Error in config.js mounting while trying to self-host renovate using docker image in linux VM #28180

ShivaniSara · 2024-03-29T00:56:11Z

ShivaniSara
Mar 29, 2024

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Bitbucket

Please tell us more about your question or problem

We use bitbucket repos. Trying POC for self-hosted renovate as per documentation. I created below config.js and while I try to mount it, I get errors. can you please help what am I missing? Also, do I need any certificates? I didn't use any for now.
Below if the config.js
module.exports = {
platform: "bitbucket-server",
endpoint: "https://globalrepository.company.int",
username: "myusername",
password: "xyz", // token created from bitbucket
onboardingConfig: {
extends: ['config:base'],
},
repositories: ["XYZ/RS"],
};

I ran below command: docker run --rm -it -v $PWD/config.js:/usr/src/app/config.js -e LOG_LEVEL=debug renovate/renovate:full --include-forks=true

Logs (if relevant)

Logs


Below is the stacktrace

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in config.js
 WARN: Config needs migrating
       "originalConfig": {
         "platform": "bitbucket-server",
         "endpoint": "https://globalrepository.company.int",
         "username": "myusername",
         "password": "***********",
         "onboardingConfig": {"extends": ["config:base"]},
         "repositories": ["XYZ/RS"]
       },
       "migratedConfig": {
         "platform": "bitbucket-server",
         "endpoint": "https://globalrepository.company.int",
         "username": "myusername",
         "password": "***********",
         "onboardingConfig": {"extends": ["config:recommended"]},
         "repositories": ["XYZ/RS"]
       }
DEBUG: File config
       "config": {
         "platform": "bitbucket-server",
         "endpoint": "https://globalrepository.company.int",
         "username": "myusername",
         "password": "***********",
         "onboardingConfig": {"extends": ["config:recommended"]},
         "repositories": ["XYZ/RS"]
       }
DEBUG: CLI config
       "config": {"forkProcessing": "enabled"}
DEBUG: Env config
       "config": {"hostRules": []}
DEBUG: Combined config
       "config": {
         "platform": "bitbucket-server",
         "endpoint": "https://globalrepository.company.int",
         "username": "myusername",
         "password": "***********",
         "onboardingConfig": {"extends": ["config:recommended"]},
         "repositories": ["XYZ/RS"],
         "hostRules": [],
         "forkProcessing": "enabled"
       }
DEBUG: Adding trailing slash to endpoint
DEBUG: Enabling forkProcessing while in non-autodiscover mode
DEBUG: Found valid git version: 2.43.2
DEBUG: Setting global hostRules
DEBUG: hostRules: no authentication for globalrepository.company.int
DEBUG: GET https://globalrepository.company.int/./rest/api/1.0/application-properties = (code=SELF_SIGNED_CERT_IN_CHAIN, statusCode=-1 retryCount=0, duration=37)
DEBUG: Error authenticating with Bitbucket. Check that your token includes "api" permissions
       "err": {
         "name": "RequestError",
         "code": "SELF_SIGNED_CERT_IN_CHAIN",
         "timings": {
           "start": 1711673379490,
           "socket": 1711673379492,
           "lookup": 1711673379493,
           "connect": 1711673379521,
           "error": 1711673379527,
           "phases": {"wait": 2, "dns": 1, "tcp": 28, "total": 37}
         },
         "message": "self-signed certificate in certificate chain",
         "stack": "RequestError: self-signed certificate in certificate chain\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:632:26)\n    at ClientRequest.emit (node:events:529:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@szmarczak+http-timer@4.0.6/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at TLSSocket.socketErrorListener (node:_http_client:501:9)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:151:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:116:3)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21)\n    at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at TLSSocket._finishInit (node:_tls_wrap:1070:8)\n    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:856:12)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.271.0 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "x-atlassian-token": "no-check",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://globalrepository.mclocal.int/rest/api/1.0/application-properties",
           "hostType": "bitbucket-server",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }
DEBUG: Adding password authentication for globalrepository.company.int (hostType=bitbucket-server) to hostRules
DEBUG: Using baseDir: /tmp/renovate
DEBUG: Using cacheDir: /tmp/renovate/cache
DEBUG: Using containerbaseDir: /tmp/renovate/cache/containerbase
DEBUG: Initializing Renovate internal cache into /tmp/renovate/cache/renovate/renovate-cache-v1
DEBUG: Commits limit = null
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for globalrepository.company.int (hostType=bitbucket-server) to hostRules
DEBUG: validatePresets()
DEBUG: Reinitializing hostRules for repo
DEBUG: Clearing hostRules
DEBUG: Adding password authentication for globalrepository.company.int (hostType=bitbucket-server) to hostRules
 INFO: Repository started (repository=XYZ/RS)
       "renovateVersion": "37.271.0"
DEBUG: Using localDir: /tmp/renovate/repos/bitbucket-server/XYZ/RS
 (repository=APIGW/event-gateway-routing-service)
DEBUG: PackageFiles.clear() - Package files deleted (repository=XYZ/RS)
DEBUG: initRepo("{
         "repository": "XYZ/RS"
       }") (repository=XYZ/RS)
DEBUG: hostRules: applying Basic authentication for globalrepository.company.int (repository=XYZ/RS)
DEBUG: GET https://globalrepository.company.int/./rest/api/1.0/projects/XYZ/repos/RS = (code=SELF_SIGNED_CERT_IN_CHAIN, statusCode=-1 retryCount=0, duration=12) (repository=XYZ/RS)
DEBUG: Unknown Bitbucket initRepo error (repository=XYZ/RS)
       "err": {
         "name": "RequestError",
         "code": "SELF_SIGNED_CERT_IN_CHAIN",
         "timings": {
           "start": 1711673379665,
           "socket": 1711673379665,
           "lookup": 1711673379670,
           "connect": 1711673379672,
           "error": 1711673379677,
           "phases": {"wait": 0, "dns": 5, "tcp": 2, "total": 12}
