Support multiple SSH keys #14

mpdude · 2020-01-10T20:12:06Z

Multiple SSH keys can be put into the secret value and will be split by the action.

Hopefully this can easily be tried by using uses: webfactory/ssh-agent@support-multiple-keys in the workflow definition.

Leave a comment or 👍 here if it works for you.

bradmartin · 2020-01-10T21:00:51Z

What would the expected input be fore this using the action?

I'm getting errors with the yml file when trying:

          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY | secrets.SQLITE_ENCRYPTED_SSH_TOKEN | secrets.SQLITE_COMMERCIAL_SSH_TOKEN }}

also , to split them and you can't use multiple ssh-private-key on the with so I'm unsure how to input multiples into the action. Any advice?

bradmartin · 2020-01-10T21:56:02Z

So looks like

    with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}, |
            ${{ secrets.SQLITE_ENCRYPTED_SSH_TOKEN }} |
            ${{ secrets.SQLITE_COMMERCIAL_SSH_TOKEN }}

is valid as well as using a , to split them. I've just got an issue with how I uploaded the keys (invalid format) to work through to confirm.

Here's my current action output for this branch:

  Setup SSH-Agent2s
##[error]Node run failed with exit code 1
Run webfactory/ssh-agent@support-multiple-keys
  with:
    ssh-private-key: ***, | *** | ***
    ssh-auth-sock: /tmp/ssh-auth.sock
Adding GitHub.com keys to /Users/runner/.ssh/known_hosts
Starting ssh-agent
Adding private key to agent
Error loading key "(stdin)": invalid format
##[error]Command failed: ssh-add -
Error loading key "(stdin)": invalid format

##[error]Node run failed with exit code 1

bradmartin · 2020-01-10T22:31:29Z

I've swapped out the KNOWN WORKING value:

          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

with a second token that I assumed was wrong and it does work, so I've confirmed my TOKENS are valid on my main repo. So I'm still uncertain how to provide the multiple values to this 😞

webknjaz · 2020-01-10T23:38:06Z

index.js

@@ -17,7 +17,9 @@ try {
    core.exportVariable('SSH_AUTH_SOCK', authSock);

    console.log("Adding private key to agent");
-    child_process.execSync('ssh-add -', { input: core.getInput('ssh-private-key') });
+    core.getInput('ssh-private-key').split(/(?=-----BEGIN)/).forEach(function(key) {
+        child_process.execSync('ssh-add -', { input: key });


It'd be nice to calculate a fingerprint and log it so that people would understand which key gets loaded. It's good for troubleshooting as there's no other ways to see what's going on.

Use something like this maybe: https://developer.github.com/apps/building-github-apps/authenticating-with-github-apps/#verifying-private-keys.

webknjaz · 2020-01-10T23:40:20Z

with a second token that I assumed was wrong and it does work, so I've confirmed my TOKENS are valid on my main repo. So I'm still uncertain how to provide the multiple values to this

try this:

with:
  ssh-private-key: |
    ${{ secrets.SSH_PRIVATE_KEY }}
    ${{ secrets.SQLITE_ENCRYPTED_SSH_TOKEN }}
    ${{ secrets.SQLITE_COMMERCIAL_SSH_TOKEN }}

Pipe will preserve the new lines in YAML.

mpdude · 2020-01-10T23:41:40Z

Nice idea that you can keep the keys in separate secrets and concatenate them this way – makes it waaaay easier if you need to rotate one key only.

