Setup with Nextcloud AIO

[bigbeka]

Issue: Error - Java not installed message;
Advice: Run occ libresign:install --java

To reproduce:

• Download and enable LibreSign from list of Nextcloud apps
• Click on 'Downloads Binaries'
• Wait for the list of items to show up and some of them errored out

Screenshots

Environment information (please complete the following information):

• OS: Proxmox > LXC > Docker > Nextcloud official container
• Browser Safari
• LibreSign Version 6.2.5
• Nextcloud Server Version 25.0.3

Searching here or elsewhere did not reveal that someone else had similar issue.

[Prodject]

I tried on two versions - Ubuntu latest + apache + nextcloud and mac M1 native docker + nextcloud.
There is a similar error, more precisely - on 6.2.5 Java installation error, and on 6.2.3 cfssl installation and configuration error.
Also tried to manually install all dependencies via php occ libresign:install --all. Installation doesn't throw errors, but dependency validation fails.

It seems to me that developers may return the http api url manual installation mode to be able to install packages in a separate container / vm. Or add the ability to provide installation of dependencies from an offline bundle package

[bigbeka]

@Prodject Thanks for the followup message and further reproducing. Hoping to get this sorted soon.

[Prodject]

Hoping to get this sorted soon

I tried to roll back to version 4.2.1 - I got a successful result of downloading dependencies. I also tried to update the version to 6.2.5 - the dependencies were preserved, but there was a bug that the current signature could not be changed.
In v.4.2.1 there was also a bug with a signature overlay conflict in pdf, I could not fix it either, and it was saved in 6.2.5.

[lhsazevedo]

Could you try in the latest release (6.2.6)?
Note that this release is compatible with Nextcloud 25 only. We do not support previous versions anymore, as we haven't sufficient funding at the moment.

[bigbeka]

@lhsazevedo updated LibreSign to 6.2.6 with Nextcloud being 25.0.3, tried to 'Download binaries', still shows the same errors.
I have also tried to remove LibreSign completely and 'Download and Enable' from within the UI, no luck there either. Any other troubleshooting I can be doing?
Nextcloud docker logs does't shown any errors while 'Download binaries' process.

[Prodject]

Could you try in the latest release (6.2.6)? Note that this release is compatible with Nextcloud 25 only. We do not support previous versions anymore, as we haven't sufficient funding at the moment.

I have now tried a clean installation of docker v.4.16.2 + nextcloud latest (docker pull nextcloud:latest) + LibreSign 6.2.6. After clicking the "Download" button, the installation lasts only a few seconds and the button becomes active again (at the same time, only one dependency is installed). In version 6.2.5 there was an identical error (loading only a few seconds)

[lhsazevedo]

Thanks for reporting @bigbeka and @Prodject. I'll setup environments similar to yours and try to reproduce the issue to further investigate this problem.

[bigbeka]

@lhsazevedo many thanks. I will run a fresh install on a fresh VM, and try to run LibreSign's download binaries as well and see if that works out.

[bigbeka]

Okay, so this is interesting. Fresh VM > Fresh Docker & Compose > Fresh Nextcloud install. And it worked, I can’t get the imagick working to generate the previews when assigning signature positions on the actual pdfs.

@lhsazevedo what would you suggest the next troubleshooting should be?
How do I get LibreSign working on my production?

I have disabled most of the apps on my Nextcloud instance to test if there are any conflicts (no luck here).

Screenshot from test setup:

[lhsazevedo]

I'm glad you made it. Now looks like you are missing the optional ghostscript dependency, that is only need for adding visible signatures.

Since you are using the Nextcloud AIO container, you'll need to add it to the NEXTCLOUD_ADDITIONAL_APKS environment variable and rebuild the image. Read more about it: How to add OS packages permanently to the Nextcloud container?. Make sure to also specify the default imagemagick, as the doc warns.

@Prodject I've just released a new version (6.2.7) which fixes a bug in the "download binaries" that was preventing the progress bars from showing which might fix your issue. Could you try again with this new version, in a clean installation?

[bigbeka]

@lhsazevedo Would you look at that! Many thanks for the update, LibreSign 6.2.7 did the trick with my production as well (I just had to update LibreSign in Nextcloud GUI), all success apart from imagick, which I believe I will need to rebuild NextCloud AIO with Nextcloud_additional_APKS as you mentioned. Thank you for the link and your work on this!

@lhsazevedo Off-topic question: Is there a way to ask for signatures without requiring for an account? This features would really get it close to DocuSign (Clinex of signature validations).

