Issues with new repositories on travis-ci.com

[kwilcox]

Travis is migrating from travis-ci.org to travis-ci.com for new repositories. I can't get a new project working with doctr on .com. I've regenerated the keys multiple times and still receive the following CI error. Could it be a different private key on .com that is preventing the decryption of the secure env variable?

Error: DOCTR_DEPLOY_ENCRYPTION_KEY_IOOS_ATN_DOCS or DOCTR_DEPLOY_ENCRYPTION_KEY environment variable is not set

Repo in question: https://github.com/ioos/atn-docs
Travis CI Builds: https://www.travis-ci.com/ioos/atn-docs/builds

[asmeurer]

I didn't know about that migration. Currently .org is hard-coded in some places, and it assumes that .com means a private repository.

If I go to https://www.travis-ci.org/ioos/atn-docs/builds it exists but doesn't have any builds. Do you know why that is?

I suspect when you ran doctr configure it encrypted the keys using the public key for https://www.travis-ci.org/ioos/atn-docs/.

We need to determine how to tell what the "correct" one of .org and .com is and use it when configuring (and some other hard-coded things need to be fixed as well).

[kwilcox]

Some background on the transition is here: https://blog.travis-ci.com/2018-05-02-open-source-projects-on-travis-ci-com-with-github-apps

Seems they have started the process to deprecate .org, before today I was always able to add new repos.

[asmeurer]

So I'm curious if you go to https://github.com/ioos/atn-docs/settings/installations do you see Travis CI twice?

[kwilcox]

I only see it once under Installed GitHub Apps

[asmeurer]

I've been able to reproduce the situation with https://github.com/drdoctr/travis-ci-com-testing. I get the same error at https://travis-ci.com/drdoctr/travis-ci-com-testing but the builds work at https://travis-ci.org/drdoctr/travis-ci-com-testing, which I was able to activate concurrently.

[asmeurer]

So as far as I can tell, travis-ci.com requires authentication in the API call to get the public key. So I'm going to have to figure out how to do that. The current private repo code generates a GitHub token, but I think Travis has its own token that is used.

[asmeurer]

It looks like the recommended

travis login
travis token

generates a token on GitHub and then deletes it. I got an email after running the command:

Hey asmeurer!

A personal access token (temporary token to identify with the travis command line client against https://api.travis-ci.org/) with read:org, repo:status, repo_deployment, user:email, and write:repo_hook scopes was recently added to your account. Visit https://github.com/settings/tokens for more information.

[asmeurer]

For some reason when I try logging in I keep getting requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://api.github.com/. I'm going to pick this up later I think. I think we just need to detect if we are on travis-ci.com and run the private repo code. Annoyingly, this means travis-ci.com will require authentication, unless I am doing it wrong. I also don't know how to do the detection just yet.

[asmeurer]

I have opened an upstream issue on Travis about the apparent requirement of authentication on travis-ci.com travis-ci/travis-ci#9954. Unless it is resolved, it will no longer be possible to run doctr configure --no-upload-key on repos that use travis-ci.com, as they require GitHub authentication to download the public key.

I am still working on a PR to add support for it.

[asmeurer]

Work in progress pull request at #310.

[asmeurer]

A little debugging info (we should probably add to the docs). If you see a message like

$ export 1kuDMmayLsp3Puh79JUgl7QuU3Ht36tx0kCzt1WfuP8fww=[secure]
The previous command failed, possibly due to a malformed secure environment variable.
Please be sure to escape special characters such as ' ' and '$'.
For more information, see https://docs.travis-ci.com/user/encryption-keys.

near the top of the build log, and then doctr fails with

Error: DOCTR_DEPLOY_ENCRYPTION_KEY_DRDOCTR_TRAVIS_CI_COM_TESTING or DOCTR_DEPLOY_ENCRYPTION_KEY environment variable is not set

Or if you get

cryptography.fernet.InvalidToken

It means either

• you updated the .enc file but not the secure environment variable in .travis.yml, or visa versa
• you encrypted the token with the wrong service (travis-ci.com instead of .org or visa versa)