         },
         "message": "self-signed certificate in certificate chain",
         "stack": "RequestError: self-signed certificate in certificate chain\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:632:26)\n    at ClientRequest.emit (node:events:529:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@szmarczak+http-timer@4.0.6/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at TLSSocket.socketErrorListener (node:_http_client:501:9)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:151:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:116:3)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21)\n    at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at TLSSocket._finishInit (node:_tls_wrap:1070:8)\n    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:856:12)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.271.0 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "x-atlassian-token": "no-check",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://globalrepository.mclocal.int/rest/api/1.0/projects/XYZ/repos/RS",
           "hostType": "bitbucket-server",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }
ERROR: Repository has unknown error (repository=XYZ/RS)
       "err": {
         "name": "RequestError",
         "code": "SELF_SIGNED_CERT_IN_CHAIN",
         "timings": {
           "start": 1711673379665,
           "socket": 1711673379665,
           "lookup": 1711673379670,
           "connect": 1711673379672,
           "error": 1711673379677,
           "phases": {"wait": 0, "dns": 5, "tcp": 2, "total": 12}
         },
         "message": "self-signed certificate in certificate chain",
         "stack": "RequestError: self-signed certificate in certificate chain\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:632:26)\n    at ClientRequest.emit (node:events:529:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@szmarczak+http-timer@4.0.6/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at TLSSocket.socketErrorListener (node:_http_client:501:9)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:151:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:116:3)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21)\n    at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at TLSSocket._finishInit (node:_tls_wrap:1070:8)\n    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:856:12)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.271.0 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "x-atlassian-token": "no-check",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://globalrepository.mclocal.int/rest/api/1.0/projects/XYZ/repos/RS",
           "hostType": "bitbucket-server",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }
DEBUG: Unknown res: unknown-error (repository=XYZ/RS)
DEBUG: Repository result: unknown-error, status: unknown, enabled: undefined, onboarded: undefined (repository=XYZ/RS)
DEBUG: Repository timing splits (milliseconds) (repository=XYZ/RS)
       "splits": {},
       "total": 47
DEBUG: Package cache statistics (repository=XYZ/RS)
       "get": {"count": 0, "avgMs": 0, "medianMs": 0, "maxMs": 0, "totalMs": 0},
       "set": {"count": 0, "avgMs": 0, "medianMs": 0, "maxMs": 0, "totalMs": 0}
DEBUG: HTTP statistics (repository=APIGW/event-gateway-routing-service)
       "urls": {
         "https://globalrepository.mclocal.int/rest/api/1.0/projects/XYZ/repos/RS": {
           "GET": {"-1": 1}
         }
       },
       "hosts": {
         "globalrepository.company.int": {
           "count": 1,
           "reqAvgMs": 12,
           "reqMedianMs": 12,
           "reqMaxMs": 12,
           "queueAvgMs": 0,
           "queueMedianMs": 0,
           "queueMaxMs": 0
         }
       },
       "requests": 1
DEBUG: HTTP cache statistics (repository=XYZ/RS)
DEBUG: Lookup statistics (repository=XYZ/RS)
DEBUG: dns cache (repository=XYZ/RS)
       "hosts": []
 INFO: Repository finished (repository=XYZ/RS)
       "cloned": undefined,
       "durationMs": 47
DEBUG: Checking file package cache for expired items
DEBUG: Deleted 0 of 0 file cached entries in 5ms
 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 50,
           "logContext": "Zl1vIRFMw8RsaiPa55NcQ",
           "repository": "XYZ/RS",
           "err": {
             "name": "RequestError",
             "code": "SELF_SIGNED_CERT_IN_CHAIN",
             "timings": {
               "start": 1711673379665,
               "socket": 1711673379665,
               "lookup": 1711673379670,
               "connect": 1711673379672,
               "error": 1711673379677,
               "phases": {"wait": 0, "dns": 5, "tcp": 2, "total": 12}
             },
             "message": "self-signed certificate in certificate chain",
             "stack": "RequestError: self-signed certificate in certificate chain\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:632:26)\n    at ClientRequest.emit (node:events:529:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@szmarczak+http-timer@4.0.6/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at TLSSocket.socketErrorListener (node:_http_client:501:9)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:151:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:116:3)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21)\n    at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34)\n    at TLSSocket.emit (node:events:517:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at TLSSocket._finishInit (node:_tls_wrap:1070:8)\n    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:856:12)",
             "options": {
               "headers": {
                 "user-agent": "RenovateBot/37.271.0 (https://github.com/renovatebot/renovate)",
                 "accept": "application/json",
                 "x-atlassian-token": "no-check",
                 "authorization": "***********",
                 "accept-encoding": "gzip, deflate, br"
               },
               "url": "https://globalrepository.mclocal.int/rest/api/1.0/projects/XYZ/repos/RS",
               "hostType": "bitbucket-server",
               "username": "",
               "password": "",
               "method": "GET",
               "http2": false
             }
           },
           "msg": "Repository has unknown error"
         }
       ]