[lhsazevedo]

Great! Happy to help. Let us know if you got it fully working.

At the moment, a Nextcloud account is required for signing the document, but we are aware that removing this requirement would fit LibreSign to lots of use cases out there. This will require some significant rework in the app though, we are planning this in #1406.

@Prodject I'm closing this for now, but don't hesitate to ping us if it still fails in a clean install.

[bigbeka]

@lhsazevedo We might need to reopen this, as original issue came back, right after I tried to add "imagick" to -e NEXTCLOUD_ADDITIONAL_APKS and I re-pulled the latest Nextcloud Docker image in this process.

I can confirm that the same issue came up when I re-pulled the latest image for the fresh/test instance.

This is on my production instance:

Could you suggest how to go about this now?

[lhsazevedo]

Thanks for reporting again.
Sure. I suggest you to running the following commands:

# Uninstall all LibreSign binaries (Java, cfssl etc)
php occ libresign:uninstall --all

# Update Nextcloud filesystem nodes for libresign app data
php occ files:scan-app-data libresign

Then proceed to the settings page and try downloading the binaries again. I've found that sometimes I need to click "download binaries" button for a second time when the first one fails.

If that doesn't work, you could also repeat the commands above but this time download the binaries using the CLI:

# Uninstall LibreSign binary dependencies (Java, cfssl etc)
php occ libresign:uninstall --all

# Update Nextcloud filesystem nodes for libresign app data
php occ files:scan-app-data libresign

# Install LibreSign binary dependencies
php occ libresign:install --all

Either way, please report the results here to help us track this down.

[bigbeka]

Many thanks @lhsazevedo , you are the best!

So I managed to get the dependencies installed with 3 CLI commands:

php occ libresign:uninstall --all
php occ files:scan-app-data libresign
php occ libresign:install --all

GUI 'Downloads binaries' did not help.

Running the second command gave me an error, which is not related to LibreSign, it is actually being tracked here.

I have also tried to recreate the Nextcloud container, dependencies seem to be working and are not showing any errors.

For the life of me, I can't get imagick working, as you suggested, I have added -e NEXTCLOUD_ADDITIONAL_APKS="imagick imagemagick".

• Would you have any suggestions on this?

[bigbeka]

Reading through the internet, I came across this, which might be interesting: nextcloud/server#13099 (comment)

Would you guys consider switching from imagick to something else as suggested in the above discussion?

[BicycleMarketResearchLLC]

Thank you all for working on this, I have been following and trying the suggested resolutions. I keep getting this error in the GUI. It seems like a slight version mismatch in JRE:

Invalid java version. Found: sh: /mnt/ncdata/appdata_ocmmonyuk9bz/libresign/java/jdk-17.0.5+8-jre/bin/java: not found expected: openjdk version "17.0.5" 2022-10-18

Do you know if there is a mechanism to specify the correct version of java for the install? I am on the latest AIO deployment of Nextcloud on an Ubuntu VPS.

[lhsazevedo]

No problem, I'm learning a lot while trying to understand what is happening!

Oh, that should be -e NEXTCLOUD_ADDITIONAL_APKS="imagemagick ghostscript", where:

• imagemagick is the sole default value of NEXTCLOUD_ADDITIONAL_APKS, we are just keeping it:

  By default added is imagemagick. If you want to keep that, you need to specify it. (source)

• ghostscript is the dependency that was missing here

That should fix it.

Thanks for sharing the concerns around imagick vulnerabilities. The app uses it only for rendering pages when adding visible signatures, it would be necessary to estimate the work required to switch to a safer alternative like the new Imaginary service mentioned in the thread you sent. Would you mind creating an issue for this?

---

Hi @BicycleMarketResearchLLC, I guess the cause of your problem is not related to this one. Could you open a new issue for it?

[lhsazevedo]

@bigbeka We improved error logging for the setup process in v6.2.9 (Nextcloud 25) and v7.0.0 (Nextcloud 26).

Maybe we can get more details about your issue. Try downloading binaries again and, if it fails, please share the last entries from data/nextcloud.log.

[bigbeka]

Hi @lhsazevedo Thank you very much! I have now upgraded my NC25 to NC26.0.0

I had deleted LibreSign before doing this, so I downloaded LibreSign 7.0.0 and tried to download binaries and here are the errors that it output. Does it tell anything useful?

[bigbeka]

@lhsazevedo After trying (with no luck) the new version, I tried manually running CLI commands you shared above, and they worked as expected, but the imagemagick is still not working. 🤷‍♂️ I have added - NEXTCLOUD_ADDITIONAL_APKS="imagemagick ghostscript" in the Nextcloud's docker-compose environment script.

