$ zuul-client --zuul-url https://zuul.wikimedia.org/ encrypt --tenant wikimedia --project integration/config --infile <(echo -n bar) zuulclient.api.ZuulRESTException: Insufficient privileges to perform the action. ERROR - Command encrypt completed with error(s)
The client attempt to retrieve the key using the API: GET /api/tenant/{tenant_name}/key/{project_name}.pub
The API can be tried from https://zuul.wikimedia.org/openapi:
- scroll to that API
- hit the button Try it out
- File the fields:
- tenant_name: wikimedia
- project_name: integration/config
Results
curl
curl -X 'GET' \ 'https://zuul.wikimedia.org/api/tenant/wikimedia/key/integration%2Fconfig.pub' \ -H 'accept: text/plain'
url
https://zuul.wikimedia.org/api/tenant/wikimedia/key/integration%2Fconfig.pub
Response
404
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> </body></html>
That is Apache responding with its own code, it should probably have given the result emitted by Zuul which is expected to be Tenant or Project not found. The URL not found is probably because Apache shortcircuited the URL encoded or did a file state or whatever madness.
If I do the request transforming the %2F% to /, it works!
$ curl https://zuul.wikimedia.org/api/tenant/wikimedia/key/integration/config.pub -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4Y9UWgnNStoHtWIyjF71 /r+DW0VH8yElfQUt36kxITm+BFtmMctyc5PfgcPMNzM+U75HxrydZHgrFeMuMhot 3Dj4IeBMA/kq94UWzfeI8kgGrSqSbgRz14P1J6PPIcRpJfukvkNt8qTjgcVCDymj ...
Once I get the key, I can invoke zuul-client --public-key <file holding the key>.
We should figure out the root cause of the URL not being accepted. Something something about urlencoding, I am pretty sure Gerrit has a similar requirement.
