GnuPG signing breaks after some days

[TobiX]

Renovate CE (8.1.1 currently, but started with earlier version) runs fine for some days, but then the following starts appearing on all dashboards:

Repository problems

Renovate tried to run on this repository, but found these problems.

• WARN: gitPrivateKey: error importing
• WARN: Error updating branch

The associated log looks like this (slightly redacted):

{
  "name": "renovate",
  "hostname": "renovate-gitlab-a347943782",
  "pid": 2674,
  "level": 20,
  "logContext": "9a40654f-3101-46f5-8f32-9ec074737962",
  "repository": "someorg/base",
  "branch": "renovate/dependency-check.version",
  "err": {
    "cmd": "/bin/sh -c gpg --import /tmp/git-private-gpg.key",
    "stderr": "gpg: key AAAAAAAAAAAAAAAA: \"Company Renovate Bot <svc-renovate@company.com>\" not changed\ngpg: key AAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAA: error sending to agent: No such file or directory\ngpg: key AAAAAAAAAAAAAAAA/BBBBBBBBBBBBBBBB: error sending to agent: No such file or directory\ngpg: error reading '/tmp/git-private-gpg.key': No such file or directory\ngpg: import from '/tmp/git-private-gpg.key' failed: No such file or directory\ngpg: Total number processed: 0\ngpg:              unchanged: 1\ngpg:       secret keys read: 1\n",
    "stdout": "",
    "options": {
      "cwd": "/tmp/renovate/repos/gitlab/someorg/base",
      "encoding": "utf-8",
      "env": {
        "HOME": "/home/ubuntu",
        "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "LC_ALL": "C.UTF-8",
        "LANG": "C.UTF-8",
        "CONTAINERBASE_CACHE_DIR": "/tmp/renovate/cache/containerbase"
      },
      "maxBuffer": 10485760,
      "timeout": 900000
    },
    "exitCode": 2,
    "name": "ExecError",
    "message": "Command failed: gpg --import /tmp/git-private-gpg.key\ngpg: key AAAAAAAAAAAAAAAA: \"Company Renovate Bot <svc-renovate@company.com>\" not changed\ngpg: key AAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAA: error sending to agent: No such file or directory\ngpg: key AAAAAAAAAAAAAAAA/BBBBBBBBBBBBBBBB: error sending to agent: No such file or directory\ngpg: error reading '/tmp/git-private-gpg.key': No such file or directory\ngpg: import from '/tmp/git-private-gpg.key' failed: No such file or directory\ngpg: Total number processed: 0\ngpg:              unchanged: 1\ngpg:       secret keys read: 1\n",
    "stack": "ExecError: Command failed: gpg --import /tmp/git-private-gpg.key\ngpg: key AAAAAAAAAAAAAAAA: \"Company Renovate Bot <svc-renovate@company.com>\" not changed\ngpg: key AAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAA: error sending to agent: No such file or directory\ngpg: key AAAAAAAAAAAAAAAA/BBBBBBBBBBBBBBBB: error sending to agent: No such file or directory\ngpg: error reading '/tmp/git-private-gpg.key': No such file or directory\ngpg: import from '/tmp/git-private-gpg.key' failed: No such file or directory\ngpg: Total number processed: 0\ngpg:              unchanged: 1\ngpg:       secret keys read: 1\n\n    at ChildProcess.<anonymous> (/usr/src/app/node_modules/renovate/lib/util/exec/common.ts:99:11)\n    at ChildProcess.emit (node:events:531:35)\n    at ChildProcess.emit (node:domain:488:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:294:12)"
  },
  "durationMs": 47,
  "msg": "rawExec err",
  "time": "2024-09-02T00:13:57.789Z",
  "v": 0
}

After some investigation (https://unix.stackexchange.com/a/340105) it appears that something is deleting ~/.gnupg/private-keys-v1.d - after restoring that directory in the container, Renovate starts working normally again...

[nabeelsaabna]

do you have MEND_RNV_WORKER_CLEANUP enabled ? (also relates to MEND_RNV_WORKER_CLEANUP_DIRS)
is ~/.gnupg/private-keys-v1.d mounted or generated at runtime ?

[TobiX]

Hmm, MEND_RNV_WORKER_CLEANUP is indeed enabled and /home/ubuntu is in the default MEND_RNV_WORKER_CLEANUP_DIRS. When configuring gitPrivateKey, gpg-agent creates ~/.gnupg/private-keys-v1.d at runtime and places its secret keys there.

So I suspect all those facts together lead to the worker removing this directory on every cleanup run?