Jenkins Google Summer of Code Office Hours, 28 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GSoC 2021 Git credentials binding 2021 07 28

Description

Jenkins git credentials binding office hours July 28, 2021. Topics included discussing issues with private keys.

Meeting notes are available at https://docs.google.com/document/d/1gZneYIDWrT5S-1ACG641wfvxs7vnDC0RCYqy-EuuhwY/edit#heading=h.m0lph2u36pvh

A

Cool looks like it's recording, so we've got uh a credentials binding project july 28th, 7 30 a.m, india standard time.

A

So the hardship we were talking about um before you joined, we were just kind of kicking off with this topic of the private key support and things that we should check. uh You had mentioned something in the getter about an rsa, a uh rsa encrypted keys that you're having problems with with the library you're. Using can you do you want to kick off the discussion on with some detail there.

B

Yeah, so so I think that the ssd library is not supporting the rsc encrypted key, which is open, ssh format.

B

I mean any other key, such as e c d s, a 19 which is encrypted and even in open, ssh format is, is you know, performing the task very well, but the rsa encrypted is not.

B

I think that the issue is from the ssj library rather than in the binding code.

C

Okay, but have you tried debugging.

B

Yeah I tried to debug well, I have not gone through the code of the ssj library that much so.

C

Oh, no, that's! Okay, because I can see from there uh from their read me they're saying in the supported algorithms. I can see rsa in fact,.

B

A

D

So reshop could you could you provide a link that we could drop into the document on the because it may be that we're just talking to different types.

B

Also, uh I just discovered more that pkcs encrypted uh encoding is not supported, the not supported in the bouncy castle, plugin api, like it's showing an error when I was performing tests, so I think I need to either open an issue or make a video regarding that.

C

Yeah we we, we do have a pkc state format, private keys or open ssh.

B

Any name it can be in them.

E

It can be in openness.

D

But I've I've never seen openssh mention any support, pp keys for pkcs8 keys. I would assume that if openssh doesn't support it, we don't need to.

C

Yeah and I I thought that um the pkcs8 format is used for certificates right, I mean storing certificate changes, sort of a format which is used to store intermediate and client root certificates.

C

That's what I.

C

D

So harsha, I think what you're hearing is that we're not worried about pkcs8 format. As far as I can tell, because not a concern because openssh doesn't support it and so a pkcs8 format unless you've, unless you found some way to use pkcs8 to to to communicate with openssh I've. Never I've never seen it mentioned in any documentation.

B

Well, I will look into that more because I have just discovered the issue this yesterday.

C

Okay, but but if mark is saying that open ssh is not supporting it, then why would we need to worry about it? Because if a user is not going to create a key with it, then ssh key pair, then why would it be an issue for us.

D

Okay, now I'm seeing that okay, so open, takes a minus m argument for key format and does accept pkcs 8 as a public key or private key.

D

So apparently it will accept pkcs8, so we may have to just declare hey not supported.

C

B

Yeah code is available in the bouncy castle appear for the pgcs, but it is not performing as as expected. You know you can say uh it is showing an error. I think that's and that's a bug for that. I mean the code. Is there in the plugin, but it's showing an error. So this there is a bug.

B

It is suppose it supports, but there is an is there's. No support is available for that.

C

So um what I was, what I was trying to say is that when we're talking about releasing this ssh private key as a binding for the git plugin, should we not focus on encryptions and formats which we know for sure are going to be encountered by 90 or, let's see 80 percent of the user?

C

If that is something we can figure out, and if we know that, then we should focus on that and first release the plugin with that those many encryption algorithms and we can say that we yes at this moment, we don't support, let's say pkcs8 or any other algorithm, which is a bit outdated. Probably.

C

I mean is: is that a viable uh strategy we could use uh mark chest and membership.

D

For me, if we support rs, if we support the keys that a typical linux system will generate, I think we're 90 of the way there and a typical when I say a typical linux system, I mean a typical linux system using ssh-keygen.

A

Yeah, I agree, I think kind of try and solve the the broad case, and then you know if we need to create, follow uh jira issues or something like that or just declare them. As you know, what's what is supported? We could even declare in the dock and then, if it's unsupported and someone wants it, they create an issue like that seems like an option to.

A

I generally agree.

C

I think that creates a dependency for him. It blocks him right and then he would have to create a pr there and I'm not sure how their development cycle works. It's going to.

C

B

Oh, no, I just discovered it yesterday, so I have to do you know more on that and then I will will, I think, open an issue or I should I you know. Should I look into the accord and solve the resolve issuer? Should I just open an issue for that.

C

um My advice would be first, you should um have you gone through the unit test, so actually I was trying to find their unit test. I was not able to right down, but I remember that in the unit test, they've tested a lot of algorithms. uh These encryption, algorithms and um they've shown how to decrypt them. So why are you able to see an example of them decrypting a ptc state format key because I vaguely remember that I saw it, but I I just I'm not able to find it right now from github.

C

So what I'm trying to say is just make sure that um it is a bug from their side and not because um maybe we are giving a wrong input or there is something that they something different, that they are expecting. Something like that.

A

I guess I'd even maybe go a different way like we could just kind of mark this. As you know, it may not work for now and just kind of like keep moving forward with the ones that are the standard ones, just in the interest of time and moving forward.

D

Yeah I I I'm, I'm agreed with justin that if I think, if we support rsa and ed25511, we've probably already supported over 95 percent of the use cases just with those two, those two algorithms and passphrase protected or not passphrase protected.

D

Now harsha, the thing I didn't understand from your your getter comment was, I think you said that rsa is not working for you with when using open, ssh format. Did I understand that correctly, yeah? Okay? So so that's that would be a red hot one, because rsa is the default used on many of the, and I think maybe even most ssh implementations.

C

Okay, so if the private key file is encrypted by the rsa format, then we are not able to decrypt it right.

B

You know the ssj ssj library is decrypting the file and return it in a pkc escape format uh in form of byte, adding and then I'm using the bouncy castle api to convert it into a new format. You can so that it can be used for the authentication purpose, because by data is not that much supported. I guess I mean it was showing another because showing an issue that needs to just secure.

B

The key is not that much secure if you are using right array, because the fam format uses bs4 the base64 format for the transferring of the key. That is more, you know useful and more reliable, rather than binary. So.

C

But I didn't, I did not understand what is your issue. Your issue is that you are not able to uh use that byte array and then is there an issue with the transformation to the pem format from pkcs8, or is there an issue in decrypting that key.

B

C

B

Is I am not able to perform the authentication operation? Well, all other tasks are being performed, but the only thing is: I am not able to form the authentication operation. It says that.

C

Okay, so, okay, the library is not okay, okay, so there is some issue with the decrypted key. That is what it is.

A

um But I guess, are you able to take the bite array and put it down on the file system and see if that works? Oh, yes, without going taking that extra step.

B

Ready yeah, I did that I.

A

Didn't know, okay, that works right or no, oh, no, that doesn't work. Okay,.

A

B

Also, the you know the ss is bending is highly dependent on library, so it is mostly mean for open necessity or 100 dependent on the ssj library and for other formats, it's dependent on the bouncy castle, plug-in library api. So the bind the acid binding code that I am providing is not much.

B

You know playing much role. The only the bindings are.

C

So, as I understand it, um if let's say your rsa pass phase predict key first, it will be. I think it would be encrypted by a cipher right like aes, something like that aes256 and then that is decrypted, and the second step would be to give you that rsa format formatted key into into a bi-direction and you're, saying that that is provided to you in a pgcs8 format.

B

C

When you're talking about rsa.

C

Oh, you have opened an issue, in necessity,.

B

Oh yeah, I mean uh if I am wrong, they could even point me to that direction and.

C

C

D

B

I'm just wanting to know like if I mean the issue is really in ssd library. So are we still using that or should we, you know, look for the alternatives.

C

That depends that do we have an alternative which would work for all of the cases.

D

Yeah, so so rse are for me. Rsa key support is crucial without our without rs we we could, we could ship without it, I guess, but the pain factor would be enormous, because most users generate rsa keys by default. So if we truly can't make it work with ssh, I think we have to look for something else that would support it, yeah or or provide a fix back to that allows it to be supported. That would be fine as well.

D

I'm just astonished if it's not supported, because I would expect their consumers see it as the most common uh encryption algorithm.

A

Yeah- and I guess hardship, I think you said that you just recently discovered this, and maybe some more debugging can go into whether this uh you know there's just something else that needs to be done or something like that is. That is my understanding, correct.

B

When you're in the.

B

I still think that the issue is in ssj lagging so because the binding code is not that much playing role in the in decrypting. The key and you know, leaving the uni byte array. It's just just giving the key in string format and and then outputting. The key in base 64 format, even using the bouncy classic plugin.

C

C

Could there be a reason that we're not consuming the crack? They may be decrypted by having the right form so you're saying. First of all, I just don't understand that I'm seeing your code here which you've written in the issue that you get the private key out of the um the open, ssh key one key file, and then you get the encoded byte right. This encoded byte array, you then I would assume the uh decoded base64 right.

C

This would be a basically for encoded, byte, app, yeah and you're, saying that this is an ek format, because you you've checked the get format from the get format function that this was pcc.

C

And then, um since this is pkcs, it is whereas I understand you were working with pem for mac files right, so you would be doing that conversion as well.

B

C

Okay, and so, if you have have you tried using that pkcs8 file like converting that into a pkcs file, 8 file.

