SSH, passphrases, keychains, Could not open a connection to your authentication agent

I will be very surprised if anyone has the answer to this. I have googled for a long time but no luck.

As an iOS developer who will shortly be welcoming a new team member I want to set up a continuous integration server so that anyone who checks in code will kick off a build, which will in turn set the status of a build light providing a visual indication of code status. If the build breaks it won't stay that way for long because we'll see a big red light.

The ingredients I picked to make this work are Jenkins, Git and a Mac mini. Day to day I won't have physical access to the mini but the build light is controlled by ethernet - no problem.

The first step in getting Jenkins to manage a build is to clone the git repository. For obvious reasons it discards any old code and grabs a copy of the entire repository. I'm using a git "Repository URL" of [email protected]:repo/ProjectName.git. Naturally I did 'su - jenkins' and become user jenkins, then going through the process of scp id_rsa.pub [email protected]. As gitfella I appended that public key to authorized_hosts.

The surprise came when I went back to being user jenkins and tried ssh [email protected] - I was asked for the passphrase for jenkins. At this stage I realised the repository clone was failing because the passphrase could not be entered while Jenkins was running without an interactive shell.

The way to get the passphrase into the keychain is ssh-add -K (and prior to Lion I don't remember having to do this ever) but this does not work in a ssh shell, it fails with the message Could not open a connection to your authentication agent. Executing ssh-agent shows the environment variables that need to be set to allow this to happen, and once that's done ssh-add -K works. Then the git clone is OK. Then I thought the problem was solved but next ssh login I'm asked for the passphrase again.

I now have the git clone phase of the build working but I would rather not have to remove the passphrase for Jenkins entirely...

How can ssh-agent values be set on every invocations of this Jenkins build process? Jenkins is started by executing launchctl load /Library/LaunchDaemons/org.jenkins-ci.plist - would it be possible to set the ssh-agent environment in here somehow? Would these settings persist as long as Jenkins does (per boot)? I'm reluctant to mess with this now I have this little problem mostly sorted, but maybe some expert knows the right fix.

Solution 1:

The ssh-add -K command add the key to the Apple's Keychain, but there is a SSH specific keychain, unrelated do the Apple's one.

It runs as a deamon and interacts only with SSH.

I don't know if this will help you, but I have strong feeling that it will.

Keychain is available as a homebrew package so if you get nomebrew available at your system to install it just type brew install keychan. After that a man keychain will help a lot.