问题描述
在向GitLab的Windows Shared Runner上的ssh-agent添加SSH密钥时，我遇到了很大的麻烦，以便随后允许我访问GitLab上的私有软件包。
实际的SSH私钥是使用“文件”环境变量设置的，但是直接通过ssh-add将其添加到the permissions are too open状态，因此我研究了尝试纠正这一问题的方法-均无效。>
相反，我将密钥回显到手动创建的文件中。只是现在，添加密钥时，我收到“代理拒绝操作”。
为了增强性能，ssh代理甚至拒绝出于测试目的在VM内部生成的密钥。
SSH密钥均为ed25519类型。
这是我的gitlab-ci.yml脚本-我想念什么？
stages:
- test
test_windows:
stage: test
tags:
- shared-windows
- windows
- windows-1809
variables:
CI_ARTIFACTS_PATH_TMP: '"$CI_PROJECT_DIR"'
script:
# ------------------------------------------------------------------------
# Print the contents of some key directories
# ------------------------------------------------------------------------
- ls -l "C:\"
- ls -l "C:\Users\"
- ls -l "C:\Git\"
- ls -l "C:\Git\usr\bin\"
- ls -l "C:\Program Files\"
- ls -l "C:\Windows\System32\OpenSSH\"
# ------------------------------------------------------------------------
# Install dependencies/helpers
# ------------------------------------------------------------------------
# No steps required
# ------------------------------------------------------------------------
# Configure SSH (OpenSSH variant)
# ------------------------------------------------------------------------
- Get-Command ssh-keygen
- Get-Command ssh-add
- Get-Command ssh
- Set-Service -Name ssh-agent -StartupType Manual
- Start-Service ssh-agent
- Get-Service ssh-agent | select * # Check if it has started
# ------------------------------------------------------------------------
# copy the DK_FILE ssh private key env variable into the id_ed25519 file (create if nonexistent)
# ------------------------------------------------------------------------
- $dk_file_txt = Get-Content $DK_FILE -Raw
- echo $dk_file_txt
- New-Item -ItemType "file" -Force -Path C:\Users\$env:UserName\.ssh\id_ed25519
- echo "$dk_file_txt" > C:\Users\$env:UserName\.ssh\id_ed25519
- (Get-Content C:\Users\$env:UserName\.ssh\id_ed25519 -Raw).Replace("`r`n","`n") | Set-Content C:\Users\$env:UserName\.ssh\id_ed25519 -Force
# ------------------------------------------------------------------------
# Set Key Permissions
# ------------------------------------------------------------------------
# :: Remove Inheritance ::
# - cmd /c icacls "C:\Users\gitlab_runner\.ssh" /c /t /inheritance:d
- cmd /c icacls C:\Users\$env:UserName\.ssh\id_ed25519 /c /t /inheritance:d
# :: Set Ownership to Owner ::
# - cmd /c icacls "C:\Users\gitlab_runner\.ssh" /c /t /grant %username%:F
- cmd /c icacls C:\Users\$env:UserName\.ssh\id_ed25519 /c /t /grant %username%:F
# :: Remove All Users,except for Owner ::
# - cmd /c icacls "C:\Users\gitlab_runner\.ssh" /c /t /remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
- cmd /c icacls C:\Users\$env:UserName\.ssh\id_ed25519 /c /t /remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
# :: Verify ::
# - cmd /c icacls "C:\Users\gitlab_runner\.ssh"
- cmd /c icacls C:\Users\$env:UserName\.ssh\id_ed25519
# ------------------------------------------------------------------------
# Add the SSH key via ssh-add
# ------------------------------------------------------------------------
- ssh-add C:\Users\$env:UserName\.ssh\id_ed25519
# ------------------------------------------------------------------------
# Test if it worked
# ------------------------------------------------------------------------
# - ssh -Tvvv [email protected]
# - git config --global core.sshCommand "'C:\Windows\System32\OpenSSH\ssh.exe'"
# - npm install
# - npm run package-win
# ------------------------------------------------------------------------
# Upload artifacts (if any)
# ------------------------------------------------------------------------
# - gitlab-runner artifacts-uploader --verbose --id "${CI_JOB_ID}" --token "${CI_JOB_TOKEN}" --url "${CI_SERVER_URL}" --artifact-format zip --artifact-type archive --path $CI_ARTIFACTS_PATH_TMP || exit 1
