PKCS12 truststore password issues

SonarQube Server / Community Build
1

We found a gap in the existing run-sonar-scanner-cli boilerplate.

When we transitioned from default JVM trust to TLS trust utilising a fallback GitHub root cert secret, the certificates were imported into the PKCS12 truststore successfully. However, on subsequent workflow runs, SonarScanner attempted to load the existing truststore without being supplied the truststore password.

This resulted in:

PKCS12 key store mac invalid - wrong password or corrupted file

The truststore itself was validated and found to be healthy. The fix ensures the truststore password is always supplied whenever a PKCS12 truststore exists.

# Persisted self-hosted runner truststores still need the PKCS12 password even when
# SONAR_ROOT_CERT is not set for the current run; otherwise SonarScanner fails before

# any network call with "PKCS12 key store mac invalid".

if [[ -f "$SONAR_SSL_TRUSTSTORE_FILE" ]] && [[ " ${scanner_args[*]} " != *" -Dsonar.scanner.truststorePassword=$SONAR_SSL_TRUSTSTORE_PASSWORD "* ]]; then

scanner_args+=("-Dsonar.scanner.truststorePassword=$SONAR_SSL_TRUSTSTORE_PASSWORD")

fi
2

Hi @adaly56, I split your post into a separate thread because the original one you posted on was old and your message is probably not relevant anymore to the original poster.

That being said, could you clarify which version of the GitHub action are you using? I had a look at the code in our GH action and I couldn’t find the run-sonar-scanner-cli script in the latest version, I could only find it in v5. If you’re not using the latest, then could you please try again with the latest version and see if the issue persists?