[stork-users] stork-agent 2.6.0 fails to start after upgrade: certificate files moved

[fbcadmin]

here are the apt sources used:


root at dhcp-vlan3:[/etc/apt/sources.list.d]:# cat isc-stork.list
# Source: ISC - Internet Systems Consortium
# Site: https://gitlab.isc.org/isc-projects/stork/
# Repository: ISC - Internet Systems Consortium / stork
# Description: Repository for stable versions of Stork packages. Stork 
is a free, open-source management system for Kea DHCP servers. This 
repository contains the Stork server. Stork installation also requires 
downloading and installing the Stork agent that runs on the BIND or Kea 
host.

# upgrade with:  curl -1sLf 
'https://dl.cloudsmith.io/public/isc/stork/setup.deb.sh' | sudo -E bash
# then put this and the above .  copy it b4 upgrade

deb [signed-by=/usr/share/keyrings/isc-stork-archive-keyring.gpg] 
https://dl.cloudsmith.io/public/isc/stork/deb/debian trixie main

deb-src [signed-by=/usr/share/keyrings/isc-stork-archive-keyring.gpg] 
https://dl.cloudsmith.io/public/isc/stork/deb/debian trixie main


root at dhcp-vlan3:[/etc/apt/sources.list.d]:# cat isc-kea-3-0.list
# Source: ISC - Internet Systems Consortium
# Site: https://gitlab.isc.org/isc-projects/kea
# Repository: ISC - Internet Systems Consortium / kea-3-0
# Description: A certifiably-awesome open-source package repository 
curated by ISC - Internet Systems Consortium, hosted by Cloudsmith.


deb [signed-by=/usr/share/keyrings/isc-kea-3-0-archive-keyring.gpg] 
https://dl.cloudsmith.io/public/isc/kea-3-0/deb/debian trixie main

deb-src [signed-by=/usr/share/keyrings/isc-kea-3-0-archive-keyring.gpg] 
https://dl.cloudsmith.io/public/isc/kea-3-0/deb/debian trixie main

On 10/15/26 10:33, fbcadmin wrote:
> this was  Diagnosed and fixed with Grok Build (grok 1.0.52, Grok 4.7)
>
> On 10/15/26 10:31, fbcadmin wrote:
>> After upgrading isc-stork-agent from 2.4.1 (2.4.1.260508132628) to 2.6.0
>> (2.6.0.261009212745) on Debian, the agent no longer starts. systemd
>> reports exit status 1, and the log says:
>>
>>     failed to set up the gRPC server: the agent cannot start due to
>>     missing certificates; consider running 'stork-agent register' to
>>     obtain certificates or specify the --server-url to do it 
>> automatically
>>
>> The certificates were still present and valid. Stork 2.6.0 looks for
>> them under new names, directly in /var/lib/stork-agent/, and the package
>> upgrade does not move the old files. The agent then treats the store as
>> empty and refuses to start. Re-registration was not required.
>>
>> Old location (2.4.1)    New location (2.6.0)
>> ------------------------------------------- 
>> -----------------------------------------
>> /var/lib/stork-agent/certs/ca.pem /var/lib/stork-agent/root-cert.pem
>> /var/lib/stork-agent/certs/cert.pem /var/lib/stork-agent/server-cert.pem
>> /var/lib/stork-agent/certs/key.pem  /var/lib/stork-agent/server-key.pem
>> /var/lib/stork-agent/tokens/agent-token.txt 
>> /var/lib/stork-agent/token.txt
>> /var/lib/stork-agent/tokens/server-cert.sha256 
>> /var/lib/stork-agent/server-cert.sha256
>>
>> Copying the existing files to those new names, with owner stork-agent
>> and mode 600, lets the agent start with the same registration:
>>
>>     base=/var/lib/stork-agent
>>     install -o stork-agent -g stork-agent -m 600 \
>>         "$base/certs/ca.pem"            "$base/root-cert.pem"
>>     install -o stork-agent -g stork-agent -m 600 \
>>         "$base/certs/cert.pem"          "$base/server-cert.pem"
>>     install -o stork-agent -g stork-agent -m 600 \
>>         "$base/certs/key.pem"           "$base/server-key.pem"
>>     install -o stork-agent -g stork-agent -m 600 \
>>         "$base/tokens/agent-token.txt"  "$base/token.txt"
>>     install -o stork-agent -g stork-agent -m 600 \
>>         "$base/tokens/server-cert.sha256" "$base/server-cert.sha256"
>>     systemctl reset-failed isc-stork-agent
>>     systemctl start isc-stork-agent
>>
>> The agent then logs "Started serving Stork Agent" on port 8080. The
>> original files can be left in place. This was confirmed on two Kea DHCP
>> HA servers that were already registered before the upgrade.
>>
>> The new paths are set in backend/agent/certstore.go (newCertPaths).
>> It would help if the 2.6.0 packages migrated these files on upgrade, or
>> if the release notes called out the rename.
>>