Impossible to clone using an SSH key

[ghost]

I initially read this issue about supporting ssh keys (and added a comment on it).

The proposed solution is to add the ssh key to your secret keys, and then in your pipeline do so:

- mkdir /root/.ssh && echo "$SSH_KEY" > /root/.ssh/id_rsa && chomd 0600 /root/.ssh/id_rsa

This doesn't work for me. After investigating, here is what I tried:

I tried to output the key to check that it exists and was read right, this works

Then I tried to add a public key, using the same command, and here's where it gets weird: the public key never appears. I created a secret called ssh_key_pub, same way as I created my ssh_key secret.

Then I did

- echo "$SSH_KEY_PUB" > /root/.ssh/id_rsa.pub
- cat /root/.ssh/id_rsa.pub`

And if I use cat to check the file, it is empty, whereas this worked for the private key.

So first question: Why would the exact same method work for one secret and not the other? Note that I added the secrets in the web UI, as I can't find any documentation for the drone secret command that actually works.

Then, I tried just pasting the public key in my pipeline, and then it worked, I could see both keys correctly in the right files using cat, but git still refuses to pull:

npm ERR! Permission denied (publickey).
23s
32
npm ERR! fatal: Could not read from remote repository.
23s
33
npm ERR!
23s
34
npm ERR! Please make sure you have the correct access rights
23s
35
npm ERR! and the repository exists.
23s
36
npm ERR!
23s
37
npm ERR! exited with error code: 128

So I have no idea how I am actually supposed to get drone to actually properly use a set of SSH keys, because whatever I do, it never works.

[bradrydzewski]

It is very much possible to clone a repository using git+ssh. If you look at the build configuration for the official drone project you will see we use this exact feature without issue:
https://github.com/drone/drone/blob/782688872970bc7dea53f167ce4181458892369e/.drone.sh#L9:L17

Alternatively, you can use git+https instead of using ssh keys. Drone creates a netrc file with credentials that git will use to automatically authenticate http requests.

-[email protected]:npm/npm.git
+git+https://github.com/npm/npm.git

If you do not want to change your package.json file you can easily instruct git to globally override and replace git+ssh urls with git+https urls. You can use the below command as documented in this StackOverflow discussion.

git config --global url.https://github.com/.insteadOf [email protected]:

Per our issue template, please use our support channel for questions and support requests prior to creating github issues. Thanks