2

I have a build script for a Jekyll website (GH pages) that required calling git commands that require Github authentication from inside of the script. Here is the script: 

#!/usr/bin/env bash

rm -rf _site/

git clone [email protected]:RIT-EVT/RIT-EVT.github.io.git --branch master --depth 1 _site

LIVE_VERSION_BUILD=`cat _site/version`

LIVE_VERSION=${LIVE_VERSION_BUILD%.*}
LIVE_BUILD=${LIVE_VERSION_BUILD##*.}
PACKAGE_VERSION=`sed -nE 's/^\s*"version": "(.*?)",$/\1/p' package.json`

if [[ "$LIVE_VERSION" == "$PACKAGE_VERSION" ]]; then
    LIVE_BUILD=`expr $LIVE_BUILD + 1`
else
    LIVE_VERSION=${PACKAGE_VERSION}
    LIVE_BUILD=0
fi

rm -rf _site/*

jekyll build
echo "$LIVE_VERSION.$LIVE_BUILD" > _site/version

cd _site/
git add -A
git commit -m "v$LIVE_VERSION.$LIVE_BUILD $(date)"
git push
cd ..

I am running Jenkins within a Docker container that I pulled from the docker hub. I modified the container by adding the same private key information used by Jenkins to perform the initial clone of the repository. However, when I call a git command from the script, it says it's unauthenticated:

Started by user evt
Building in workspace /var/jenkins_home/workspace/Website Deploy
 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url [email protected]:RIT-EVT/RIT-EVT.github.io.git # timeout=10
Fetching upstream changes from [email protected]:RIT-EVT/RIT-EVT.github.io.git
 > git --version # timeout=10
using GIT_SSH to set credentials GitHub - ssh
 > git fetch --tags --progress [email protected]:RIT-EVT/RIT-EVT.github.io.git +refs/heads/*:refs/remotes/origin/*
 > git rev-parse refs/remotes/origin/develop^{commit} # timeout=10
 > git rev-parse refs/remotes/origin/origin/develop^{commit} # timeout=10
Checking out Revision 85084620e62b5b03f02c610e33880eeb94b12531 (refs/remotes/origin/develop)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 85084620e62b5b03f02c610e33880eeb94b12531
 > git rev-list 85084620e62b5b03f02c610e33880eeb94b12531 # timeout=10
[Website Deploy] $ /bin/bash -xe /tmp/hudson9119924045433544873.sh
+ rm -rf _site/
+ git clone [email protected]:RIT-EVT/RIT-EVT.github.io.git --branch master --depth 1 _site
Cloning into '_site'...
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Build step 'Execute shell' marked build as failure
Finished: FAILURE

So the key information is clearly working for the git plugin for jenkins, but for whatever reason, the key is not being picked up by the git binary in the container. What's even weirder is I can SSH into the machine that the container is running on, docker exec -it jenkins bash into the container, and run the same git command, and it works perfectly.

This got me thinking that it might be an issue with users and permissions. So I tried to find out what user jenkins is running the script as. Here is the very small script I ran:

echo ${USER}
echo hello # Just a sanity test to make sure that echo works :p

This is the output I get:

misc. Jenkins stuff...
[Website Deploy] $ /bin/sh -xe /tmp/hudson1343134234815638946.sh
+ echo

+ echo hello
hello
Finished: SUCCESS

So it seems that it's not able to get access to the key information loaded into ssh-agent because the script is not being run under the same user that loaded the key(?)

Any help would be greatly appreciated :)

Update:

I ran whoami to see if that would work in the script, and it gave me jenkins as the result:

[Website Deploy] $ /bin/bash -xe /tmp/hudson2652666458388248519.sh
+ whoami
jenkins
Finished: SUCCESS

So I am stumped why git cannot pickup the private key from ssh-agent.

Improve this question
5
  • since echo ${USER} didn't seem to help you could try replacing that with a whoami command and you should get the username jenkins is running under. Commented Mar 7, 2017 at 19:34
  • Also I'm not certain that calling git from a bash script will interact with a jenkins plugin. It would depend on if the plugin stores the key in the user's .ssh directory and how. If you used the -i flag and gave the path to the key you want to use, you should be home free. Commented Mar 7, 2017 at 19:38
  • I dont need it to interact with the jenkins plugin. That's why I also loaded the private key into the ssh key store on the container itself, since that's usually how git picks them up. Commented Mar 8, 2017 at 13:48
  • Ok, so running whoami gave me jenkins, but I'm stumped as to why it cant access ssh-agent. Commented Mar 8, 2017 at 13:51
  • You can use your SSH key and SSH agent please see answer here: stackoverflow.com/questions/47870282/… Commented Jan 25, 2018 at 13:53

2 Answers 2

Reset to default
1

I figured out what was wrong. If I logged into the container using docker exec -it jenkins bash, ran eval `ssh-agent -s` to start the ssh-agent, and ran ssh-add <keyFile>, I could run the git clone right there in the shell.

However, if exited the shell and logged back in by running the same docker command, the ssh-agent would not be started and would not have the private key loaded, which led me to believe that the ssh-agent was not actually running when the Jenkins build ran.

So, I switched to using https with git and supplying a username and password into the URL of the repo by using the credentials binding plugin.

So in essence, you cannot call git commands from Jenkins build scripts and expect to be able to use your SSH keys.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

While this may have worked for you, it is entirely possible to call git commands from within Docker containers on Jenkins. Simply use the SSH agent plugin when configuring your build job. This will not only provide the SSH key that you need from the Jenkins credential store, but it will also configure and setup the SSH agent for you.

I always suggest using only SSH keys as they are more secure and harder to compromise.

In addition, the SSH agent plugin can be invoked within a Jenkins pipeline script as well. Simply wrap any commands that need access to the key with an sshagent block.

For example:

sshagent(credentials: ['jenkins-credential-id']) {
  sh 'git clone [email protected]:RIT-EVT/RIT-EVT.github.io.git'
  sh 'jekyll build'
}
Improve this answer

1 Comment

It would be useful to see more context. Where do you write this? In steps ?

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.