Comments 03-vomsproxy

[katilp]

• fix link https://awesome-workshop.github.io/continuous-integration-deployment-gitlab/14-the-spy-game/index.html to https://awesome-workshop.github.io/continuous-integration-deployment-gitlab/12-the-spy-game/index.html

• on lxplus, there's an error message from base64 for the demo example (although it does what is expected):

[kati@lxplus700 ~]$ echo "SSB3aWxsIG5ldmVyIHB1dCBteSBzZWNyZXRzIHVuZGVyIHZlcnNpb24gY29udHJvbAo" | base64 -d
I will never put my secrets under version control
base64: invalid input

• advise where to put the voms-proxy fragment or what needs to be modified in the existing file. If I put it in my existing .gitlab-ci.yml (and comment the cmssw compilation with .cmssw_compile (as it takes time), it results to This GitLab CI configuration is invalid: voms_proxy job: stage parameter should be .pre, build, test, deploy, .post on gitlab web interface commit (removing stage: getproxy solves this)

• a problem with voms-proxy: https://gitlab.cern.ch/kati/gitlab-cms/-/jobs/7201547 . The variable GRIDUSER_CERT should be properly set in my repo from a valid usercert with cat ~/.globus/usercert.pem | base64 Retried to check if copy-paste error, but no change. The trailing = is there. base64 gave no errors/warnings in this case.

  • chmod 400 usercert.pem missing but adding it does not help (maybe not needed?)
  • certificate files are only two first lines even if they are properly set in the respective ci variables

➡️ Problem solved with printf -> echo, and base64 -di, see below

• Is there as reason to use $GRID_USERCERT (without braces) and ${GRID_PASSWORD} (with braces)?

[katilp]

For the certificates, they both appear to have just first two lines, at least with head -2 and tail -3 in the job, even if the full string is in the Variables page. So something still goes broken with line breaks.

I can fix this by using
echo ${GRID_USERCERT} | base64 -di -w 0 > ${HOME}/.globus/usercert.pem
i.e. echo instead of printf, and base64 with option -di

printf gives for some reason only the top part of the string, and when using echo base64 needs the -i flag to avoid some end-of-line junk