Skip to content

[Bug]: Error occ when try to sign app Gestion #52211

Closed

Description

@baimard

⚠️ This issue respects the following points: ⚠️

Bug description

I have a CI/CD pipeline for my app Gestion on https://github.com/baimard/gestion.

With Nextcloud 31, I encounter this bug when I try to sign my app, and I don't understand why.

Run cd /usr/src/nextcloud
  cd /usr/src/nextcloud
  php occ integrity:sign-app --privateKey=p.key --certificate=p.crt --path=/usr/src/nextcloud/apps/gestion
  cd /usr/src/nextcloud/apps
  tar cvzf gestion.tar.gz gestion
  echo -n "$APP_KEY" > /usr/src/nextcloud/apps/p.key
  openssl dgst -sha512 -sign /usr/src/nextcloud/apps/p.key /usr/src/nextcloud/apps/gestion.tar.gz | openssl base64 > /usr/src/nextcloud/apps/shasum.txt
  cat ./shasum.txt
  shell: sh -e {0}
  env:
    APP_KEY: ***

Warning: fileowner(): stat failed for /usr/src/nextcloud/config/config.php in /usr/src/nextcloud/occ on line 20
An unhandled exception has been thrown:
Exception: Config file has leading content, please remove everything before "<?php" in apache-pretty-urls.config.php in /usr/src/nextcloud/lib/private/Config.php:222
Stack trace:
#0 /usr/src/nextcloud/lib/private/Config.php(40): OC\Config->readData()
#1 /usr/src/nextcloud/lib/base.php(94): OC\Config->__construct('/usr/src/nextcl...')
#2 /usr/src/nextcloud/lib/base.php(607): OC::initPaths()
#3 /usr/src/nextcloud/lib/base.php(1141): OC::init()
#4 /usr/src/nextcloud/console.php(28): require_once('/usr/src/nextcl...')
#5 /usr/src/nextcloud/occ(33): require_once('/usr/src/nextcl...')
#6 {main}
Error: Process completed with exit code 1.

If you have any Idea ?

Steps to reproduce

  1. create a new release
  2. github action launch automaticly

Expected behavior

Sign the app with occ nextcloud

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

.github/workflows

name: Publish in GitHub Package Registry

# on:
#   workflow_dispatch:

#   push :
#     tags:
#       - '*'

on:
  release:
      types: [published]

jobs:
  container:
    runs-on: ubuntu-latest
    container: nextcloud
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          path: gestion

      - name: Create tar
        run: |
          cd gestion && make appstore

      - name: load app
        run: |
          cd gestion
          tar xzvf ./build/artifacts/appstore/gestion.tar.gz --directory /usr/src/nextcloud/apps/

      - name: Generate key
        env:
          APP_KEY: ${{ secrets.APP_PRIVATE_KEY }}
          APP_CRT: ${{ secrets.APP_CERTIFICATE }}
        run: |
          echo -n "$APP_KEY" > /usr/src/nextcloud/p.key
          echo -n "$APP_CRT" > /usr/src/nextcloud/p.crt

      - name: sign app
        env:
          APP_KEY: ${{ secrets.APP_PRIVATE_KEY }}
        run: |
          cd /usr/src/nextcloud
          php occ integrity:sign-app --privateKey=p.key --certificate=p.crt --path=/usr/src/nextcloud/apps/gestion
          cd /usr/src/nextcloud/apps
          tar cvzf gestion.tar.gz gestion
          echo -n "$APP_KEY" > /usr/src/nextcloud/apps/p.key
          openssl dgst -sha512 -sign /usr/src/nextcloud/apps/p.key /usr/src/nextcloud/apps/gestion.tar.gz | openssl base64 > /usr/src/nextcloud/apps/shasum.txt
          cat ./shasum.txt

      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}

      - name: Upload app tarball to release
        uses: svenstaro/upload-release-action@v2
        id: attach_to_release_app
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: /usr/src/nextcloud/apps/gestion.tar.gz
          asset_name: gestion.tar.gz
          tag: ${{ steps.get_version.outputs.VERSION }}
          overwrite: true

      - name: Upload shasum to release
        uses: svenstaro/upload-release-action@v2
        id: attach_to_release_shasum
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: /usr/src/nextcloud/apps/shasum.txt
          asset_name: shasum.${{ steps.get_version.outputs.VERSION }}.txt
          tag: ${{ steps.get_version.outputs.VERSION }}
          overwrite: true

      - name: Sleep for 1 minute
        run: sleep 60s
        shell: bash

  publish:
    runs-on: ubuntu-latest
    needs: [container]
    steps:
      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}

      - name: Upload app to Nextcloud appstore
        uses: R0Wi/nextcloud-appstore-push-action@v1
        with:
          app_name: gestion
          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
          download_url: https://github.com/baimard/gestion/releases/download/${{ steps.get_version.outputs.VERSION }}/gestion.tar.gz
          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
          nightly: false

      - name: Twitter
        uses: Eomm/why-don-t-you-tweet@v1
        with:
          tweet-message: "Nextcloud Gestion is here! Check the new release ${{ github.event.release.tag_name }}. Don't forget to clear your cache ;) #Nextcloud #release #opensource"
        env:
          TWITTER_CONSUMER_API_KEY: ${{ secrets.TWITTER_CONSUMER_API_KEY }}
          TWITTER_CONSUMER_API_SECRET: ${{ secrets.TWITTER_CONSUMER_API_SECRET }}
          TWITTER_ACCESS_TOKEN: ${{ secrets.TWITTER_ACCESS_TOKEN }}
          TWITTER_ACCESS_TOKEN_SECRET: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}

Activity

  1. added
    0. Needs triagePending check for reproducibility or if it fits our roadmap
    on Apr 15, 2025
  2. kesselb commented on Apr 15, 2025

    @kesselb
    Contributor

    Hi,

    is there any content in apache-pretty-urls.config.php before <?php? Also check for invisible characters (e.g. bom)

    It looks like you are using an existing nextcloud installation on your server for signing the app, I assume that should work too, however in our workflows (see https://github.com/nextcloud/.github/blob/master/workflow-templates/appstore-build-publish.yml) we are always using a fresh checkout.

  3. baimard commented on Apr 15, 2025

    @baimard
    Author

    is there any content in apache-pretty-urls.config.php before <?php? Also check for invisible characters (e.g. bom)

    it's from the direct container nextcloud ...

  4. kesselb commented on Apr 15, 2025

    @kesselb
    Contributor

    Okay!

    I have a hunch about what's going on. By default, the Docker container does not install Nextcloud, which means there is no config.php file. This is why you're seeing the warning: "Warning: fileowner(): stat failed for /usr/src/nextcloud/config/config.php." This warning leads to headers_sent returning true, which then triggers the "Config file has leading content" warning and cancels the process.

    The error regarding the missing configuration file has already been fixed in #51594 and has been backported to version 31.0.3. The Docker image will be updated to 31.0.3 soon, and I would expect your workflow to function correctly afterward.

    Workaround: Use our workflow with a clean checkout.

    cc @provokateurin as you recently worked in this area. No idea if there's something to improve code wise, I wasn't aware that headers_sent could also return true for cli requests 🤷 😕

  5. baimard commented on Apr 15, 2025

    @baimard
    Author

    Merci beaucoup for the quick answer, I will wait for the release 31.0.3 of nextcloud.

    Should we close the issue ?

  6. provokateurin commented on Apr 15, 2025

    @provokateurin
    Member

    I think so!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    0. Needs triagePending check for reproducibility or if it fits our roadmap31-feedbackbug

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions