Parsing issues with JCasC and

Your checklist for this issue

🚨 Please review the guidelines for contributing to this repository.

• [x ] Jenkins version 2.190.1

• Plugin version Credentials Plugin - 2.3.0 and Configuration as Code - 1.32

• OS Linux

Description

I’m am trying to execute the following fragment in my JCasC script

  credentials:
    system:
      domainCredentials:
        - credentials:
            - basicSSHUserPrivateKey:
                scope: SYSTEM
                id: ssh_with_passphrase_provided
                username: ssh_root
                passphrase: ${SSH_KEY_PASSWORD}
                description: "SSH passphrase with private key file. Private key provided"
                privateKeySource:
                  directEntry:
                    privateKey: ${SSH_PRIVATE_KEY}

When I insert my private key in PEM format into the fragment and run it, my github certificate is reported as invalid but if I put the same value manually to the certificate plugin it works just fine.

After much testing and reading about base64 encoding I stumbled upon this fragment to check the contents of my certificate store:

 def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
     com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class,
     Jenkins.instance,
     null,
     null
 );
 for (c in creds) {
      println(c.id + ": " + c.description  )
      if(c instanceof com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey)
               println(c.getPrivateKey())
 }

I was able to determine that the contents of the certificate are not being parsed properly by the JCasC input process. To put it simply: The carriage return after the “BEGIN PRIVATE” is being ignored as well as the carriage return before the “END PRIVATE”. Here is an example:

-----BEGIN RSA PRIVATE KEY----- line 1
line 2
line 3
line 4 -----END RSA PRIVATE KEY-----

I was able to fix it by inserting the CR directly into the JCasC template and it works just fine.

I thought I’d pass this on since it might help someone in the same situation as myself and possibly close a bug!

Thanks!

[daverod24]

I could solve the problem I had here the solution 20 spaces have to be indented and I did it this way and it worked for me

#jinja2: trim_blocks: "true", lstrip_blocks: "true"

           - basicSSHUserPrivateKey:
               scope: GLOBAL
               id: "{{slave_linux_jenkins_cred_id}}"
               username: "{{jenkins_user}}"
               passphrase: ''
               description: "SSH passphrase with private key file. Private key provided for {{jenkins_user}}"
               privateKeySource:
                 directEntry:
                   privateKey: |
                      {{ SSH_PRIVATE_KEY | indent(20) }}

render this way and it’s works #resolvetaskssh

              privateKeySource:
                directEntry:
                  privateKey: |
                    -----BEGIN RSA PRIVATE KEY-----
                    MIIEogIBAAKCAQEAm2eO9B2a9g6E7vCmhEMyoNDyPgUmcr4gChnirniN0SUYCAyo
                    2/rSVhEe+LxU1MR3ZhOfTGX6uozc/bBHExsKj4/drR2f6oAJfa8Drvaplxr7GeI5
                    ul4tea/ZtsT6iPNYLlfJeMM7TkjMt7fl/x+pycxT4fuWKRDoOHZlPcXXZkPvbSpm
                    D7UmkQq7npyzkTwysY7OeeF5iXT6LOZRyc28Yn5fxzmAZ58lTzHExBHP1HcmH++h
                    hPIBAoGAPlJk4r3bAa3wK8CcuWISPmSx5TM/KWKDWCZpkGX99gKVIJrxTVc9Kyu6
                    qov+TRng6qxbA/8BOL7MWjJu9e5n5dNHZE5bghBSDoC+8g6tZxsMJrFuQQ+Y1EiH
                    n63Rb1vZJOXH7o/iiBU8ZRbGVX0iPCJZaXcGVOfwXPcR55NhocY=
                    -----END RSA PRIVATE KEY-----        

I hope this helps someone regards

[jetersen]

JCasC can decode base64 to strings with the help of substitution: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#additional-variable-substitution