-
Task
-
Resolution: Unresolved
-
Minor
-
None
https://plugins.jenkins.io/git-client/#plugin-content-ssh-host-key-verification is incredibly useful in pipelines.
The ssh-agent-plugin doesn't take advantage of it however. It would be great if it could. That would reduce the need to inject ~/.ssh/known_hosts for Git operations within sshagent pipeline steps.
- is related to
-
JENKINS-66601 Add scenarios to help choice the best "Host Key Verification Strategy" option
-
- Closed
-
Many classes and methods in the org.jenkinsci.plugins.gitclient.verifier package (source, javadoc) reference "CliGit" or "JGit", but they don't seem to actually depend on Git. Rather, AbstractCliGitHostKeyVerifier provides command-line options for the "ssh" executable, and AbstractJGitHostKeyVerifier implements com.trilead.ssh2.ServerHostKeyVerifier.
AFAICT, ssh-agent-plugin runs "ssh-add" and "ssh-agent" on the Jenkins agent, but it does not run "ssh" and does not use the trilead API (except in a test). If ssh-agent-plugin depended on git-client-plugin (which feels somewhat undesirable) and queried the SshHostKeyVerificationStrategy, it is not clear to me how ssh-agent-plugin should then use the information available from there. Perhaps the "sshagent" step could collect the "ssh" command-line options from AbstractCliGitHostKeyVerifier and place them in an environment variable that the pipeline could then reference in "ssh" commands.