ValueError on installation of Github Integration

[rics3n]

Important Details

How are you running Sentry?

• On-Premise docker [Version 9.1.1]
• Saas (sentry.io)

Description

Unable to install the Github Integration. The error seems to happen when the private key is loaded. sentry config get github-app.private-key is showing the correct key with newlines separated by \n as described in the docs and in this issue.

Steps to Reproduce

1. Follow the guide from the docs to configure the Github Integration
2. Install Github Integration trough settings/<orga>/integrations/
3. In the Github popup click on install
4. Github is redirecting to sentry and sentry throws the following error

Stacktrace of the error:

  File "/usr/local/lib/python2.7/site-packages/sentry/pipeline/__init__.py", line 207, in current_step
    return self.finish_pipeline()
  File "/usr/local/lib/python2.7/site-packages/sentry/integrations/pipeline.py", line 41, in finish_pipeline
    data = self.provider.build_integration(self.state.data)
  File "/usr/local/lib/python2.7/site-packages/sentry/integrations/github/integration.py", line 234, in build_integration
    identity['access_token'], state['installation_id'])
  File "/usr/local/lib/python2.7/site-packages/sentry/integrations/github/integration.py", line 207, in get_installation_info
    'Authorization': 'Bearer %s' % get_jwt(),
  File "/usr/local/lib/python2.7/site-packages/sentry/integrations/github/utils.py", line 27, in get_jwt
    return jwt.encode(payload, github_private_key, algorithm='RS256')
  File "/usr/local/lib/python2.7/site-packages/jwt/api_jwt.py", line 56, in encode
    json_payload, key, algorithm, headers, json_encoder
  File "/usr/local/lib/python2.7/site-packages/jwt/api_jws.py", line 102, in encode
    key = alg_obj.prepare_key(key)
  File "/usr/local/lib/python2.7/site-packages/jwt/algorithms.py", line 207, in prepare_key
    key = load_pem_public_key(key, backend=default_backend())
  File "/usr/local/lib/python2.7/site-packages/cryptography/hazmat/primitives/serialization/base.py", line 20, in load_pem_public_key
    return backend.load_pem_public_key(data)
  File "/usr/local/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1071, in load_pem_public_key
    self._handle_key_loading_error()
  File "/usr/local/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1329, in _handle_key_loading_error
    raise ValueError("Could not deserialize key data.")
ValueError: Could not deserialize key data.

What you expected to happen

The github integration should be installed successfully.

[markstory]

Sounds like you key is invalid or corrupt.

[rics3n]

This was also my first gut feeling. I created multiple keys in my github app and converted them all to \n format. Also tried without it but no luck.

This is the format which I understand should work.

github-app.private-key: "-----BEGIN RSA PRIVATE KEY-----\n<PRIVATE KEY LINE 1>\n....\n<PRIVATE KEY LINE N>\n-----END RSA PRIVATE KEY-----"

Can anyone confirm that it works with version 9.1.1?

[chrisella]

Same problem here.

ValueError: Could not deserialize key data.

In the callback from adding the GitHub app. Any updates would be appreciated.
I've also tried with 2 keys, each with newlines converted to no avail.

[chrisella]

Ah finally got it working, the difference this time was I made sure the private string had a trailing \n
Give that a go, maybe you'll be as lucky.

[rics3n]

Thanks for the answer, but no luck for me. I now also executed the code from utils.py inside a python interpreter session with the key returned by sentry config get github-app.private-key. The error did not happen with or without the trailing \n. The jwt token could be generated without a problem.

[el7cosmos]

I got it working by replacing single quote with double quote for the config value

github-app.private-key: '-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n'

github-app.private-key: "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"

[BYK]

Closing as this looks like a configuration error and not a bug.