# ------------------------------------------------------------------------
# Finish...
# ------------------------------------------------------------------------
- exit 0
artifacts:
paths:
- .ssh
exclude:
- node_modules
请注意，我还尝试了使用poshgit的变体，并为指向此安装的ssh命令设置了不同的别名。
使用poshgit变体时，已成功添加ssh私钥。但是，当实际尝试运行ssh会话时，我收到“主机密钥检查失败”错误。然后，这将终止我的npm安装（使用私有存储库作为依赖项）。
stages:
- test
test_windows:
stage: test
tags:
- shared-windows
- windows
- windows-1809
variables:
CI_ARTIFACTS_PATH_TMP: '"$CI_PROJECT_DIR"'
script:
# ------------------------------------------------------------------------
# Print the contents of some key directories
# ------------------------------------------------------------------------
- ls -l "C:\"
- ls -l "C:\Users\"
- ls -l "C:\Git\"
- ls -l "C:\Git\usr\bin\"
- ls -l "C:\Program Files\"
- ls -l "C:\Windows\System32\OpenSSH\"
# ------------------------------------------------------------------------
# Install dependencies/helpers
# ------------------------------------------------------------------------
# ------------------------------------------------------------------------
# Configure SSH (Poshgit variant)
# ------------------------------------------------------------------------
- choco install poshgit -y --limit-output --no-progress
- refreshenv
- Import-Module 'C:\tools\poshgit\dahlbyk-posh-git-9bda399\src\posh-git.psd1'
- refreshenv
- $env:PATH+=";C:\Git\usr\bin"
- Set-Alias ssh-keygen "$env:ProgramFiles\git\usr\bin\ssh-keygen.exe" # Provided by poshgit
- Set-Alias ssh-agent "C:\Git\usr\bin\ssh-agent.exe"
- Set-Alias ssh-add "C:\Git\usr\bin\ssh-add.exe"
- Set-Alias ssh "C:\Git\usr\bin\ssh.exe"
- Start-SshAgent -Quiet
- echo "$env"
- gci env:SSH_AUTH_SOCK
- mkdir .ssh
- Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'
# - ssh-keygen -f "$CI_PROJECT_DIR\.ssh\test_rsa" -t rsa -N '""'
# - ssh-keygen -f "$CI_PROJECT_DIR\.ssh\test_ed25519" -t ed25519 -N '""'
- New-Item -ItemType "directory" -Force -Path C:\Users\$env:UserName\.ssh\
- ssh-keygen -a 100 -t ed25519 -f "C:\Users\$env:UserName\.ssh\id_ed25519" -C "MY_SSH_KEY" -N '""'
- Remove-Item -Path "C:\Users\$env:UserName\.ssh\id_ed25519.pub"
# - Set-Content -Path "C:\Users\$env:UserName\.ssh\id_ed25519" -Value $dk_file_txt -Force
- ssh-add "C:\Users\$env:UserName\.ssh\id_ed25519"
# ------------------------------------------------------------------------
# Test if it worked
# ------------------------------------------------------------------------
# - ssh -o StrictHostKeyChecking=no [email protected] uptime
- ls -l "$env:ProgramFiles\"
- ls -l "$env:ProgramFiles\git\"
- ls -l "$env:ProgramFiles\git\bin"
# - Set-Alias -Name git -Value "$env:ProgramFiles\git\bin\git.exe"
# - npm config set git "$env:ProgramFiles\git\bin\git.exe"
# - git config --global core.sshCommand "$env:ProgramFiles\git\usr\bin\ssh.exe"
- ssh -Tvvv [email protected]
# - npm install # Fails with error code 128 (ssh failure)
# - npm run package-win
# ------------------------------------------------------------------------
# Upload artifacts (if any)
# ------------------------------------------------------------------------
- gitlab-runner artifacts-uploader --verbose --id "${CI_JOB_ID}" --token "${CI_JOB_TOKEN}" --url "${CI_SERVER_URL}" --artifact-format zip --artifact-type archive --path $CI_ARTIFACTS_PATH_TMP || exit 1
# ------------------------------------------------------------------------
# Finish...
# ------------------------------------------------------------------------
- exit 0
artifacts:
paths:
- .ssh
exclude:
- node_modules
理想情况下，我宁愿使用openssh，而不必添加外部依赖项。感谢您的帮助，因为我在此问题上浪费了很多时间。
解决方法
暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！
如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。
小编邮箱:dio#foxmail.com (将#修改为@）