Unable to verify the first certificate error in cml-send-comment

[JLC7]

Thanks for creating this tool!

We currently have our shared gitlab runners configured to use docker on our own linux servers. I am trying to run the cml-base-case example. I keep encountering an error with cml-send-comment line in the cml-base-case code in gitlab. Is there a way to pass in the path of the the ssl certificate like /etc/ssl/certs/?

Here is a screen shot of when it fails.

I tried creating my own runner manually and edited the /etc/gitlab-runners/config.toml file to point to the paths but not having luck. For example I tried setting:

volumes = ["/cache",
               "/etc/gitlab-runner/certs:/etc/gitlab-runner/certs",
	       "/etc/ssl/certs:/etc/ssl/certs"
    ]

Nothing I tried work so far. Any guidance on what I can try?

Thanks

[DavidGOrtega]

@JLC7
take into account that CML is actually a docker image. What you are doing is adding the certs to your runners however CML is still running inside a container. So you should expose the to CML.

An easy and effective way would be adding a small code in the workflow to setup the cert from a secret like we use to do with google credentials. Fr that you have to save your SSL as a settings->CI/CD env variable

then in the ci.yaml file setup it with a simple command.

 - echo $SSL_CERT > $MY_PATH
 - export NODE_EXTRA_CA_CERTS=$MY_PATH
...
 - cml-send-comment...

with this setup you don't have to change your runners or anything else.

https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file

⚠️ I have not tested this

[DavidGOrtega]

@JLC7 did you solved your issue?

[JLC7]

It led me to a solution. I updated the dockerfile by copying the cert into it and added the following line to the yml

- export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/ca-cert.crt

But trying...

- echo $SSL_CERT > $MY_PATH
- export NODE_EXTRA_CA_CERTS=$MY_PATH

ended up passing the actual contents of the certificate instead of a path to the certificate to NODE_EXTRA_CA_CERTS and I wasn't sure how to get around that.

Let me know if there would've been a simpler way. Thanks for your help!

[DavidGOrtega]

ended up passing the actual contents of the certificate instead of a path to the certificate to NODE_EXTRA_CA_CERTS

@JLC7 How that can be possible?

MY_PATH='mycert.crt'
SSL_CERT='HELLO CERT'
echo $SSL_CERT > $MY_PATH
export NODE_EXTRA_CA_CERTS=$MY_PATH

echo $NODE_EXTRA_CA_CERTS
cat $MY_PATH

the output

mycert.crt

HELLO CERT

as expected. At this point the cert exists at $MY_PATH and NODE_EXTRA_CA_CERTS contains $MY_PATH

[DavidGOrtega]

I updated the dockerfile by copying the cert into it

Take care with that, if your image is public you are exposing your keys. 🙂

[DavidGOrtega]

Let me know if there would've been a simpler way

Another option would be make accesible the file with the container.volumes option

jobs:
  cml_run:
    container:
      image: dvcorg/cml:latest
      volumes: ['path_to_my_cert:/my_cert.crt']
   env:
      NODE_EXTRA_CA_CERTS: '/my_cert.crt'

[JLC7]

I resolved the issue. Setting the gitlab variable type to File rather than Variable helped. All I needed then was
- export NODE_EXTRA_CA_CERTS=$SSL_CERT
Thanks for the help.