Use working upload key until org secret fixed - #115
Merged
Conversation
The upload loop printed "Uploaded <file>..." unconditionally, without checking scp's exit code. In run 31105640103 every file failed to transfer with "Permission denied (publickey)" and the log still claimed success for both; the step only went red because the last scp's exit code happened to leak out of the script. Had the first file failed and the second succeeded, the run would have been green with a file missing from the server. scp's exit code is now checked per file, and the script exits 1 if any transfer failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The org-level KIWIX_FILE_UPLOAD_SSH_KEY, as currently stored, cannot be
parsed by OpenSSH. Both upload workflows therefore point back at the
repo-level copy, which authenticates and uploads successfully.
Evidence from two runs of the same job on the same runner (OpenSSH_10.3p1,
OpenSSL 3.5.7), differing only in which secret was used:
org 31107600716: 400 bytes, 7 lines, crlf=1, bom=False
ssh-keygen -y -> error in libcrypto: unsupported (255)
scp -> Permission denied (publickey), nothing uploaded
repo 31107727173: 401 bytes, 8 lines, crlf=1, bom=False
ssh-keygen -y -> loaded (0)
scp -> both assets uploaded
Identical write path and no BOM in either, so the workflow is not at fault.
The org copy is one byte and one line shorter than a working copy of the
same key, which points at a line break lost when the secret was stored. The
libcrypto error rather than "invalid format" suggests the missing newline is
the one after the BEGIN armour line: OpenSSH then fails to recognise its own
format and falls back to OpenSSL, which rejects it.
This reverts the workflow half of #101 only. The key file path fix and the
.gitignore entry from that change are unaffected and stay.
Note that the nightly workflow was migrated too, so without this it would
have started failing at its next scheduled run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jaifroid
added
help wanted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The org secret for upload to OpenZim releases errors out, whereas the repo-level secret works fine. So I have to revert #112 and re-open #101 temporarily.