[JENKINS-36997] CLI implementation of RemoteAgent by jglick · Pull Request #18 · jenkinsci/ssh-agent-plugin

jglick · 2017-02-08T19:58:40Z

passing tests
remove need for tests to pass -o HostKeyAlgorithms=ssh-dss (reference)
normalize ExecRemoteAgent.agent
verify in WorkflowPluginTest.sshGitInsideDocker overhaul acceptance-test-harness#272

@reviewbybees

…stalled on a slave. Not working yet with keys protected by a passphrase.

… key.

...namely jenkinsci/remoting@944fb8a

OpenSSH 7.0 and greater disables use of ssh-dss public key algorithm. To allow tests to run on system with OpenSSH 7.0, explicitly enable ssh-dss by passing `-o HostKeyAlgorithms=+ssh-dss`.

… remote host

Older OpenSSH implementations does not support the `...=+ssh-dss` syntax to add a key alg (mind the `+`), So use `...=ssh-dss` to make tests working also on pre-7.0 versions of OpenSSH. This is an amendment of commit 66bae3b.

…AgentServer would create. Switching expectation to what ssh-agent, via ExecRemoteAgent, will create. From the man page: FILES $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid> UNIX-domain sockets used to contain the connection to the authen‐ tication agent. These sockets should only be readable by the owner. The sockets should get automatically removed when the agent exits.

…ree to connect to the test server without special options. apache/mina-sshd#29

…emoting calls were not exercised.

…calls.

…script either.

jglick · 2017-02-09T20:24:51Z

src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentBase.java

                    tw.writeMPInt(rpk.getModulus());
                    return new String(Base64.encode(tw.getBytes()));
                }
-                if (pk instanceof DSAPublicKey) {


Our tests use RSA, so there is no need to even check for this.

jglick · 2017-02-09T20:25:16Z

src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentBase.java

        sshd.getProperties().put(SshServer.WELCOME_BANNER, "Welcome to the Mock SSH Server\n");
-        sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider(new File(hostKey.getPath())));
+        SimpleGeneratorHostKeyProvider hostKeyProvider = new SimpleGeneratorHostKeyProvider(new File(hostKey.getPath()));
+        hostKeyProvider.setAlgorithm(/* TODO when upgrading sshd: KeyUtils.RSA_ALGORITHM */"RSA"); // http://stackoverflow.com/a/33692432/12916


Allow tests to run even with a newer ssh command connecting.

jglick · 2017-02-09T20:25:57Z

src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentBuildWrapperTest.java

        job.getBuildersList().add(shell);

-        r.assertLogContains("Permission denied (publickey).", r.assertBuildStatus(Result.FAILURE, job.scheduleBuild2(0).get()));
+        r.assertLogContains("Failed to run ssh-add", r.assertBuildStatus(Result.FAILURE, job.scheduleBuild2(0).get()));


Used to proceed with the block even when the passphrase was bad, which did not make much sense—better to fail at once.

jglick · 2017-02-09T20:26:38Z

src/main/java/com/cloudbees/jenkins/plugins/sshagent/RemoteAgent.java

     * Stops the agent.
     */
-    void stop();
+    void stop() throws IOException, InterruptedException;


These methods may now be running remote commands, so they should be allowed to throw reasonable exceptions.

jglick · 2017-02-09T20:27:20Z

src/main/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentStepExecution.java

+        } finally {
+            purgeSockets();
        }
-        purgeSockets();


Various updates related to exception handling from stop.

jglick · 2017-02-09T20:27:43Z

src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentBuildWrapperTest.java

        SystemCredentialsProvider.getInstance().save();

        FreeStyleProject job = r.createFreeStyleProject();
+        job.setAssignedNode(r.createSlave());


Make sure the remote part works.

jglick · 2017-02-09T20:28:03Z

src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentStepWorkflowTest.java

                story.j.assertBuildStatusSuccess(story.j.waitForCompletion(b));

-                Pattern pattern = Pattern.compile("(?:SSH Agent (?:before|after) restart )/.+/ssh([0-9])+");
+                Pattern pattern = Pattern.compile("(?:SSH Agent (?:before|after) restart )/.+/ssh-.+/agent.(\\d)+");


Different socket path name patterns created by new implementation.

jglick · 2017-02-09T20:28:18Z

pom.xml

    <jenkins.version>1.609.3</jenkins.version>
    <java.level>7</java.level> <!-- sshd-core is 7+ -->
-    <workflow-jenkins-plugin.version>1.9</workflow-jenkins-plugin.version>
+    <workflow-jenkins-plugin.version>1.14.2</workflow-jenkins-plugin.version>


The latest compatible with 1.609.3.

stephenc

🐝

jglick · 2017-02-10T17:30:12Z

@reviewbybees done

Mi-La and others added 10 commits November 21, 2016 11:01

Adds a new remote agent implementation based on a native ssh-agent in…

36b7e23

…stalled on a slave. Not working yet with keys protected by a passphrase.

Support for keys protected by a passphrase.

c206deb

Fixes executable flag in a temporary script for SSH_ASKPASS.

932bfaf

Modify copyright.

1c25e27

Fixes a deadlock when a wrong passphrase is associated with a private…

5f7dd90

… key.

ExecRemoteAgentStarter.java updated to catch up with API change

9776f8e

...namely jenkinsci/remoting@944fb8a

Add -o HostKeyAlgorithms=+ssh-dss to ssh command used in tests.

66bae3b

OpenSSH 7.0 and greater disables use of ssh-dss public key algorithm. To allow tests to run on system with OpenSSH 7.0, explicitly enable ssh-dss by passing `-o HostKeyAlgorithms=+ssh-dss`.

Use Launcher interface to check whether ssh-agent is installed on…

0dcd5a8

… remote host

jglick added the work-in-progress label Feb 8, 2017

jglick mentioned this pull request Feb 8, 2017

New implementation of ssh-agent (second attempt) #17

Merged

jglick added 10 commits February 8, 2017 15:27

FindBugs

2ea595a

Tabs to spaces.

3b14ad2

Use RSA for the host key algorithm so that the OpenSSH client will ag…

5a60af8

…ree to connect to the test server without special options. apache/mina-sshd#29

Deprecated override.

24cdb07

Apparently no test in this plugin ever tried using an agent, so the R…

20d2aeb

…emoting calls were not exercised.

Simplified ExecRemoteAgent to use Launcher & FilePath for all remote …

0776101

…calls.

FindBugs

78fe995

Update Pipeline dependency.

34806fa

Missing $SSH_AUTH_SOCK would indicate a serious problem.

7772af1

If there is no passphrase, there is no need to create an SSH_ASKPASS …

ec3aac2

…script either.

jglick commented Feb 9, 2017

View reviewed changes

jglick mentioned this pull request Feb 9, 2017

Allow plugin overrides to be specified with safe environment variable names jenkinsci/acceptance-test-harness#273

Merged

jglick removed the work-in-progress label Feb 9, 2017

recampbell assigned stephenc Feb 10, 2017

stephenc approved these changes Feb 10, 2017

View reviewed changes

jglick merged commit 8d02c6c into jenkinsci:master Feb 10, 2017

jglick deleted the ExecRemoteAgent-JENKINS-36997 branch February 10, 2017 18:44

jglick mentioned this pull request Feb 10, 2017

[JENKINS-37430] add support to ppc64le #16

Closed

jglick mentioned this pull request Apr 6, 2017

Updating sshd-core to 1.4.0 jenkinsci/sshd-plugin#10

Merged

jglick mentioned this pull request Jan 4, 2021

[JENKINS-51273] sshAgent fails on declarative pipeline and also yaml jenkinsci/kubernetes-plugin#331

Closed

This was referenced Mar 10, 2021

Use Netty tcnative fork instead of old tomcat-apr #47

Closed

Delete non-exec-based agent factories #48

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[JENKINS-36997] CLI implementation of RemoteAgent#18

[JENKINS-36997] CLI implementation of RemoteAgent#18
jglick merged 20 commits intojenkinsci:masterfrom
jglick:ExecRemoteAgent-JENKINS-36997

jglick commented Feb 8, 2017 •

edited

Loading

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

jglick Feb 9, 2017

Uh oh!

stephenc left a comment

Uh oh!

jglick commented Feb 10, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

jglick commented Feb 8, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stephenc left a comment

Choose a reason for hiding this comment

Uh oh!

jglick commented Feb 10, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jglick commented Feb 8, 2017 •

edited

Loading