guettli/sharedinbox
1
0
Fork 0
Code Issues 21 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix deploy.yml #404

New Issue
Closed
opened 2026-06-04 04:23:00 +00:00 by guettli · 1 comment
guettli commented 2026-06-04 04:23:00 +00:00 (Migrated from codeberg.org)
Copy Link
Copy Source

The last runs of deploy.yml failed.

Fix that, if possible, or set NeedSupervisor

The last runs of deploy.yml failed. Fix that, if possible, or set NeedSupervisor
guettlibot commented 2026-06-04 04:45:02 +00:00 (Migrated from codeberg.org)
Copy Link
Copy Source

The PR is open at https://codeberg.org/guettli/sharedinbox/pulls/406.

Here's a summary of what I found and fixed:

Root cause (diagnosed from CI run #1516 logs):

The deploy-apk and deploy-linux jobs fail every run with Load key "/root/.ssh/id_ed25519": error in libcrypto. Two problems compound each other:

  1. Stale Dagger cache — The tr -d '\r' key-normalisation step (from PR #369) shows as CACHED in every run. Dagger caches based on input-content hash; if the first-ever execution of that step produced a broken key file, the cached result is replayed forever and the live SOPS secret is never re-read.

  2. .ssh/ directory permissions — Dagger creates parent directories for secret mounts with 755. Mounting the raw key directly into /root/.ssh/ may let Dagger override that directory's permissions, potentially making them too permissive for OpenSSH.

Fix (ci/main.go — Deployer function):

  • Added an explicit mkdir -p /root/.ssh && chmod 700 /root/.ssh step before any secret mounts.
  • Moved the raw-key secret mount to /tmp/id_ed25519.raw (outside .ssh/).
  • Replaced tr -d '\r' with a Python3 normalisation script that handles CRLF, bare-CR, and ensures a trailing newline. Changing the command changes Dagger's cache key, forcing a fresh read of the current live secret.

PR: https://codeberg.org/guettli/sharedinbox/pulls/406

The PR is open at https://codeberg.org/guettli/sharedinbox/pulls/406. --- Here's a summary of what I found and fixed: **Root cause** (diagnosed from CI run #1516 logs): The `deploy-apk` and `deploy-linux` jobs fail every run with `Load key "/root/.ssh/id_ed25519": error in libcrypto`. Two problems compound each other: 1. **Stale Dagger cache** — The `tr -d '\r'` key-normalisation step (from PR #369) shows as `CACHED` in every run. Dagger caches based on input-content hash; if the first-ever execution of that step produced a broken key file, the cached result is replayed forever and the live SOPS secret is never re-read. 2. **`.ssh/` directory permissions** — Dagger creates parent directories for secret mounts with 755. Mounting the raw key directly into `/root/.ssh/` may let Dagger override that directory's permissions, potentially making them too permissive for OpenSSH. **Fix** (`ci/main.go` — `Deployer` function): - Added an explicit `mkdir -p /root/.ssh && chmod 700 /root/.ssh` step before any secret mounts. - Moved the raw-key secret mount to `/tmp/id_ed25519.raw` (outside `.ssh/`). - Replaced `tr -d '\r'` with a Python3 normalisation script that handles CRLF, bare-CR, and ensures a trailing newline. Changing the command changes Dagger's cache key, forcing a fresh read of the current live secret. PR: https://codeberg.org/guettli/sharedinbox/pulls/406
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
NeedSupervisor
Issue escalated to a human supervisor; agentloop will skip it until cleared.
 State/InProgress
State/Later
State/Planned
automerge
Eligible for automatic merge by CI
 ci-failure
Issue opened by agentloop to track a failing CI workflow; used for deduplication.
 do-not-merge
Plan PR — review only, do not merge.
 loop/code
Add to run the built-in "code" prompt; override at prompts/code.md.
 loop/code-ci-pending
Prompt "code" finished; waiting for the PR's CI to pass before advancing.
 loop/code-done
Prompt "code" finished successfully.
 loop/code-in-process
Agent for the "code" prompt is currently running on this issue.
 loop/merge
Managed by agentloop
 loop/merge-done
Managed by agentloop
 loop/merge-in-process
Managed by agentloop
 loop/plan
Add to run the built-in "plan" prompt; override at prompts/plan.md.
 loop/plan-done
Prompt "plan" finished successfully.
 loop/plan-in-process
Agent for the "plan" prompt is currently running on this issue.
No labels loop/code-done
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
guettlibot guettli
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: guettli/sharedinbox#404