feat(ruby): restore RVM GPG retry/keyserver logic and update test base images per review

Author: rhiroe

src/ruby/install.sh

@@ -25,6 +25,7 @@ RUBIES_DIR="/usr/local/rubies"
 RUBY_GROUP="ruby"
 RBENV_ROOT="/usr/local/share/rbenv"
 RVM_PATH="/usr/local/rvm"
+RVM_GPG_KEYS="409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB"
 
 set -e
 
@@ -86,6 +87,69 @@ apply_group_perms() {
     find "${dir}" -type d -exec chmod g+s {} + 2>/dev/null || true
 }
 
+get_gpg_key_servers() {
+    declare -A keyservers_curl_map=(
+        ["hkp://keyserver.ubuntu.com"]="http://keyserver.ubuntu.com:11371"
+        ["hkp://keyserver.ubuntu.com:80"]="http://keyserver.ubuntu.com"
+        ["hkps://keys.openpgp.org"]="https://keys.openpgp.org"
+        ["hkp://keyserver.pgp.com"]="http://keyserver.pgp.com:11371"
+    )
+
+    local curl_args=""
+    local keyserver_reachable=false
+
+    if [ -n "${KEYSERVER_PROXY:-}" ]; then
+        curl_args="--proxy ${KEYSERVER_PROXY}"
+    fi
+
+    for keyserver in "${!keyservers_curl_map[@]}"; do
+        local keyserver_curl_url="${keyservers_curl_map[${keyserver}]}"
+        if curl -s ${curl_args} --max-time 5 "${keyserver_curl_url}" > /dev/null; then
+            echo "keyserver ${keyserver}"
+            keyserver_reachable=true
+        else
+            echo "(*) Keyserver ${keyserver} is not reachable." >&2
+        fi
+    done
+
+    if ! $keyserver_reachable; then
+        echo "(!) No keyserver is reachable." >&2
+        exit 1
+    fi
+}
+
+receive_gpg_keys() {
+    local keys=${!1}
+    local keyring_args=""
+    if [ -n "${2:-}" ]; then
+        keyring_args="--no-default-keyring --keyring \"$2\""
+    fi
+
+    export GNUPGHOME="/tmp/tmp-gnupg"
+    mkdir -p "${GNUPGHOME}"
+    chmod 700 "${GNUPGHOME}"
+    echo -e "disable-ipv6\n$(get_gpg_key_servers)" > "${GNUPGHOME}/dirmngr.conf"
+
+    local retry_count=0
+    local gpg_ok="false"
+    set +e
+    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; do
+        echo "(*) Downloading GPG key..."
+        # shellcheck disable=SC2086
+        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
+        if [ "${gpg_ok}" != "true" ]; then
+            echo "(*) Failed getting key, retrying in 10s..."
+            (( retry_count++ ))
+            sleep 10s
+        fi
+    done
+    set -e
+    if [ "${gpg_ok}" = "false" ]; then
+        echo "(!) Failed to get gpg key."
+        exit 1
+    fi
+}
+
 default_ruby_version() {
     [ -L "${RUBIES_DIR}/current" ] && basename "$(readlink "${RUBIES_DIR}/current")"
 }
@@ -267,14 +331,7 @@ RBENV_PROFILE
 install_rvm() {
     echo "Installing rvm..."
 
-    # Best-effort GPG key import; some networks block keyservers.
-    gpg --keyserver hkp://keyserver.ubuntu.com \
-        --recv-keys \
-        409B6B1796C275462A1703113804BB82D39DC0E3 \
-        7D2BAF1CF37B13E2069D6956105BD0E739499BDB 2>/dev/null \
-    || curl -sSL https://rvm.io/mpapis.asc | gpg --import - 2>/dev/null \
-    || curl -sSL https://rvm.io/pkuczynski.asc | gpg --import - 2>/dev/null \
-    || true
+    receive_gpg_keys RVM_GPG_KEYS
 
     curl -sSL https://get.rvm.io | bash -s stable --path "${RVM_PATH}"
 

test/ruby/scenarios.json

@@ -39,13 +39,13 @@
         }
     },
     "ruby_debian": {
-        "image": "mcr.microsoft.com/devcontainers/base:bullseye",
+        "image": "mcr.microsoft.com/devcontainers/base:bookworm",
         "features": {
             "ruby": {}
         }
     },
     "ruby_rbenv": {
-        "image": "ubuntu:noble",
+        "image": "mcr.microsoft.com/devcontainers/base:noble",
         "features": {
             "ruby": {
                 "version": "3.4.2",
@@ -54,7 +54,7 @@
         }
     },
     "ruby_rvm": {
-        "image": "mcr.microsoft.com/devcontainers/base:bullseye",
+        "image": "mcr.microsoft.com/devcontainers/base:bookworm",
         "features": {
             "ruby": {
                 "version": "3.4.2",