Windows上Jenkins的git插件不使用带子模块的凭据

Question

I have an issue with Jenkins on Windows with git, I can use ssh credentials to fetch git repository from BitBucket but when it tries to fetch the submodule repository, which is on the same account, I get permission exception.

Fetching upstream changes from git@bitbucket.org:mycomp/at.git

C:\\CI\\Git\\bin\\git.exe --version using GIT_SSH to set credentials Bitbucket key C:\\CI\\Git\\bin\\git.exe fetch --tags --progress git@bitbucket.org:mycomp/at.git +refs/heads/ :refs/remotes/origin/ C:\\CI\\Git\\bin\\git.exe rev-parse "origin/ci^{commit}" Checking out Revision a079842300ba7fc9e6f4e7182c94af2cfc3af0ba (origin/ci) C:\\CI\\Git\\bin\\git.exe config core.sparsecheckout C:\\CI\\Git\\bin\\git.exe checkout -f a079842300ba7fc9e6f4e7182c94af2cfc3af0ba C:\\CI\\Git\\bin\\git.exe rev-list a079842300ba7fc9e6f4e7182c94af2cfc3af0ba C:\\CI\\Git\\bin\\git.exe remote C:\\CI\\Git\\bin\\git.exe submodule init C:\\CI\\Git\\bin\\git.exe submodule sync C:\\CI\\Git\\bin\\git.exe config --get remote.origin.url C:\\CI\\Git\\bin\\git.exe submodule update FATAL: Command "C:\\CI\\Git\\bin\\git.exe submodule update" returned status code 1: stdout: stderr: Cloning into 'include/portal_air'... Permission denied (publickey). fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Clone of 'git@bitbucket.org:mycomp/portal_air.git' into submodule path 'include/portal_air' failed

hudson.plugins.git.GitException: Command "C:\CI\Git\bin\git.exe submodule update" returned status code 1:
stdout: 
stderr: Cloning into 'include/portal_air'...
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Clone of 'git@bitbucket.org:mycomp/portal_air.git' into submodule path 'include/portal_air' failed

    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1406)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$400(CliGitAPIImpl.java:87)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$6.execute(CliGitAPIImpl.java:741)
    at hudson.plugins.git.extensions.impl.SubmoduleOption.onCheckoutCompleted(SubmoduleOption.java:77)
    at hudson.plugins.git.GitSCM.checkout(GitSCM.java:908)
    at hudson.model.AbstractProject.checkout(AbstractProject.java:1414)
    at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:671)
    at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:88)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:580)
    at hudson.model.Run.execute(Run.java:1684)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:88)
    at hudson.model.Executor.run(Executor.java:231)

Answer 1

Yes, This is an issue which i have faced to clone a project and its sub module.

I was using https instead of git@ to clone the repos, git scm plugin only apply the credential passed via jenkins to main module and not for sub module. To fix the issue i had to run a process which stores the credential and passes it to any git operation which need authentication. Like this http://www.scmtechblog.net/2014/12/git-authentication-for-automation-script.html

Now, you are trying to access via git@ and still getting permission denied, Can you please make sure that the account has correct access on submodule repository for which you added the ssh keys.

Answer 2

Submodule authentication using the same credentials and protocol as the parent repository are now support with the Jenkins git plugin. Support was added in the 10 Sep 2016 release of Jenkins git plugin 3.0.0.

The submodule configuration portion of the job definition page ("Additional Behaviours" > "Advanced Sub-modules Behaviours") "now includes a checkbox "Use credentials from default remote of parent repository". Check that box and the credentials from the parent repository will be used for the submodules.

Note that the repository cloning protocols must be the same (ssh or https) for the parent repository and the submodules, otherwise the parent credentials can't be used with the submodule repository.