Any other thoughts on this?

Oh, that should be -e NEXTCLOUD_ADDITIONAL_APKS="imagemagick ghostscript", where:

• imagemagick is the sole default value of NEXTCLOUD_ADDITIONAL_APKS, we are just keeping it:

  By default added is imagemagick. If you want to keep that, you need to specify it. (source)

• ghostscript is the dependency that was missing here

That should fix it.

[vitormattos]

Ghostscript and ImageMagick is mandatory. You need to have both at server machine.

[lhsazevedo]

Any other thoughts on this?

Either you do not have ghostscript installed or LibreSign wasn't able to detect it, the former is most likely. You can check by opening a shell in your Nextcloud container and typing gs --version.

[bigbeka]

@lhsazevedo Thank you, as always, you were right, gs is not installed despite the fact that I have the -e NEXTCLOUD_ADDITIONAL_APKS="imagemagick ghostscript" added to my docker-compose.yml.

Your suggestions on this error would be greatly appreciated. I will do some googling.

[bigbeka]

Hi @lhsazevedo Thank you very much! I have now upgraded my NC25 to NC26.0.0

I had deleted LibreSign before doing this, so I downloaded LibreSign 7.0.0 and tried to download binaries and here are the errors that it output. Does it tell anything useful?

@lhsazevedo It would be great to resolve this, as I am back in square 1 with 'Download Binaries'. As soon as I re-pull the image and docker-compose up I get the following state:

[lhsazevedo]

Oops, I missed your comment about the error log. I'll take a look into it later this weekend. Thank you for your patience.

[bigbeka]

I will try it now. Do I need to delete anything manually before reinstalling? I already had LibreSign installed on my instance of NC.

[bigbeka]

Magic!! It all works as it should! Thank you for implementing additional identification factors. They all work like charm. All dependencies are installed with a click of a button!
I tested signing with "Email" both with "Request to create account..." and without. Both worked.

Although the "Identification documents" doesn't seem to work. The flow does not ask to upload any ID docs.

I made a lot of changes at setup flow.

Who with Nextcloud AIO could help testing again to check if this issue was solved?

[vitormattos]

Wow! Very happy by your feedback!

Although the "Identification documents" doesn't seem to work. The flow does not ask to upload any ID docs.

Could you open an issue about this?

I think that now is the time to close this issue. It's the party time!

Note

If you like this app, don't hesitate to help us

Ways to help this project:

• Creating a very nice review of this project at:
  • social networks like LinkedIn, Instagram, etc and putting the @LibreSign and @LibreCodeCoop
  • AlternativeTo https://alternativeto.net/software/libresign/
  • Nextcloud apps store: https://apps.nextcloud.com/apps/libresign
• Sponsoring the development by GitHub sponsor https://github.com/sponsors/LibreSign
• helping the translations on Transifex
• contacting us to have Enterprise support: https://libresign.coop

[martin-77]

Please reopen: @vitormattos

Not working on nextcloud-aio with manual upgrade to hub 8
same was on hub 7

errors:

c2bc57ffc481:/var/www/html$ php occ libresign:configure:check
 --------- ----------------- --------------------------------------------------------------------------------------------------- -----------------------------------
  Status    Resource          Message                                                                                             Tip
 --------- ----------------- --------------------------------------------------------------------------------------------------- -----------------------------------
   error    java              Java binary not found: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java   Run occ libresign:install --java
   error    pdftk             PDFtk binary is invalid: /mnt/ncdata//appdata_ocmhlw0tagos/libresign/pdftk.jar                      Run occ libresign:install --pdftk
   error    jsignpdf          Necessary Java to run JSignPdf                                                                      Run occ libresign:install --java
  success   cfssl             CFSSL binary path: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/cfssl
  success   cfssl             CFSSL: Version: 1.6.4, Runtime: go1.18
  success   cfssl-configure   Root certificate config files found.
 --------- ----------------- --------------------------------------------------------------------------------------------------- -----------------------------------
c2bc57ffc481:/var/www/html$ php occ libresign:install --all
Downloading java...
    0 [>---------------------------]Failure on download java try again.
Directory /mnt/ncdata//appdata_ocmhlw0tagos/libresign/java does not exist for sink value of /mnt/ncdata//appdata_ocmhlw0tagos/libresign/java/OpenJDK21U-jre_x64_linux_hotspot_21.0.2_13.tar.gz
    0 [->--------------------------]
    0 [--->------------------------]Failure on download java, empty file, try again 

/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java: folder is empty
/mnt/ncdata**//**appdata_ocmhlw0tagos/libresign/pdftk.jar: strange error //

any idea how to fix the // error?

