From 2a0d33accd8fc88d7950dce1d8cc166fa295fe10 Mon Sep 17 00:00:00 2001 From: Jaifroid Date: Thu, 6 Aug 2026 14:37:31 +0100 Subject: [PATCH 1/2] Fail the upload when scp does The upload loop printed "Uploaded ..." unconditionally, without checking scp's exit code. In run 31105640103 every file failed to transfer with "Permission denied (publickey)" and the log still claimed success for both; the step only went red because the last scp's exit code happened to leak out of the script. Had the first file failed and the second succeeded, the run would have been green with a file missing from the server. scp's exit code is now checked per file, and the script exits 1 if any transfer failed. Co-Authored-By: Claude Opus 5 --- scripts/Upload-KiwixRelease.ps1 | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/scripts/Upload-KiwixRelease.ps1 b/scripts/Upload-KiwixRelease.ps1 index 0df1c90..4e46bf5 100644 --- a/scripts/Upload-KiwixRelease.ps1 +++ b/scripts/Upload-KiwixRelease.ps1 @@ -139,6 +139,7 @@ function Main { $keyfile = "$PSScriptRoot\upload_ssh_key" $keyfile = $keyfile -ireplace '[\\/]', '/' "" + $uploadFailed = $false $releaseFiles | % { $filename = $_ if ($dryrun) { @@ -147,9 +148,18 @@ function Main { } else { # Uploading file & "C:\Program Files\Git\usr\bin\scp.exe" @('-P', '30322', '-o', 'StrictHostKeyChecking=no', '-i', "$keyfile", "$filename", "javascript-libzim@${server}:$target") - Write-Host "`nUploaded $filename to $server$target" + # Don't claim success on scp's behalf: it reports transfer and auth failures by exit code + if ($LASTEXITCODE -eq 0) { + Write-Host "`nUploaded $filename to $server$target" + } else { + Write-Host "`n** scp exited with code $LASTEXITCODE :" $filename "was NOT uploaded! **`n" -ForegroundColor Red + $uploadFailed = $true + } } } + if ($uploadFailed) { + exit 1 + } } else { # This shouldn't happen! Write-Host "`nERROR! We don't seem to have any filenames to upload!" -ForegroundColor Red From 8f3f06c58bad2561cc4bead0bf1f0bbebd4da250 Mon Sep 17 00:00:00 2001 From: Jaifroid Date: Thu, 6 Aug 2026 14:55:38 +0100 Subject: [PATCH 2/2] Use the working upload key until the org secret is fixed The org-level KIWIX_FILE_UPLOAD_SSH_KEY, as currently stored, cannot be parsed by OpenSSH. Both upload workflows therefore point back at the repo-level copy, which authenticates and uploads successfully. Evidence from two runs of the same job on the same runner (OpenSSH_10.3p1, OpenSSL 3.5.7), differing only in which secret was used: org 31107600716: 400 bytes, 7 lines, crlf=1, bom=False ssh-keygen -y -> error in libcrypto: unsupported (255) scp -> Permission denied (publickey), nothing uploaded repo 31107727173: 401 bytes, 8 lines, crlf=1, bom=False ssh-keygen -y -> loaded (0) scp -> both assets uploaded Identical write path and no BOM in either, so the workflow is not at fault. The org copy is one byte and one line shorter than a working copy of the same key, which points at a line break lost when the secret was stored. The libcrypto error rather than "invalid format" suggests the missing newline is the one after the BEGIN armour line: OpenSSH then fails to recognise its own format and falls back to OpenSSL, which rejects it. This reverts the workflow half of #101 only. The key file path fix and the .gitignore entry from that change are unaffected and stay. Note that the nightly workflow was migrated too, so without this it would have started failing at its next scheduled run. Co-Authored-By: Claude Opus 5 --- .github/workflows/build_libzim_wasm.yml | 5 ++++- .github/workflows/upload_release_assets_to_kiwix.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_libzim_wasm.yml b/.github/workflows/build_libzim_wasm.yml index 7bb3b3d..7705c87 100644 --- a/.github/workflows/build_libzim_wasm.yml +++ b/.github/workflows/build_libzim_wasm.yml @@ -49,7 +49,10 @@ env: DISPATCH_TYPE: ${{ github.event.inputs.buildtype }} LIBZIM_VERSION: ${{ github.event.inputs.libzim_version }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - UPLOAD_SSH_KEY: ${{ secrets.KIWIX_FILE_UPLOAD_SSH_KEY }} + # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored + # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it. + # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101). + UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }} BUILD_TYPE: ${{ github.event.inputs.buildtype }} jobs: diff --git a/.github/workflows/upload_release_assets_to_kiwix.yml b/.github/workflows/upload_release_assets_to_kiwix.yml index e12ec67..3e49a9e 100644 --- a/.github/workflows/upload_release_assets_to_kiwix.yml +++ b/.github/workflows/upload_release_assets_to_kiwix.yml @@ -21,7 +21,10 @@ env: VERSION: ${{ github.event.release.tag_name }} DISPATCH_VERSION: ${{ github.event.inputs.version }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - UPLOAD_SSH_KEY: ${{ secrets.KIWIX_FILE_UPLOAD_SSH_KEY }} + # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored + # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it. + # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101). + UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }} jobs: upload: