Fix WOPI proof key signing failure

[delmarguillen]

Summary

The awk command on line 146 of entrypoint.sh flattens the PEM private key by replacing real newlines with literal \n characters:

WOPI_PRIVATE_KEY_DATA=$(awk '{printf %s\\n, $0}' $WOPI_PRIVATE_KEY)

When jq --arg receives this, it treats \n as literal text and escapes it again. The resulting key in local.json has no real newlines, which OpenSSL cannot decode:

error:1E08010C:DECODER routines::unsupported
    at signOneShot (node:internal/crypto/sig:169:15)
    at generateProofSign (/snapshot/server/DocService/sources/wopiUtils.js)

This breaks any WOPI integration that requires proof key verification. Tested on both x86_64 and ARM64.

Fix

Replace awk with cat so jq --arg receives the raw PEM with real newlines and encodes them correctly in JSON.

One line change. Credit to @tiran133 for identifying the fix in #127.

How I found this

I built an integration of Euro-Office with ownCloud OCIS (repo). The WOPI checkFileInfo call failed on every document open.

Tested on

• DocumentServer 9.3.1 Build 37 (ghcr.io/euro-office/documentserver:latest)
• VPS: x86_64, Ubuntu 24.04, Docker 29.5.3
• Local: ARM64 (Surface Pro 9, Podman 5.8.3, WSL2)

[delmarguillen]

This fixes #127, #160, and #177. The root cause is that openssl genpkey produces a PKCS#8 key that Node.js crypto.sign() cannot use with the bundled OpenSSL 3.x backend. Switching to openssl genrsa -traditional generates a PKCS#1 key that works.

[streaminganger]

The workaround was converting the key after generation, but the proper fix is generating it in the right format from the start.

this doesn't make sense to me. i would have thought the patch by @tiran133 was a proper fix instead. the existing algorithm has been in use since onlyoffice. the root problem being that jq args will treat \n literally and then escape it result in an invalid key. @filerun analysis in #177 is also correct.

[delmarguillen]

Thanks for pointing that out. I updated the PR with the proper fix from #127, the actual issue is the awk line double-escaping newlines before jq handles them.

[delmarguillen]

Tested the updated fix on a VPS (x86_64, Ubuntu 24.04) and it works correctly.