[vitormattos]

Try to run the occ command:
occ files:scan-app-data libresign

[martin-77]

Command shows 8 folders and 26 files.

[vitormattos]

Check now if all is working fine.

You also can use the UI at Administration Settings > LibreSign

[martin-77]

Still the same. tried occ uninstall and install, java stays uninstalled. Or to be more precise:

the // thing is gone, but still:

c2bc57ffc481:/var/www/html$ php occ libresign:configure:check
 --------- ----------------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -----------------------------------
  Status    Resource          Message                                                                                                                                                                    Tip
 --------- ----------------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -----------------------------------
   error    java              Invalid java version. Found: sh: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java: not found expected: openjdk version "21.0.2" 2024-01-16 LTS   Run occ libresign:install --java
   error    pdftk             PDFtk binary is invalid: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/pdftk.jar                                                                                              Run occ libresign:install --pdftk
   error    jsignpdf          Necessary Java to run JSignPdf                                                                                                                                             Run occ libresign:install --java
  success   cfssl             CFSSL binary path: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/cfssl

  success   cfssl             CFSSL: Version: 1.6.4, Runtime: go1.18

  success   cfssl-configure   Root certificate config files found.

 --------- ----------------- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -----------------------------------

tried

php occ libresign:uninstall --all
php occ files:scan-app-data libresign
php occ libresign:install --all

nothing changed

[vitormattos]

Sounds that could be related with:

• [fixed] LibreSign v8.0.0-rc5 fails configuration check on settings page #2327

The issue #2327 already was solved but is open because is necessary to think more about how to give tips to identify that is a problem related to policies of SELinux.

To identify if is about policy, try to run the command to check the java version directly at the terminal of your server.

/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java --version

And first, check if this file (java) exists.

[martin-77]

java is not installed, folder is empty

c2bc57ffc481:/var/www/html$ /mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java --version
bash: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/java: cannot execute: required file not found

edit: have to correct myself:

c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin$ ls -la
total 104
drwxr-xr-x 2 www-data www-data  4096 Apr 26 17:12 .
drwxr-xr-x 6 www-data www-data  4096 Apr 26 17:12 ..
-rwxr-xr-x 1 www-data www-data 16240 Jan 17 06:55 java
-rwxr-xr-x 1 www-data www-data 16304 Jan 17 06:55 jfr
-rwxr-xr-x 1 www-data www-data 16344 Jan 17 06:55 jrunscript
-rwxr-xr-x 1 www-data www-data 16312 Jan 17 06:55 jwebserver
-rwxr-xr-x 1 www-data www-data 16304 Jan 17 06:55 keytool
-rwxr-xr-x 1 www-data www-data 16336 Jan 17 06:55 rmiregistry
c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin$ ./java --version
bash: ./java: cannot execute: required file not found

[vitormattos]

Have anything strange because you have the file and the message is not about without file, sounds that is about any dependency wrong.

The file is downloaded from here if is x64
https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2+13/OpenJDK21U-jre_x64_linux_hotspot_21.0.2_13.tar.gz

And from here if is aarch64:
https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2+13/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.2_13.tar.gz

Could you download the tar file to your architecture, extract and test if bin/java --verison will work fine? Pay attention to directory.

To use the same way of LibreSign to identify the architecture, you can use the follow command:

php -r "echo php_uname('m') . PHP_EOL;"

The logic to choose what file will be downloaded considering the return of function php_uname is that:

if ($architecture === 'x86_64') {
} else {
}

[martin-77]

Ok, this is crazy - maybe I make a mistake, but even the downloaded version does not work (forget about wrong folders I produce)

c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/jdk-21.0.2+13-jre/bin$ php -r "echo php_uname('m') . PHP_EOL;"
x86_64
c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/jdk-21.0.2+13-jre/bin$ ./java --version
bash: ./java: cannot execute: required file not found
c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/jdk-21.0.2+13-jre/bin$ ls -la
total 104
drwxr-xr-x 2 www-data www-data  4096 Jan 17 06:55 .
drwxr-xr-x 6 www-data www-data  4096 Jan 17 06:55 ..
-rwxr-xr-x 1 www-data www-data 16240 Jan 17 06:55 java
-rwxr-xr-x 1 www-data www-data 16304 Jan 17 06:55 jfr
-rwxr-xr-x 1 www-data www-data 16344 Jan 17 06:55 jrunscript
-rwxr-xr-x 1 www-data www-data 16312 Jan 17 06:55 jwebserver
-rwxr-xr-x 1 www-data www-data 16304 Jan 17 06:55 keytool
-rwxr-xr-x 1 www-data www-data 16336 Jan 17 06:55 rmiregistry
c2bc57ffc481:/mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/bin/jdk-21.0.2+13-jre/bin$

the folder contains the same files as the java/bin which was downloaded by libresign itself. Not sure if I make a mistake...

