Check for modification failure in content Integration using VisualSVN Server and Cruisecontrol.net

Question

I am using CruiseControl.net for continous integration. I've created a repository for my project using VisualSvn server (uses Windows Authentication). Both the servers are hosted in the same system (Os-Microsoft Windows Server 2003 sp2).

When i force build the project using CruiseControl.net "Failed task(s): Svn: CheckForModifications" is shown as the message. When i checked the build report, it says as follows:

BUILD EXCEPTION 
Error Message: ThoughtWorks.CruiseControl.Core.CruiseControlException: Source control operation failed: svn: OPTIONS of 'https://system:8443/svn/folder/Source': **Server certificate verification failed: issuer is not trusted** (https://system:8443). Process command: C:\Program Files\VisualSVN Server\bin\svn.exe log **sameUrlAbove** -r "{2010-04-29T08:35:26Z}:{2010-04-29T09:04:02Z}" --verbose --xml --username ccnetadmin --password cruise --non-interactive --no-auth-cache
at ThoughtWorks.CruiseControl.Core.Sourcecontrol.ProcessSourceControl.Execute(ProcessInfo processInfo)
at ThoughtWorks.CruiseControl.Core.Sourcecontrol.Svn.GetModifications (IIntegrationResult from, IIntegrationResult to)
at ThoughtWorks.CruiseControl.Core.Sourcecontrol.QuietPeriod.GetModifications(ISourceControl sourceControl, IIntegrationResult lastBuild, IIntegrationResult thisBuild)
at ThoughtWorks.CruiseControl.Core.IntegrationRunner.GetModifications(IIntegrationResult from, IIntegrationResult to)
at ThoughtWorks.CruiseControl.Core.IntegrationRunner.Integrate(IntegrationRequest request) 

My SourceControl node in the ccnet.config is as shown below:

<sourcecontrol type="svn">
  <executable>C:\Program Files\VisualSVN Server\bin\svn.exe</executable>
  <trunkUrl>
    check out url
  </trunkUrl>
  <workingDirectory>
    C:\ProjectWorkingDirectories\folder\Source
  </workingDirectory>
  <username>
   ccnetadmin
  </username>
  <password>
     cruise
  </password>
</sourcecontrol>

Can any one suggest how to avoid this error?

Utica

Answer 1

The subversion error message says

svn: OPTIONS of 'https://sp-ci.sbsnetwork.local:8443/svn/IntranetPortal/Source': Server certificate verification failed: issuer is not trusted (https://sp-ci.sbsnetwork.local:8443).

This tells me that your 'svn' doesn't trust the https certificate of your server.

You can fix this by performing something like

svn info https://sp-ci.sbsnetwork.local:8443/svn/IntranetPortal/Source

as the user running cruisecontrol and then accept the certificate.

(Another option would be to make CruiseControl pass --trust-server-cert to svn, but I don't know which configuration option you need for that)

Simonsen

Hi, I didn't quite understand what you said. Could you please explain what you meant by: " perform something like svn info sp-ci.sbsnetwork.local:8443/svn/IntranetPortal/Source as the user running cruisecontrol and then accept the certificate" Thanks for your answer... – Utica

use PsExec from Sysinternal Suite (technet.microsoft.com/en-us/sysinternals/bb897553.aspx) to open a command prompt impersonated as LocalSystem and accept permanently the certificate – Adriannaadrianne

Answer 2

Server certificate verification failed: issuer is not trusted

Either connect via HTTP or add the CA certificate to the build machine.

Lung

Answer 3

Take a look here for a similar (but slightly different) problem that I had a little while ago.

Basically you cannot run the service as the normal 'SYSTEM' account, you need to specify and configure a local user, with the appropriate permissions and configure the service to run as that user.

Then log into the server as the user and run any svn command at the command line;
Bert suggests:

svn info https://sp-ci.sbsnetwork.local:8443/svn/IntranetPortal/Source

you should be prompted for the SVN username and password which are then cached in the appropriate location. You should also be prompted to accept the certificate - which you should do.

Now the service should run without any problems.

Lockhart

Hi, Actually my problem is not about starting ccnet as a service. I has no problem in doing so. But while Checking out using ccnet config the following error occurs: Failed task(s): Svn: CheckForModifications" is shown as the message. When i checked the build report, it says "Server certificate verification failed: issuer is not trusted"..... for more details see my question.... – Utica

Also when i try to manually checkout using the same url of the visualsvn server; a popup is shown which says "the certificate not trusted, whether to continue with this". After accepting it permanently the checkout works fine. But when i tried through ccnet config the error i mentioned in my previous comment happens. Do you have any suggestions to solve it?.. – Utica

Ok - I'm not 100% sure what you mean by 'checking out using ccnet config'. If everything works fine when running as a service then when do you see the error? My problems were due to accessing SVN via https because when I ran CCNet as a service I needed to ensure that the user that the service was running as had a valid certificate. Logging in as that user and running an svn command allowed me to accept the certificate and all was well. – Lockhart

Actually i am trying to checkout my project from a repository(in svn server) for continuous integration. For that i am configuring the ccnet.config file to do the process. As per my knowledge you are trying to access svn server through https. In that case if the certificate is not valid a popup is shown which says "the certificate not trusted, whether to continue with this". After accepting it permanently the svn run works fine. But in my case as i am working through dashboard interface of ccnet i won't get the popup to do so..... – Utica

I'm still not 100% sure what is going on there - and it looks like nobody else here does either. All I can suggest is to post a question on the CCNet Group on Google (linking back here of course). groups.google.com/group/ccnet-user – Lockhart

Answer 4

I was trying to do the continuous integration in a windows server domain. The domain controller server should issue a certificate for the svn server(installed in one of the domain). Then import the issued certificate to svn server.

The process include two steps:

1) creating a request to issue a certificate from domain controller.

           For that follow the steps:
                 i) open visual svn server
                 ii) "right click" **visualSVN Server(Local)** and "select" 
                      **properties**
                 iii) "select" **change certificate** in **cetificates**
                 iv) "check" the **prepare certificate request** and "provide" the 
                      domain controller as server and do as asked.
                  v) "save" the request as **.req extension** and **finish** the 
                     process

2) Submitting the .req file to the domain controller to get the certificate

           For that follow the steps:
                  i) run **cmd**
                  ii) run **certreq -submit -attrib "CertificateTemplate: WebServer" 
                        .req file with its path** 
                  iii) save the certificate with **.cer** extension.
                  iv) do **i,ii,iii** of the **step 1**  
                   v)  "check" the **Import Signed Certificate** and "browse" the 
                      **.cer file** and install it.                    

Utica

Answer 5

CruiseControl service runs by default under local service account, so make sure the certificates are accepted via local service account or change "Log on as" service user to user which accepted the certs.

reference

Asphyxiant

Answer 6

I fixed the same issue here in my question at Pass arguments to svn when using CruiseControl.net

You basically need to alter your sourcecontrol block in ccnet.config and use a batch file which passes the --trust-server-cert option to svn

Quarto