C

Or are you using the pen after converting whatever logic, you've created and then using the.

B

Doesn't work and it didn't work, so I'm now using the bouncy class later from that to convert into m, I mean that's also not working.

C

B

I tried both the cases.

E

C

And have you seen in ssj? Is there an example? Could you find a test case or something like that? This.

C

Give us an example.

C

Because I cannot.

C

C

A

Yeah, that's a that's a good question rashav. I think um so. I'm sorry, I'm looking at the ssh um repo. It looks like they have integration tests with rsa keys.

D

Oh yeah, that's that's what I was seeing as.

A

Well, so we might be able to use that. Let me this is a pr that came in that actually looks like it recently added the some other keys or that's what it says: anyways comprehensive support for public key office certificates so with certificates.

A

Okay, that's slightly different. I.

A

C

And um and when we're talking about rs, so I was when I was reading about open, ssh's new format which they implemented.

C

uh So if, if I don't provide an encryption algorithm when I'm uh using sss key gen, I uh mark you are saying that the keys would be uh rsa keys right generated the private key.

D

I believe so I think that's what I had experienced previously. Let me double check the man page, just to be sure.

C

Okay, because wouldn't open ssh default to the new open, ssh format. Now the encryption and I believe it's uh open, ssh hyphen.

A

But it depends on what system you're on and what you have yeah. I mean that's a good point, but yeah, like some older systems, are probably gonna have like the older versions.

D

Yeah, certainly the I would expect the version of openssh that's installed on centos 7 to be dramatically different than the version that is installed on openbsd69, because one of those was created. What centos, 7's original release is probably seven or eight years ago now and open bsd six nine released in may of this year.

D

So so there that's, that's why the operating system variance thing there is is on the test. Ideas is because those different versions of ssh may generate different different things that users will paste into the.

C

Form so I I just tried ssh and it yeah it's generating a public and quite rxc keypad by.

C

D

I I just tried the same thing on openbsd69 and it is offering to when I run ssh keygen with no arguments it offers to store it in ssh id underscore rsa. So I think it's still defaulting to generate an rsa key.

C

So that means that this, since the the rsc key, would not be the new opening format, then I I think bouncy castle would be able to do it right because rsa is relatively uh open. Ssh was new and fall and they don't support uh decryption of fast-paced, protected private keys when they're in openssh format, but rst, I think, would be supported by like not even ssj.

C

D

Good, so I I'm afraid I I don't know which libraries support, which which formats and that's where I think harshit's investigation is the is the harshitch implementation is the real answer.

D

If, if it's not working for him, then it probably won't work for the users.

C

Have you I clearly remember that the bouncy castle java repository contains tests where they they show uh various formats how to decrypt them? Have you seen some of the examples there? Could you see? Could you find an example how they're doing it when it comes to rsa.

B

C

um I would expect both.

B

So the format will be different. Okay,.

C

Yeah yeah, I think that would be a good exercise. I think that's the easiest way to find if it doesn't work or not and the correct way to do it as.

C

A

Yeah and maybe maybe it's that we end up using bouncy castle directly instead of sshj, if you can, because you'll have the bouncy castle apis already imported.

A

um So maybe it's that we use ssj for the uh two five five one, nine and bouncy castle for.

A

Rsa but I think rishabh, I think you're kind of also saying that maybe that'll unlock using ssj to use rsa.

C

No I'm just saying I was saying that, um if, if uh we don't have to so the issue where we have to have to switch from bouncy castle to system started from a point where openness is such private keys, like in their format, that that is where bouncy has been supporting us. But since rsa is when we're creating keys, which are in rsa, that that should be supported by it is supported by bouncing acid.

C

Assuming that we can find some place where they've done it, decrypted, rs and keys in bouncy castle, and I'm not sure why ssj is not supporting.

C

A

Okay, yeah uh any other thoughts on that one or any other concerns that we need to talk about. um Besides that, it's a big one.

D

I'm I'm trying to catch myself up to speed just reading the ssh keygen man page, and I think I've got more more things we need to put in the formats in the key f or maybe less things to put in the key formats. There are three key formats that are listed here. I'm going to update that just because I was being imprecise, it looks like they've got a thing called rfc 4716, slash, ssh2 public, okay, that one we've got pem and then pkcs8.

D

So those three seem to be the key formats that it can that ssh key gen can both import and export and can change the passphrase on.

D

D

So so for me, I think justin to you to your question. I've just got. I need to do more. I didn't need to test the code that harshit has submitted as part of the pull request and see, see confirm that does it support rsa keys that I've generated if it does which kind of rsa keys? Does it not support that sort of thing.

A

Yeah that makes sense.

A

Do we have any topics that we should cover now?

A

I think this is our big one right now.