rarkins · 2024-03-29T04:03:59Z

rarkins
Mar 29, 2024
Maintainer

Copy paste the file name in full instead of trying to use $PWD

0 replies

viceice · 2024-03-29T09:44:38Z

viceice
Mar 29, 2024
Maintainer

your self-signed certificate is the problem. I don't think nodejs will ever accept it. you should create an internal rootca and add the certificate to renovate. see instructions at this link

https://github.com/containerbase/base/blob/main/docs/custom-root-ca.md#custom-root-ca-certificates

11 replies

viceice Apr 18, 2024
Maintainer

your dc-client.pem certificate seems to be not a ca certificate. it seems nodejs will reject self-signed certificates, so there's nothing we can do.

ShivaniSara Apr 18, 2024
Author

Attached details of the cert, it includes full chain. Its not self signed. Would ordering be the issue? does it expect Root first? Or does it require signing from external CA?

subject=CN=xyz.mastercard.int,OU=admin,O=Mastercard Worldwide,L=St Louis,ST=Missouri,C=US
issuer=CN=MasterCard DEV Generic Sub CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Oct 18 04:10:07 2024 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : No
SSL server : Yes
SSL server CA : No
subject=CN=MasterCard DEV Generic Sub CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
issuer=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Apr 8 14:03:34 2026 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : Yes
SSL server : Yes
SSL server CA : Yes
subject=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
issuer=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Apr 8 14:00:53 2036 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : Yes
SSL server : Yes
SSL server CA : Yes

rarkins Apr 18, 2024
Maintainer

Sorry but we don't have time to troubleshoot your certificates. We know certs work in Renovate, but we don't know what's wrong with yours.