[vitormattos]

the folder contains the same files as the java/bin which was downloaded by libresign itself. Not sure if I make a mistake...

Yes, is the same content because is the same file that LibreSign setup get.

Did you put at the same place? I ask because at your previous message is the same place. The place to extract the content is not important at this moment because I suggested to download and run the handmade test only to check if will works to you and the strange is that don't works.

[martin-77]

It is in ab sub-sub-folder of libresign.
but something prevents java from being executed. And I do not understand, why at all. the java file is executable by www-data and I am www-data...

[vitormattos]

Yes, this is the strange point and I don't know how to solve. Let's think more about and wait for comments from others.

[cube-one-gxp-lifescience-partner]

Hello, same issue as @martin-77 . This might have something to do with the docker containers using alpine. Java can be executed as expected outside the container on ubuntu.

[martin-77]

Are you on nc28 or 29? @cubeoneGmbH

[cube-one-gxp-lifescience-partner]

I'm on nc28.

[neocult-de]

I am testing LibreSign on NC28 with Nextcloud-AIO. The issue is that the container is alpine which is not build with glibc libraries and therefore the Java cant be executed inside the container. Running the following adds compatibility to glibc and then java and pdftk for that matter will be recognized and work for me.

apk add gcompat libstdc++

Please keep in mind, that this task might need to be repeated every time nextcloud-aio-nextcloud is updated. The dependencies are in the persistent ncdata folder though.

An automation could be to put the call to install gcompat into cron (as root or a user in the docker group) and schedule it after the nightly backup/update for nextcloud-aio:

0 5 * * * docker exec -it nextcloud-aio-nextcloud apk add gcompat libstdc++

Hope that helps people want to try LibreSign with Nextcloud-AIO

EDIT: It is no longer working for me after repulling the container. It makes java executable and able to run but will not initialize the JVM correctly.

As a workaround for testing:
Install all the binaries, but replace the java version with an alpine compatible one. The one available in alpine directly via:

apk add openjdk11

Then make a symlink

ln -s /usr/bin/java java #inside the java/bin folder of libresign

or

ln -s /usr/bin/java /mnt/ncdata/appdata_YOURID/libresign/java/jdk-VERSION-jre/bin/java

Keep in mind the java version check will still fail in the gui because you have another version now running, but pdftk should be on green. You have working java version in alpine and the Addon works. But it is untested.

[martin-77]

sadly, this did not solve my issue. running v29 - maybe there is something different?

Error occurred during initialization of VM
Unable to load jimage library: /mnt/ncdata/appdata_ocmhlw0tagos/libresign/java/jdk-21.0.2+13-jre/lib/libjimage.so

libjimage.so is not in the lib-folder

[cube-one-gxp-lifescience-partner]

Unfortunately this is also the case for nc28 but the libjimage.so file is existing and has correct permissions.

[cube-one-gxp-lifescience-partner]

With the updated solution @neocult-de provided PDFtk is now recognized properly. But jsignpdf still won't run and so does the whole application.

"Necessary Java to run JSignPdf | jsignpdf"

[vitormattos]

ref: #3026

[vitormattos]

Do you think that using Alpine as a base Linux distribution will be possible to reproduce the problem? I don't have any instances with Nextcloud AIO and looking at the documentation of AIO, I haven't found a way to run AIO locally to reproduce the issue.

[martin-77]

@szaimen might be the one, we all need ;-) sorry for the ping...
But to be honest, libresign would be wonderfull see implemented in Nextcloud AIO.

[szaimen]

Hi @vitormattos you could try nextcloud/all-in-one#588 (comment)

[martin-77]

It is not the questiuon of setting up Nextcloud-AIO itself but adding jdk-21.0.2+13-jre / java jdk on top of the the alpine image.
As you can see, a simple apk install did not do the trick -> #1409 (comment) - maybe you find some time to support or inspire us @szaimen .
And thanks for your quick reply! You are unbelievable!

[szaimen]

Should be possible by so, no?
https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-add-os-packages-permanently-to-the-nextcloud-container