webknjaz · 2020-01-10T23:48:27Z

README.md

@@ -36,6 +36,11 @@ jobs:
 ```
 4. If, for some reason, you need to change the location of the SSH agent socket, you can use the `ssh-auth-sock` input to provide a path.

+If you need to use multiple SSH keys (for example because you're using deployment keys which belong to one repository each), you can put all those keys into the secret value one after another.
+This action will add all the keys to the `ssh-agent` one-by-one. `ssh` will then automatically figure out the right keys for each connection.


I feel like this needs some disclaimer that if you add too many keys, ssh-agent will feed all of them to ssh servers in the order they are added. Most servers have a limit of attempts to authenticate with a key. For example, if the server has a limit of 5 keys and the correct one is number 6 in the sequence, ssh client will use 5 first keys and then ssh server will interrupt the auth flow and that right one won't even be tried out.

mpdude · 2020-01-11T00:04:24Z

In fact, there is already some output for each key loaded: https://github.com/webfactory/ssh-agent/pull/14/checks?check_run_id=384036303#step:4:7

webknjaz · 2020-01-11T00:06:56Z

In fact, there is already some output for each key loaded

Ah, ok. Then you could just add ssh-add -l -E md5 after the loop and it'll print out the whole list with hashes. The keys will be in the load order.

mpdude · 2020-01-11T12:27:42Z

@webknjaz weird... I have re-generated the demo keys and now ssh-add fails, although the input seems right.

Do you know if the keys need to be in a particular format?

webknjaz · 2020-01-11T21:36:03Z

Do you know if the keys need to be in a particular format?

Just PEM should be okay. Have you checked that there's no extra garbage added?

Are you talking about https://github.com/webfactory/ssh-agent/pull/14/files#diff-d66f8d1a4662d10fdd69fc1726011da9R15-R16? I'm not sure if you can put comments in the middle of a string literal block in YAML.
I suspect that those comments are getting added to your keys which may also depend on the YAML parser they use in GitHub Actions.

You could remove the comments and see what happens because I suspect you're getting

-----BEGIN ... PRIVATE KEY-----
...
xxx
...
-----END ... PRIVATE KEY-----       # 4096 bit RSA key created with `ssh-keygen -t rsa -b 4096 -o -f ...`
-----BEGIN ... PRIVATE KEY-----
...
yyy
...
-----END ... PRIVATE KEY-----     # ED25519 key created with `ssh-keygen -t ed25519 -a 100 -f ...`

and since you're only splitting the contents by the start string, you may get some unwanted bytes in the end. Consider using both start and end markers.

I've seen similar errors when I tried to integrate this action earlier so maybe something in the envs/VMs has changed over time. Have you checked this command locally with the same keys?

webknjaz · 2020-01-12T15:23:49Z

This https://stackoverflow.com/a/59595773/595220 hints that there should be LF in the end maybe...

webknjaz · 2020-01-12T15:28:18Z

Oh, and sometimes if you copy the key from a terminal you can accidentally copy trailing spaces at the end of each line. Have you checked this assumption?

I mean:

------BEGIN ... PRIVATE KEY-----                                       
-somesecretbytessomesecretbytessomesecretbytes                         
-somesecretbytessomesecretbytessomesecretbytes                         
-somesecretbytessomesecretbytessomesecretbytes                         
-somesecretbytessomesecretbytessomesecretbytes                         
-somesecretbytessomesecretbytessomesecretbytes                         
------END ... PRIVATE KEY-----                                         
+-----BEGIN ... PRIVATE KEY-----
+somesecretbytessomesecretbytessomesecretbytes
+somesecretbytessomesecretbytessomesecretbytes
+somesecretbytessomesecretbytessomesecretbytes
+somesecretbytessomesecretbytessomesecretbytes
+-----END ... PRIVATE KEY-----

bradmartin · 2020-01-13T17:04:40Z

Just wanted to confirm the | for multi line args in the YML file worked as suggested by @webknjaz 👍

As of now looks like all good to go with following output in my action:

***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
***
Keys added:
4096 [REDACTED] (stdin) (RSA)
4096 [REDACTED (stdin) (RSA)
4096 [REDACTED] (stdin) (RSA)

Is there any security issue that could come up with printing the values in the build like it's doing currently ^^^? I've removed them from this message and replaced with [REDACTED] however, they do print the values, just want to be sure that's not exposing anything to someone who might come across a build on a public repo seeing those 🤔

mpdude · 2020-01-13T17:09:30Z

@bradmartin yeah, that’s just debugging output because right now my own keys do no longer work :-(

That will of course be removed before we merge this.

The fingerprints will stay to help you see what’s going on, but they’re not sensitive data.

bradmartin · 2020-01-13T17:12:11Z

Sorry you're running into trouble with that, it's all a PITA to me 😄 . However, thank you for your work on this because I know without this I'd still be struggling to get this sorted... badly 💯

mpdude · 2020-01-13T17:12:18Z

@bradmartin BTW your personal keys would never show up here. They are secrets in your repo and only used when the action runs for you – all the output then stays with you.

The keys/secrets in this repo here are demo keys without access to anything.

webknjaz · 2020-01-13T22:04:10Z

@mpdude @bradmartin I think we all should compare our envs, ssh versions, and commands for generating SSH keys...

$ ssh -V       
OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
$ ssh-keygen -q -N '' -b 4096 -f test-key

Any difference from what you run?

webknjaz · 2020-01-13T22:06:00Z

your personal keys would never show up here

Well, better safe than sorry. GH Actions may have matching bugs like any other software. Plus Actions also may have bugs. You can output a part of the key which may be enough to guess the last char or you may put spaces between bytes and their matcher won't help...

bradmartin · 2020-01-13T22:36:15Z

Yea my environment:

Brads-MBP:~ bradmartin$ ssh -V
OpenSSH_7.9p1, LibreSSL 2.7.3
Brads-MBP:~ bradmartin$ ssh-keygen -q -N '' -b 4096 -f test-key

The keygen command runs with no output there, assuming that's correct for the args supplied to it.

mpdude · 2020-01-13T22:49:31Z

Finally, I believe I have sorted this out: ssh-agent seems to be very picky about leading or trailing newlines. I now strip them, add a trailing newline again and things seem to work.

What I meant above with the key output is not that GH will mask all outputs that are equal to one of the secrets, but rather that a secret stored in @bradmartin's repo would never be used when running an action in one of my repos. This has been designed that way to prevent secrets from leaking accidentally.

webknjaz · 2020-01-14T09:36:58Z

ssh-agent seems to be very picky about leading or trailing newlines

Oh, so my suggestion here #14 (comment) was correct after all :)

webknjaz · 2020-01-14T09:40:26Z

index.js

@@ -17,7 +17,11 @@ try {
    core.exportVariable('SSH_AUTH_SOCK', authSock);

    console.log("Adding private key to agent");
-    child_process.execSync('ssh-add -', { input: core.getInput('ssh-private-key') });
+    core.getInput('ssh-private-key').split(/(?=-----BEGIN)/).forEach(function(key) {


@mpdude why didn't you add an end-marker here? It'd be way more precise than trimming \n this way... People would even be able to put all the keys in one line if they wanted to

…types/node-18.14.1 Bump @types/node from 18.14.0 to 18.14.1

mpdude mentioned this pull request Jan 10, 2020

Need a way to pass array of keys instead of one #7

Closed

webknjaz reviewed Jan 10, 2020

View reviewed changes

mpdude force-pushed the support-multiple-keys branch from f3175fa to 8aa4b4b Compare January 11, 2020 00:02

mpdude force-pushed the support-multiple-keys branch 2 times, most recently from 6fcf3aa to c13b857 Compare January 13, 2020 21:57

mpdude force-pushed the support-multiple-keys branch 2 times, most recently from 479f787 to f58bd3c Compare January 13, 2020 22:45

mpdude force-pushed the support-multiple-keys branch from f58bd3c to 1bcbe13 Compare January 13, 2020 22:51

Support concatenation of multiple private keys in the given secret

1bc48df

mpdude force-pushed the support-multiple-keys branch from 1bcbe13 to 1bc48df Compare January 13, 2020 22:52

mpdude force-pushed the support-multiple-keys branch from 5f52758 to 1bc48df Compare January 13, 2020 22:57

Add a changelog

ebaadc1

mpdude merged commit 6cf6299 into master Jan 14, 2020

mpdude deleted the support-multiple-keys branch January 14, 2020 09:21

webknjaz reviewed Jan 14, 2020

View reviewed changes

cardoe added a commit to cardoe/ssh-agent that referenced this pull request Mar 2, 2023

Merge pull request webfactory#14 from cardoe/dependabot/npm_and_yarn/…

8c2ca22

…types/node-18.14.1 Bump @types/node from 18.14.0 to 18.14.1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support multiple SSH keys #14

Support multiple SSH keys #14

mpdude commented Jan 10, 2020

bradmartin commented Jan 10, 2020

bradmartin commented Jan 10, 2020 •

edited

Loading

bradmartin commented Jan 10, 2020 •

edited

Loading

webknjaz Jan 10, 2020

webknjaz commented Jan 10, 2020 •

edited

Loading

mpdude commented Jan 10, 2020

webknjaz Jan 10, 2020

mpdude commented Jan 11, 2020

webknjaz commented Jan 11, 2020

mpdude commented Jan 11, 2020

webknjaz commented Jan 11, 2020

webknjaz commented Jan 12, 2020

webknjaz commented Jan 12, 2020

bradmartin commented Jan 13, 2020

mpdude commented Jan 13, 2020

bradmartin commented Jan 13, 2020

mpdude commented Jan 13, 2020

webknjaz commented Jan 13, 2020

webknjaz commented Jan 13, 2020

bradmartin commented Jan 13, 2020 •

edited

Loading

mpdude commented Jan 13, 2020

webknjaz commented Jan 14, 2020

webknjaz Jan 14, 2020

Support multiple SSH keys #14

Support multiple SSH keys #14

Conversation

mpdude commented Jan 10, 2020

bradmartin commented Jan 10, 2020

bradmartin commented Jan 10, 2020 • edited Loading

bradmartin commented Jan 10, 2020 • edited Loading

webknjaz Jan 10, 2020

Choose a reason for hiding this comment

webknjaz commented Jan 10, 2020 • edited Loading

mpdude commented Jan 10, 2020

webknjaz Jan 10, 2020

Choose a reason for hiding this comment

mpdude commented Jan 11, 2020

webknjaz commented Jan 11, 2020

mpdude commented Jan 11, 2020

webknjaz commented Jan 11, 2020

webknjaz commented Jan 12, 2020

webknjaz commented Jan 12, 2020

bradmartin commented Jan 13, 2020

mpdude commented Jan 13, 2020

bradmartin commented Jan 13, 2020

mpdude commented Jan 13, 2020

webknjaz commented Jan 13, 2020

webknjaz commented Jan 13, 2020

bradmartin commented Jan 13, 2020 • edited Loading

mpdude commented Jan 13, 2020

webknjaz commented Jan 14, 2020

webknjaz Jan 14, 2020

Choose a reason for hiding this comment

bradmartin commented Jan 10, 2020 •

edited

Loading

bradmartin commented Jan 10, 2020 •

edited

Loading

webknjaz commented Jan 10, 2020 •

edited

Loading

bradmartin commented Jan 13, 2020 •

edited

Loading