Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-69264

[ssh-agent] Use SSH Host Key verification strategies from git-client-plugin

    • Icon: Task Task
    • Resolution: Unresolved
    • Icon: Minor Minor
    • ssh-agent-plugin
    • None

      https://plugins.jenkins.io/git-client/#plugin-content-ssh-host-key-verification is incredibly useful in pipelines.

      The ssh-agent-plugin doesn't take advantage of it however. It would be great if it could. That would reduce the need to inject ~/.ssh/known_hosts for Git operations within sshagent pipeline steps.

          [JENKINS-69264] [ssh-agent] Use SSH Host Key verification strategies from git-client-plugin

          Many classes and methods in the org.jenkinsci.plugins.gitclient.verifier package (source, javadoc) reference "CliGit" or "JGit", but they don't seem to actually depend on Git. Rather, AbstractCliGitHostKeyVerifier provides command-line options for the "ssh" executable, and AbstractJGitHostKeyVerifier implements com.trilead.ssh2.ServerHostKeyVerifier.

          AFAICT, ssh-agent-plugin runs "ssh-add" and "ssh-agent" on the Jenkins agent, but it does not run "ssh" and does not use the trilead API (except in a test). If ssh-agent-plugin depended on git-client-plugin (which feels somewhat undesirable) and queried the SshHostKeyVerificationStrategy, it is not clear to me how ssh-agent-plugin should then use the information available from there. Perhaps the "sshagent" step could collect the "ssh" command-line options from AbstractCliGitHostKeyVerifier and place them in an environment variable that the pipeline could then reference in "ssh" commands.

          Kalle Niemitalo added a comment - Many classes and methods in the org.jenkinsci.plugins.gitclient.verifier package ( source , javadoc ) reference "CliGit" or "JGit", but they don't seem to actually depend on Git. Rather, AbstractCliGitHostKeyVerifier provides command-line options for the "ssh" executable, and AbstractJGitHostKeyVerifier implements com.trilead.ssh2.ServerHostKeyVerifier. AFAICT, ssh-agent-plugin runs "ssh-add" and "ssh-agent" on the Jenkins agent, but it does not run "ssh" and does not use the trilead API (except in a test). If ssh-agent-plugin depended on git-client-plugin (which feels somewhat undesirable) and queried the SshHostKeyVerificationStrategy, it is not clear to me how ssh-agent-plugin should then use the information available from there. Perhaps the "sshagent" step could collect the "ssh" command-line options from AbstractCliGitHostKeyVerifier and place them in an environment variable that the pipeline could then reference in "ssh" commands.

          Pay Bas added a comment -

          kon indeed all valid points. Will have to think on this.

          Pay Bas added a comment - kon indeed all valid points. Will have to think on this.

            Unassigned Unassigned
            paybas Pay Bas
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: