[Bug]: Error occ when try to sign app Gestion

[baimard]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I have a CI/CD pipeline for my app Gestion on https://github.com/baimard/gestion.

With Nextcloud 31, I encounter this bug when I try to sign my app, and I don't understand why.

Run cd /usr/src/nextcloud
  cd /usr/src/nextcloud
  php occ integrity:sign-app --privateKey=p.key --certificate=p.crt --path=/usr/src/nextcloud/apps/gestion
  cd /usr/src/nextcloud/apps
  tar cvzf gestion.tar.gz gestion
  echo -n "$APP_KEY" > /usr/src/nextcloud/apps/p.key
  openssl dgst -sha512 -sign /usr/src/nextcloud/apps/p.key /usr/src/nextcloud/apps/gestion.tar.gz | openssl base64 > /usr/src/nextcloud/apps/shasum.txt
  cat ./shasum.txt
  shell: sh -e {0}
  env:
    APP_KEY: ***

Warning: fileowner(): stat failed for /usr/src/nextcloud/config/config.php in /usr/src/nextcloud/occ on line 20
An unhandled exception has been thrown:
Exception: Config file has leading content, please remove everything before "<?php" in apache-pretty-urls.config.php in /usr/src/nextcloud/lib/private/Config.php:222
Stack trace:
#0 /usr/src/nextcloud/lib/private/Config.php(40): OC\Config->readData()
#1 /usr/src/nextcloud/lib/base.php(94): OC\Config->__construct('/usr/src/nextcl...')
#2 /usr/src/nextcloud/lib/base.php(607): OC::initPaths()
#3 /usr/src/nextcloud/lib/base.php(1141): OC::init()
#4 /usr/src/nextcloud/console.php(28): require_once('/usr/src/nextcl...')
#5 /usr/src/nextcloud/occ(33): require_once('/usr/src/nextcl...')
#6 {main}
Error: Process completed with exit code 1.

If you have any Idea ?

Steps to reproduce

1. create a new release
2. github action launch automaticly

Expected behavior

Sign the app with occ nextcloud

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

.github/workflows

name: Publish in GitHub Package Registry

# on:
#   workflow_dispatch:

#   push :
#     tags:
#       - '*'

on:
  release:
      types: [published]

jobs:
  container:
    runs-on: ubuntu-latest
    container: nextcloud
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          path: gestion

      - name: Create tar
        run: |
          cd gestion && make appstore

      - name: load app
        run: |
          cd gestion
          tar xzvf ./build/artifacts/appstore/gestion.tar.gz --directory /usr/src/nextcloud/apps/

      - name: Generate key
        env:
          APP_KEY: ${{ secrets.APP_PRIVATE_KEY }}
          APP_CRT: ${{ secrets.APP_CERTIFICATE }}
        run: |
          echo -n "$APP_KEY" > /usr/src/nextcloud/p.key
          echo -n "$APP_CRT" > /usr/src/nextcloud/p.crt

      - name: sign app
        env:
          APP_KEY: ${{ secrets.APP_PRIVATE_KEY }}
        run: |
          cd /usr/src/nextcloud
          php occ integrity:sign-app --privateKey=p.key --certificate=p.crt --path=/usr/src/nextcloud/apps/gestion
          cd /usr/src/nextcloud/apps
          tar cvzf gestion.tar.gz gestion
          echo -n "$APP_KEY" > /usr/src/nextcloud/apps/p.key
          openssl dgst -sha512 -sign /usr/src/nextcloud/apps/p.key /usr/src/nextcloud/apps/gestion.tar.gz | openssl base64 > /usr/src/nextcloud/apps/shasum.txt
          cat ./shasum.txt

      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}

      - name: Upload app tarball to release
        uses: svenstaro/upload-release-action@v2
        id: attach_to_release_app
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: /usr/src/nextcloud/apps/gestion.tar.gz
          asset_name: gestion.tar.gz
          tag: ${{ steps.get_version.outputs.VERSION }}
          overwrite: true

      - name: Upload shasum to release
        uses: svenstaro/upload-release-action@v2
        id: attach_to_release_shasum
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: /usr/src/nextcloud/apps/shasum.txt
          asset_name: shasum.${{ steps.get_version.outputs.VERSION }}.txt
          tag: ${{ steps.get_version.outputs.VERSION }}
          overwrite: true

      - name: Sleep for 1 minute
        run: sleep 60s
        shell: bash

  publish:
    runs-on: ubuntu-latest
    needs: [container]
    steps:
      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}

      - name: Upload app to Nextcloud appstore
        uses: R0Wi/nextcloud-appstore-push-action@v1
        with:
          app_name: gestion
          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
          download_url: https://github.com/baimard/gestion/releases/download/${{ steps.get_version.outputs.VERSION }}/gestion.tar.gz
          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
          nightly: false

      - name: Twitter
        uses: Eomm/why-don-t-you-tweet@v1
        with:
          tweet-message: "Nextcloud Gestion is here! Check the new release ${{ github.event.release.tag_name }}. Don't forget to clear your cache ;) #Nextcloud #release #opensource"
        env:
          TWITTER_CONSUMER_API_KEY: ${{ secrets.TWITTER_CONSUMER_API_KEY }}
          TWITTER_CONSUMER_API_SECRET: ${{ secrets.TWITTER_CONSUMER_API_SECRET }}
          TWITTER_ACCESS_TOKEN: ${{ secrets.TWITTER_ACCESS_TOKEN }}
          TWITTER_ACCESS_TOKEN_SECRET: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}

[kesselb]

Hi,

is there any content in apache-pretty-urls.config.php before <?php? Also check for invisible characters (e.g. bom)

It looks like you are using an existing nextcloud installation on your server for signing the app, I assume that should work too, however in our workflows (see https://github.com/nextcloud/.github/blob/master/workflow-templates/appstore-build-publish.yml) we are always using a fresh checkout.

[baimard]

is there any content in apache-pretty-urls.config.php before <?php? Also check for invisible characters (e.g. bom)

it's from the direct container nextcloud ...

[kesselb]

Okay!

I have a hunch about what's going on. By default, the Docker container does not install Nextcloud, which means there is no config.php file. This is why you're seeing the warning: "Warning: fileowner(): stat failed for /usr/src/nextcloud/config/config.php." This warning leads to headers_sent returning true, which then triggers the "Config file has leading content" warning and cancels the process.

The error regarding the missing configuration file has already been fixed in #51594 and has been backported to version 31.0.3. The Docker image will be updated to 31.0.3 soon, and I would expect your workflow to function correctly afterward.

Workaround: Use our workflow with a clean checkout.

cc @provokateurin as you recently worked in this area. No idea if there's something to improve code wise, I wasn't aware that headers_sent could also return true for cli requests 🤷 😕

[baimard]

Merci beaucoup for the quick answer, I will wait for the release 31.0.3 of nextcloud.

Should we close the issue ?

[provokateurin]

I think so!