Drop creating secrets.yml and just use SECRET_KEY_BASE env
#365
Conversation
|
😢 looks like 5.0 and 5.1 are running into rails/rails#54260 and likely won't get any Rails fix since 6.1 is end of life. Perhaps the Redmine Gemfile needs to pin the |
|
🤔 It looks like our elif [ ! -f config/initializers/secret_token.rb ]; then
rake generate_secret_token
fi |
|
Hmm, if that command still works and does the right thing, that seems sane. |
| fi | ||
| : "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}" | ||
|
|
There was a problem hiding this comment.
Concretely, adding this to fix the 6.0 test failure (and maybe also a warning that they should save their config/initializers/secret_token.rb file?):
| if [ -n "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then | |
| rake generate_secret_token | |
| fi | |
There was a problem hiding this comment.
You mean -z there, right? (not -n)
There was a problem hiding this comment.
Also, do we need to explicitly unset SECRET_KEY_BASE if it's empty, or does it get ignored properly? (We need to export SECRET_KEY_BASE otherwise as well, right?)
if [ -n "$SECRET_KEY_BASE" ]; then
export SECRET_KEY_BASE
else
unset SECRET_KEY_BASE
if [ ! -f config/initializers/secret_token.rb ]; then
# TODO warning?
rake generate_secret_token
fi
fiThere was a problem hiding this comment.
Added so 6.0 is working now.
yosifkit
force-pushed
the
better-keybase
branch
from
d51b58c to
a57cd24
Compare
@marius-balteanu is this something that's already on your radar? 😅 (fresh installs of Redmine 5.x fail to start thanks to dependency updates 🙈) |
|
👀 Oh, there are fixes applied for |
|
That looks pretty reasonable to apply in our builds 👀 |
| apt-get install -y --no-install-recommends patch; \ | ||
| wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \ | ||
| echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \ | ||
| patch -p1 < 42113.patch; \ |
There was a problem hiding this comment.
This can technically be patch -p1 --input=42113.patch, but I don't think it's that important. 👍
| echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \ | ||
| patch -p1 < 42113.patch; \ | ||
| rm 42113.patch; \ | ||
| apk del --no-network patch; \ |
There was a problem hiding this comment.
It's possible BusyBox's patch is enough, but it's not that important (esp. as it's temporary) 👍
Changes: - docker-library/redmine@087f78a: Merge pull request docker-library/redmine#365 from infosiftr/better-keybase - docker-library/redmine@922b31e: Backport https://www.redmine.org/issues/42113 patch for 5.x - docker-library/redmine@a57cd24: Drop secrets.yml and just use `SECRET_KEY_BASE`
| # just use the rails variable rather than trying to put it into a yml file | ||
| # https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438 | ||
| # https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable) | ||
| if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then |
There was a problem hiding this comment.
Doh, this will error out if SECRET_KEY_BASE isn't set, right?
Changes: - docker-library/redmine@8d36a1a: Merge pull request docker-library/redmine#366 from infosiftr/single-template - docker-library/redmine@b160f7a: Move to a single template for Debian and Alpine - docker-library/redmine@087f78a: Merge pull request docker-library/redmine#365 from infosiftr/better-keybase - docker-library/redmine@922b31e: Backport https://www.redmine.org/issues/42113 patch for 5.x - docker-library/redmine@a57cd24: Drop secrets.yml and just use `SECRET_KEY_BASE`
Rails 7.1-7.2 deprecated/removed
config/secrets.ymlusage and instead usecredentials, so our generatedsecrets.ymlis no longer used (which is the cause of #349).Rails 7.2 is used in Redmine 6.0+. Rails 6.1 is used in Redmine 5.0 and 5.1. Rails 7.2 and 6.1 both support the
SECRET_KEY_BASEenvironment variable, so let's use that instead. Users can continue to use theREDMINE_SECRET_KEY_BASEorREDMINE_SECRET_KEY_BASE_FILEvariables or swap toSECRET_KEY_BASE.Fixes #349
See removals and deprecations:
https://guides.rubyonrails.org/7_1_release_notes.html
https://guides.rubyonrails.org/7_2_release_notes.html