Jenkins：Git 克隆失败，找不到匹配的密钥交换方法

Question

我正在使用 Jenkins 版本 - 2.332.1 ，并且 jenkins gerrit 存储库 ssh 克隆有问题。详细信息如下，

Jenkins Git plugin Version 4.10.3 

构建服务器环境：-

$ ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f  31 Mar 2020

$ git --version
git version 2.33.1

Jenkins 构建控制台日志：-

11:35:13  > git config remote.origin.url ssh://[email protected]:29418/ndk/linux/kernal-image # timeout=10
11:35:13 Fetching upstream changes from ssh://[email protected]:29418/ndk/linux/kernal-image
11:35:13  > git --version # timeout=10
11:35:13  > git --version # 'git version 2.33.1'
11:35:13  > git fetch --tags --force --progress -- ssh://[email protected]:29418/ndk/linux/kernal-image +refs/heads/*:refs/remotes/origin/* # timeout=10
11:35:13 ERROR: Error fetching remote repo 'origin'
11:35:13 hudson.plugins.git.GitException: Failed to fetch from ssh://[email protected]:29418/ndk/linux/kernal-image
11:35:13    at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1001)
11:35:13    at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1242)
11:35:13    at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1302)
11:35:13    at hudson.scm.SCM.checkout(SCM.java:540)
11:35:13    at hudson.model.AbstractProject.checkout(AbstractProject.java:1215)
11:35:13    at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:645)
11:35:13    at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)
11:35:13    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:517)
11:35:13    at hudson.model.Run.execute(Run.java:1896)
11:35:13    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
11:35:13    at hudson.model.ResourceController.execute(ResourceController.java:101)
11:35:13    at hudson.model.Executor.run(Executor.java:442)
11:35:13 Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --force --progress -- ssh://[email protected]:29418/ndk/linux/kernal-image +refs/heads/*:refs/remotes/origin/*" returned status code 128:
11:35:13 stdout: 
11:35:13 stderr: Unable to negotiate with 165.55.66.77 port 29418: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
11:35:13 fatal: Could not read from remote repository.
11:35:13 
11:35:13 Please make sure you have the correct access rights
11:35:13 and the repository exists.
11:35:13 
11:35:13    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2671)
11:35:13    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2096)
11:35:13    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$500(CliGitAPIImpl.java:84)
11:35:13    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:618)
11:35:13    at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:999)
11:35:13    ... 11 more
11:35:13 ERROR: Error fetching remote repo 'origin'
11:35:13 Finished: FAILURE

在终端上 ssh 连接到 gerrit 有效，结果如下，

$ ssh -p 29418 [email protected]

  ****    Welcome to Gerrit Code Review    ****

  Hi ProUser ., you have successfully connected over SSH.

  Unfortunately, interactive shells are disabled.
  To clone a hosted Git repository, use:

  git clone ssh://[email protected]:29418/REPOSITORY_NAME.git

用 jenkins 解决问题。请帮助我找到可能的解决方法。

Answer 1

在运行 Jenkins 控制器的服务器上（假设它与您手动测试 ssh 连接的服务器相同），添加到 .bashrc

export GIT_SSH_COMMAND='ssh -Tv'

这将允许准确查看运行的 SSH 命令以及它在哪里寻找 SSH 密钥一对。

为此，您需要仔细检查 Jenkins 控制器正在运行的帐户（root，或您自己用于手动测试的相同用户帐户）

，而且问题还在于默认使用的端口不是 29418，但是 22。

为了确保您使用正确的端口（再次假设 Jenkins 使用与您正在使用的用户帐户相同的用户帐户运行）：

• 将 Gerrit 服务器 URL 替换为

  gerrit:REPOSITORY_NAME.git
  

• 添加 ~/.ssh/config 文件：

Host gerrit
  Hostname 165.55.66.77
  User prj-user
  Port 29418
  IdentityFile ~/.ssh/TheRightPrivateKey
  KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group1-sha1

这样，您就可以确定 SSH URL/命令是正确的，使用正确的端口/密钥/用户/主机名。