you have a printer for which a signed binary driver is available via OpenPrinting (newer Epson inkjets) then the download of the signature key file does not work and so the driver installation does not complete.
  See this mail from Olaf Meeuwissen from Avasys (they make drivers for Epson):
  ----------
  Hi Till,
  Saito-san and I have been looking at how well the automatic download
  works when behind a proxy. Short story: it doesn't. The long story
  follows below.
  Till Kamppeter <email address hidden> writes:
  > > for testing the automatic driver download on current Natty [...]
  > > apply the patch attached to my previous mail [...]
  > > 0001-Activated-
  We upgraded Natty on 2011-03-03 and applied your patch to
  system-
  > > cupsctl FileDevice=yes
  > > cd /usr/share/
  > > python newprinter.py --setup-
  > > --devid=
  That's what we did. We've been looking at jockey debug logs, wireshark
  network traffic captures and the jockey code trying to figure out where
  things went wrong. According to the logs, the query of the OpenPrinting
  DB went just fine. It's getting the fingerprint that bombs. Using wget
  to fetch the fingerprint in the same environment works fine.
  >From the jockey debug logs:
  2011-03-03 13:04:49,904 DEBUG: Querying openprinting.org database...
  2011-03-03 13:04:49,904 DEBUG: ... querying for MFG:Epson;
  2011-03-03 13:04:56,203 DEBUG: OpenPrintingDri
  2011-03-03 13:04:56,252 WARNING: https:/
  2011-03-03 13:04:56,252 DEBUG: Ignoring driver as it does not have a valid GPG fingerprint
  2011-03-03 13:04:56,253 DEBUG: openprinting.org database query finished
  We've chased the WARNING statement down to the connect method of
  _CertValidating
  def connect(self):
  sock = socket.
  self.sock = ssl.wrap_
  cert = self.sock.
  hostname = self.host.
  if not self._validate_
  raise InvalidCertific
  The ssl.wrap_socket raises an ssl.SSLError. What puzzles us is that
  this method creates a connection to the _proxy_ rather than to the host
  where the fingerprint resides. The wireshark capture for a wget went
  straight to the latter host and negotiated TLSv1 with the proxy on the
  fly.
  We've also played with passing different ssl_version parameters to
  ssl.wrap_socket but that didn't help. We're not sure whether this
  method negotiates a usable version but if it doesn't that something that
  probably needs fixing as well.
  Hope this helps,
  ----------
  Can this get fixed in Natty? Thanks.
  Note taking for myself. Reproducer:
  sudo apt-get install squid
  in trunk:
  sudo http_proxy="http://
  trigger Epson driver search:
  dbus-send --print-reply --dest=
  Faster reproducer:
  # working case without proxy:
  $ python -c 'import jockey.detection; from jockey.oslib import OSLib; OSLib.inst = OSLib(); print jockey.
  E522 0FB7 014D 0FBD A50D FC2B E5E8 6C00 8AA6 5D56
  # failing case with proxy:
  $ http_proxy="http://
  WARNING:root:https:/
  I added a bunch of test cases, restructured the code a bit, and now switched the implementation to use pycurl instead of jockey's verified_https.py urllib2 handler. I didn't see a way to make this work properly with HTTPS proxies, but with pycurl it works just fine:
  $ http_proxy="http://
  E522 0FB7 014D 0FBD A50D FC2B E5E8 6C00 8AA6 5D56
  Squid log confirms that the request was proxied and reached the right destination:
  1299594547.873 1444 127.0.0.1 TCP_MISS/200 4340 CONNECT linux.avasys.jp:443 - DIRECT/
  I'll upload this in a bit. I'd appreciate if you could test this again once it's in Natty, to confirm that it also really works in your setup. Thanks!
  Olaf, just saw that you weren't subscribed to this bug report, Till proxied it for you.
  I'll upload this in a bit. I'd appreciate if you could test this again once it's in Natty, to confirm that it also really works in your setup. Thanks!
  This bug was fixed in the package jockey - 0.9.2-0ubuntu1
  ---------------
  jockey (0.9.2-0ubuntu1) natty; urgency=low
  * New upstream bug fix release:
  - Add X.org video driver ABI checking. (This was already cherrypicked
  in an earlier upload)
  - Drop our own verified_https.py and implement GPG fingerprint SSL
  checking with pycurl, which gets along with proxies. (LP: #729185)
  - Some code cleanup and more test cases.
  * debian/control: Add python-pycurl dependency.
  -- Martin Pitt <email address hidden> Tue, 08 Mar 2011 16:08:06 +0100
  Re #5, we've tested with the fixed code and getting the GPG fingerprint worked fine for us.? If yes, then I think the fix is OK. If no, then it might need a bit more work.
  Now that getting the GPG fingerprint works it time to make GPG proxy aware, see #733023 ;-)
  Hello Olaf,
  Olaf Meeuwissen [2011-03-11 1:54 -0000]:
  > Re #5, we've tested with the fixed code and getting the GPG fingerprint
  > worked fine for us.
  Nice!
  >?
  Yes, it does by default:
  http://
  Both the old (verified_https.py) and the new (pycurl) implementation
  are covered by various test cases, amongst them one for a nonmatching
  host name:
  http://
  I reproduced this with squid.