Really big companies should consider getting a support contract. Please see mend.io/renovate

viceice Apr 21, 2024
Maintainer

Attached details of the cert, it includes full chain. Its not self signed. Would ordering be the issue? does it expect Root first? Or does it require signing from external CA?

subject=CN=xyz.mastercard.int,OU=admin,O=Mastercard Worldwide,L=St Louis,ST=Missouri,C=US
issuer=CN=MasterCard DEV Generic Sub CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Oct 18 04:10:07 2024 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : No
SSL server : Yes
SSL server CA : No
subject=CN=MasterCard DEV Generic Sub CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
issuer=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Apr 8 14:03:34 2026 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : Yes
SSL server : Yes
SSL server CA : Yes
subject=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
issuer=CN=MasterCard DEV Generic Root CA1 G2,OU=Corporate Security,O=MasterCard Worldwide,C=BE
notAfter=Apr 8 14:00:53 2036 GMT
Certificate purposes:
SSL client : Yes
SSL client CA : Yes
SSL server : Yes
SSL server CA : Yes

it should only contain the root ca, nothing else

ShivaniSara Apr 26, 2024
Author

Tried with only root ca as well, exact same error. Even tried updating renovate dockerfile and rebuilding new image, but always the self-signed error.

subject= CN=Company DEV Generic Root CA1 G2,OU=Corporate Security,O=Company Worldwide,C=BE
Certificate purposes:
SSL client : Yes
SSL client CA : Yes
SSL server : Yes
SSL server CA : Yes
Netscape SSL server : No
Netscape SSL server CA : Yes
S/MIME signing : Yes
S/MIME signing CA : Yes
S/MIME encryption : No
S/MIME encryption CA : Yes
CRL signing : Yes
CRL signing CA : Yes
Any Purpose : Yes
Any Purpose CA : Yes
OCSP helper : Yes
OCSP helper CA : Yes
Time Stamp signing : No
Time Stamp signing CA : Yes

ShivaniSara · 2024-04-01T15:34:15Z

github-actions[bot]
bot Apr 1, 2024

Hi there,

Please do not unnecessarily @ mention maintainers like @rarkins or @viceice. Doing so causes annoying mobile notifications and makes it harder to maintain this repository.

For example, never @ mention a maintainer when you are creating a discussion if your desire is to get attention. This is rude behavior, just like shouting out your coffee order in a Starbucks before it's your turn.

It's OK to comment in an issue or discussion after multiple days or weeks. But please, still don't @ mention people. The maintainers try to answer most discussions, but they can't answer all discussions. If you're still not getting an answer, take a look at the information you've given us and see if you can improve it.

Thanks, the Renovate team

1 reply

ShivaniSara Apr 1, 2024
Author

Sure, I am really sorry about that. I will take care of this.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error in config.js mounting while trying to self-host renovate using docker image in linux VM #28180

{{title}}

Replies: 3 comments 12 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Error in config.js mounting while trying to self-host renovate using docker image in linux VM #28180

ShivaniSara Mar 29, 2024

What would you like help with?

How are you running Renovate?

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Please tell us more about your question or problem

Logs (if relevant)

Replies: 3 comments · 12 replies

rarkins Mar 29, 2024 Maintainer

viceice Mar 29, 2024 Maintainer

viceice Apr 18, 2024 Maintainer

ShivaniSara Apr 18, 2024 Author

rarkins Apr 18, 2024 Maintainer

viceice Apr 21, 2024 Maintainer

ShivaniSara Apr 26, 2024 Author

github-actions[bot] bot Apr 1, 2024

ShivaniSara Apr 1, 2024 Author

ShivaniSara
Mar 29, 2024

Replies: 3 comments 12 replies

rarkins
Mar 29, 2024
Maintainer

viceice
Mar 29, 2024
Maintainer

viceice Apr 18, 2024
Maintainer

ShivaniSara Apr 18, 2024
Author

rarkins Apr 18, 2024
Maintainer

viceice Apr 21, 2024
Maintainer

ShivaniSara Apr 26, 2024
Author

github-actions[bot]
bot Apr 1, 2024

ShivaniSara Apr 1, 2024
Author