0

I get the following error for my github project after commiting my code on travis-ci.org:

Deploying application

on master ✓
domain: <mydomain> ✓
site path: /srv/http/webapps/Main ✓
zipping _site to site.zip...
decrypting ssh key...
bad magic number

Script failed with status 1
failed to deploy

I have forked a project that I'm trying to take over and maintain as the project is being discontinued by it's author, which I think is a shame. This project uses travis to update it's site. I'm completely unfamiliar with both travis, never got around encryption and in fact never set up a site before, so I'm completely clueless to what I'm doing.

I'm using three computers to achieve this. My own, a development computer and the site hosting one.

The files I think that are relevant are .travis.yml, .deploy/deploy.sh and .deploy/deploy_key.enc

What I've done is the following:

sudo ssh root@UBS-main
cd /srv/http/webapps/Main
nano .travis.yml (removing env.global.secure line)
ssh-keygen -t rsa -b 4096 -C 'build@travis-ci.org' -f ./deploy_key
travis encrypt-file deploy_key --add
travis encrypt MY_SECRET_ENV=<pass> --add env.global
rm deploy_key
scp /srv/http/webapps/Main/deploy_key.enc folatt@UBS-Dev:~/workspace/UBS/UBS-site/deploy/deploy_key.enc
scp /srv/http/webapps/Main/.travis.yml folatt@UBS-Dev:~/workspace/UBS/UBS-site/.travis.yml

This is assuming that I

  1. need to create an ssh key
  2. Encrypt this key using travis.
  3. Need some kind of secret password?? using travis again.
  4. remove the unencrypted key.
  5. Move the key and travis file to the development computer repository.
  6. And then commit the changes to github.

.travis.yml

language: ruby
sudo: false
rvm:
- 2.2
env:
  global:
  - domain: <mydomain> (changed)
  - site_path: /srv/http/webapps/Main (changed)
  - secure: <bunch of encrypted code> (changed)
before_script:
  - npm install -g bower
  - bower install
script: bundle exec jekyll build
deploy:
  provider: script
  skip_cleanup: true
  script: "./deploy/deploy.sh"
  on:
    branch: master

./deplay/deploy.sh

#!/usr/bin/env bash
set -e

if [ ! "env:$TRAVIS_BRANCH" == "env:master" ]; then
    echo not on master, not deploying
    exit 0
fi

echo "on master ✓"

if [ -z "$domain" ]; then
    echo "domain" variable not set
    exit 1
fi
echo "domain: $domain ✓"

if [ -z "$site_path" ]; then
    echo "site_path" variable not set
    exit 1
fi
echo "site path: $site_path ✓"

echo "zipping _site to site.zip..."
(cd _site/ && zip -r - .) > site.zip 2>/dev/null

echo "decrypting ssh key..."
openssl aes-256-cbc -k "$deploy_key_pass" -in deploy/deploy_key.enc -out deploy/deploy_key -d
chmod 400 deploy/deploy_key

echo "setting StrictHostKeyChecking for all domains..."
printf "Host *\n    StrictHostKeyChecking no\n" > ~/.ssh/config
chmod 400 ~/.ssh/config

echo "copying site to $domain..."
scp -i deploy/deploy_key site.zip deploy@$domain:~/site.zip
ssh -i deploy/deploy_key deploy@$domain 'rm -rf "'$site_path'"/* && unzip ~/site.zip -d "'$site_path'" && rm ~/site.zip'
  • First for debugging I would do all this temporary using unencrypted env vars and files. Once it's working you encrypt things step by step. When you get this working too, re-create all keys etc. and commit them encrypted only. That's how I got familiar with these travis features in past. – rudimeier May 12 '17 at 10:26
0

Solved so far as the key had to be decrypted differently and the bad magic number goes away.

openssl aes-256-cbc -K $encrypted_<...>_key -iv $encrypted_<...>_iv -in deploy_rsa.enc -out /tmp/deploy_rsa -d

Where $encrypted_<...>_key and $encrypted_<...>_iv are generated by travis encrypt-file deploy_rsa --add.

See https://oncletom.io/2016/travis-ssh-deploy/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.