Testing my own private repo...

gabriel

Thank you for the file and keys. I´ve bootet up a test system and at first was not able to import. I checked it twice: The signature does not fit with your public key. My best guess would be that you used a different private key during the initial export or that there was a copy/past error.

But the good news is that the provided keys work. I did a small change to your app and re-exported it with your private key. I was then able to import your app successfully after I installed your public key.

Could you please try the same thing (update your app, re-export, install it) and let me know, if it works?

fmvalsera

Hi Gabriel,

I've tried what you suggested with no luck. But I have a new clue of what could be happening. Perhaps you know how to solve it.

In my environment REI3 is running under Docker with Linux at host, for both instances (source an target). I have tried the test several times but it doesn't work, even following your sequence.

After that I have started a portable REI3 instance on Windows. The application I created and exported from Linux I can import in Windows neither. The same error message is shown.

So I have recreated the application in the Windows instance with a new key pair. I have signed it in Windows with the private key and I have distributed the public one to the Linux target instance. Then I have imported successfully the application.

At this point, I guess that the problem is related to the signature that is generated with the private key in the source Linux instance. Could it be that the sign process (GO runtime, native libraries or other dependencies) does not produce the same signature depending on the operating system?

Well, I hope this helps to solve the issue because is the only difference I find.

Thanks for your time!

gabriel

fmvalsera
As long as you used the official releases (e.g. did not change the source code), there should not be any difference. But I will run tests to confirm. I´ll get back to you.

Sorry that you are having issues - its usually a pretty straightforward process.

gabriel

I´ve done some tests with 2 keys (one generated on a Windows machine, one generated on a Linux machine):

Both keys were newly generated. I´ve exported apps both from Windows & Linux systems with both keys and imported back into both Windows & Linux. All tests were successful.

The only thing I cannot test right now, is R3 under Docker. But they are the same binaries as the regular Linux release, so I struggle to come up with possible differences.

All dependencies for key handling (creation, signing, validation) are built-in to the binary as far as I know. There could potentially be differences between R3 releases (v3.5.4 / v.3.6 for example) because we upgrade the Go packages (net/crypto I think in this case) - but this would be the first time we had this issue.

I assume you have also tested new keys in your R3 instances on Docker? Just in case.

fmvalsera

Wow!, thank you so much for your help.

I continue testing and you are right, probably the issue is not related to the operating system.

I say that because the application generated in Windows (is also a dummy application but not exactly the first one I hosted at GitHub) can be imported in Linux. After that I exported again from Linux with the same key pair I used in Windows both .rei files are exactly the same. I mean the .json files inside are equals, including the signature attribute. And I can import the application with no problem.

So now I'm suspecting about the first application I created. As you told me in a previous reply you did a small change in the application, what was it? Is it possible that I'm missing some attribute or element necessary for exporting properly?

Sorry, I'm lost with this and I would like to check the reliability to distribute applications with the platform.

Thanks again.

fmvalsera

Well, I'm here again... And this time I think that I have found the problem.

For my first dummy application I set the "Builds on" application attribute to lsw_icons (the second one hadn't any dependency). If I clean that attribute the application can be exported/imported successfully in any environment. But if I set the dependency with lsw_icons, the export finishes ok but the import doesn't work.

Which is the right way to do it? I mean to link to another project. Of course I have installed the project lsw_tools from official Repo in the instance where I'm creating the dummy application (otherwise the combo "Builds on" wouldn't show the choice to add lsw_icons).

Thanks for helping me to check this.

gabriel

fmvalsera
Its valid to select other apps as "Builds on" - these apps will then be exported together with your app, because they have become dependencies.

However, as you and my colleague @lsw-fabian probably suspects, there could be an issue with their signatures. Usually you would not make any changes to apps from other authors - and if this is the case, they keep their original signature and will not be re-signed with your private key. Because lsw_icons was released by us, it uses the key REI3 official (2020). Is it possible that you removed the original trusted key for REI3? If so, then your app might be importable, but an app like lsw_icons cannot be verified.

lsw-fabian

Have you made any changes to lsw_icons?

fmvalsera

Hello,
I made no modificación to lsw_icons. As far as I understand the application exportation has no embedded dependencies. Since the target instance has no preinstalled dependencies neither, the application import fail.
The confusing was the received message about no valid public key on target instance while importing, rather than warning about missing dependency.
Well, I'm not sure if it's working this way... but it's my conclusion after all.
Thank you for your support.
Regards.

gabriel

fmvalsera
Bad timing, I have not seen your post before posting mine 🙂

When you Build on other applications, they become dependencies and they will automatically be exported as well. See my previous post for how this can cause an issue, regarding the apps having different signature keys.

fmvalsera

All right, now everything is clear. That's the point, I thought that the whole application was signed with the same private key.
Now I understand that the lws_icons keeps its original signature, so that's why I must add all the involved public keys in the target instance.
Thank you very much, both of you, for your five stars support during the weekend!!
Best regards.

gabriel

fmvalsera
And thank you for the excellent explanation and willingness to test. I´ll make a note to extend our documentation regarding application transfer - I don´t think we have all that detail in there yet.