[JENKINS-28399] Add binding for SSH private keys

pom.xml

@@ -106,6 +106,11 @@
       <version>2.4</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.jenkins-ci.plugins</groupId>
+      <artifactId>ssh-credentials</artifactId>
+      <version>1.11</version>
+    </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins.workflow</groupId>
       <artifactId>workflow-cps</artifactId>

src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding.java

@@ -0,0 +1,134 @@
+/*
+ * The MIT License
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.jenkinsci.plugins.credentialsbinding.impl;
+
+import com.cloudbees.jenkins.plugins.sshcredentials.SSHUserPrivateKey;
+import com.google.common.collect.ImmutableSet;
+import hudson.Extension;
+import hudson.FilePath;
+import hudson.Launcher;
+import hudson.model.Run;
+import hudson.model.TaskListener;
+import hudson.util.Secret;
+import org.jenkinsci.Symbol;
+import org.jenkinsci.plugins.credentialsbinding.BindingDescriptor;
+import org.jenkinsci.plugins.credentialsbinding.MultiBinding;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.DataBoundSetter;
+
+import javax.annotation.CheckForNull;
+import javax.annotation.Nonnull;
+import java.io.IOException;
+import java.util.*;
+
+public class SSHUserPrivateKeyBinding extends MultiBinding<SSHUserPrivateKey> {
+
+    public final String keyFileVariable;
+    public String usernameVariable;
+    public String passphraseVariable;
+
+    @DataBoundConstructor public SSHUserPrivateKeyBinding(@Nonnull String keyFileVariable, String credentialsId) {
+        super(credentialsId);
+        this.keyFileVariable = keyFileVariable;
+    }
+
+    @DataBoundSetter
+    public void setUsernameVariable(@Nonnull final String usernameVariable) {
+        this.usernameVariable = usernameVariable;
+    }
+
+    @CheckForNull
+    public String getUsernameVariable() {
+        return usernameVariable;
+    }
+
+    @DataBoundSetter
+    public void setPassphraseVariable(@Nonnull final String passphraseVariable) {
+        this.passphraseVariable = passphraseVariable;
+    }
+
+    @CheckForNull
+    public String getPassphraseVariable() {
+        return passphraseVariable;
+    }
+
+    @Override protected Class<SSHUserPrivateKey> type() {
+        return SSHUserPrivateKey.class;
+    }
+
+    @Override public Set<String> variables() {
+        Set<String> set = new HashSet<>();
+        set.add(keyFileVariable);
+        if (usernameVariable != null) {
+            set.add(usernameVariable);
+        }
+        if (passphraseVariable != null) {
+            set.add(passphraseVariable);
+        }
+        return ImmutableSet.copyOf(set);
+    }
+
+    @Override public MultiEnvironment bind(Run<?,?> build, FilePath workspace, Launcher launcher, TaskListener listener) throws IOException, InterruptedException {
+        SSHUserPrivateKey sshKey = getCredentials(build);
+        UnbindableDir keyDir = UnbindableDir.create(workspace);
+        FilePath keyFile =  keyDir.getDirPath().child("ssh-key-" + keyFileVariable);
+
+        StringBuilder contents = new StringBuilder();
+        for (String key : sshKey.getPrivateKeys()) {
+            contents.append(key);
+            contents.append('\n');
+        }
+        keyFile.write(contents.toString(), "UTF-8");
+        keyFile.chmod(0400);
+
+        Map<String, String> map = new HashMap<String, String>();
+        map.put(keyFileVariable, keyFile.getRemote());
+        if (passphraseVariable != null) {
+            Secret passphrase = sshKey.getPassphrase();
+            if (passphrase != null) {
+                map.put(passphraseVariable, passphrase.getPlainText());
+            } else {
+                map.put(passphraseVariable, "");
+            }
+        }
+        if (usernameVariable != null) {
+            map.put(usernameVariable, sshKey.getUsername());
+        }
+
+        return new MultiEnvironment(map, keyDir.getUnbinder());
+    }
+
+    @Symbol("sshUserPrivateKey")
+    @Extension public static class DescriptorImpl extends BindingDescriptor<SSHUserPrivateKey> {
+
+        @Override protected Class<SSHUserPrivateKey> type() {
+            return SSHUserPrivateKey.class;
+        }
+
+        @Override public String getDisplayName() {
+            return Messages.SSHUserPrivateKeyBinding_ssh_user_private_key();
+        }
+
+    }
+
+}

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/Messages.properties

@@ -1,10 +1,11 @@
 FileBinding.secret_file=Secret file
 SecretBuildWrapper.use_secret_text_s_or_file_s_=Use secret text(s) or file(s)
+SSHUserPrivateKeyBinding.ssh_user_private_key=SSH User Private Key
 StringBinding.secret_text=Secret text
 UsernamePasswordBinding.username_and_password=Username and password (conjoined)
 UsernamePasswordMultiBinding.username_and_password=Username and password (separated)
 ZipFileBinding.secret_zip_file=Secret ZIP file
 ZipFileBinding.NoSuchCredentials=No such credentials
 ZipFileBinding.NotZipFile=Not a ZIP file
 ZipFileBinding.CouldNotVerifyFileFormat=Could not verify file format
-CertificateMultiBinding.certificate_keystore=Certificate
+CertificateMultiBinding.certificate_keystore=Certificate

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding/config-variables.jelly

@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+
+Copyright 2013 jglick.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form" xmlns:st="jelly:stapler" xmlns:c="/lib/credentials">
+    <f:entry title="${%Key File Variable}" field="keyFileVariable">
+        <f:textbox/>
+    </f:entry>
+    <f:entry title="${%Passphrase Variable}" field="passphraseVariable">
+        <f:textbox/>
+    </f:entry>
+    <f:entry title="${%Username Variable}" field="usernameVariable">
+        <f:textbox/>
+    </f:entry>
+</j:jelly>

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding/help-keyFileVariable.html

@@ -0,0 +1,3 @@
+<div>
+    Name of an environment variable to be set to the temporary path of the SSH key file during the build.
+</div>

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding/help-passphraseVariable.html

@@ -0,0 +1,3 @@
+<div>
+    Name of an environment variable to be set to the password during the build. (optional)
+</div>

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding/help-usernameVariable.html

@@ -0,0 +1,3 @@
+<div>
+    Name of an environment variable to be set to the username during the build. (optional)
+</div>

src/main/resources/org/jenkinsci/plugins/credentialsbinding/impl/SSHUserPrivateKeyBinding/help.html

@@ -0,0 +1,9 @@
+<div>
+    Copies the SSH key file given in the credentials to a temporary location, then sets a variable to that location.
+    (The file is deleted when the build completes.) Also optionally sets variables for the SSH key's username and passphrase.
+</div>
+<div>
+    <strong>Warning</strong>: if the master or slave node has multiple executors,
+    any other build running concurrently on the same node will be able to read
+    the contents of this file.
+</div>