D

Yeah and I apologize my capacity to do, testing right now is pretty limited, but no the next.

C

D

That I'll be able to attack. This is probably this weekend.

A

Harsha were there any other topics that you wanted to cover in.

B

Today, well, I'm pretty awkward by this moment.

B

So there is not much to cover only the the two things were there, only the ssj regarding the snj and and the bouncy castle, and- and we have discussed on that so.

A

A

Yeah, so I guess from here- maybe we, I guess, are we maybe done for today and then offline. We kind of like people can take a poke at the rsa stuff, see what we find out.

A

I'm happy to continue talking about this too. I'm not trying to close down the subject.

A

B

um Just I have just one thing to a smart like off topic so mark uh the issue that I encountered. When the you know the art plugin artifact version was 4.19, so it was dissolved when it bumped you, so you changed it to 4.21. So can you tell.

E

C

B

D

Unfortunately, I don't have any guess at all what was causing it, because that was I couldn't. I couldn't duplicate it and- and I think what you're saying is now you no longer see it either yeah interesting yeah, so I've I don't. I don't know what what would have caused that that was.

D

I mean I guess it could have been something corrupted or mangled in your maven repository cache, that's on your in your dot, m2 directory. um It could be some other surprise. I I apologize harsh it, but I just don't know that that was completely perplexing to me.

B

I mean that it was not. You know, reproducible by by you, it was not no.

B

I have two systems so on both the system. It was showing the error, so I was sure that it was.

D

Interesting and and yet okay, so then, if it was showing it on both systems, then it certainly should not have been anything related to local corruption on one system and not another, that that's really strange and but are are either of the system still showing the problem.

E

Oh no, after you know changing to 4.2, and then it was gone interesting.

D

If you, if you switch back to 4.20, does the issue return.

D

So that may that yeah, that might indicate some real problem in the the parent parent version 4.24.20. But I have not seen any mention of that kind of problem anywhere in the jenkins mailing.

D

Lists, let me see if let me see if I can read the releases to see if there's some hint in the release, notes.

D

Okay, so 4.21 was released to remove the spot bugs upgrade to 4.3.0, so that to me doesn't seem like doesn't seem like it would be likely to do any damage to your ability to compile and oh and at 4.20, though, requires maven 3.8.1.

D

What version of maven are you currently running.

B

uh I updated about first before that I was running 3.6.1, so it showed an error, so I upgraded updated it to 3.8.1 or 0. I think 8.1.

D

Okay, good so you're running the correct version, then so that's not the.

D

D

Okay, so, unfortunately I don't have have any guess what could be going wrong and and just would suggest, hey, let's continue and if it. If the issue appears again we'll ask on the developer list to see if others can give us any.

A

A

Yeah I've I've had yeah. The two systems thing is interesting, though. um I've had similar local maven cache sad times before that sometimes magically fix themselves after a clean but yeah with two systems.

A

It's interesting, hopefully we're happy now yeah yeah.

D

Okay, then I've I've exhausted my topics.

C

um Harshap will be generating those um keys when you're testing, so you just you're not providing a specific algorithm right, you're, just generating them using ssh keygen.

B

Yeah, no, no well, it depends on which form which algorithm I want to use, and for my.

C

Yeah, of course, and you you're, giving rsa as the algorithm.

B

C

And the private key, when you open it, you see open, ssh, private, key or using rsa private key. So openness is it yeah. So so then, the pro when I was saying that rsa should be supported and we should definitely find a submission for bouncy castle problem. So this is not the rsa algorithm right. This would be open, ssh yeah. We would need to look at ssj because ssj was is able to decrypt openssh the newer format with different algorithms.

C

You've tried with different right, but with r, then rsa you're, saying it's.

C

C

I'll try doing it as well now.

C

D

So harsh you'll continue your investigation of key support and we'll we'll talk further on friday. If I've had a chance to do some interactive testing, we can look at the results then. Otherwise it may be next monday, before or next tuesday or wednesday. Your time before, I'm ready to talk about test results.

B

Well, I will be submitting some unit tests for.

E

That, oh, you can go through that great excellent.

A

Yeah but yeah. I also like uh rishabh's idea about looking to see if there's any, if you can find any unit tests for bouncy castle.

C

A

Really maybe they're, even in other gate repositories um for rsa.

D

Yeah and I definitely see rsa based tests in the sshj repository.

D

Now, when I look at the data files, they don't look, they look like they are one of the variants of of files that are understood by openssh, but I haven't haven't proven. I haven't confirmed that by interactive test.

A

Yeah, hopefully it's just like a little weird thing that he you just need to flip a something somewhere.

C

A

Those are the most annoying ones.

C

C

A

Cool all right. Well, I guess, uh if we have nothing else, we can close her out thanks. Everybody thanks thanks. Everybody all right have a good one. Take care.