Jenkins使用Maven Release（无SSH/Git）连接GitLab遇密钥验证错误求助

原本在隔离Docker镜像中，通过Jenkins结合Maven Release插件、sshagent及系统Git客户端，使用SSH私钥向私有GitLab提交版本标签，运行正常。运维团队将Jenkins切换为jenkins:jenkins用户后，因Maven Docker镜像无该用户，出现「No user exists for uid 332」错误。

改为使用maven-scm-provider-jgit（不依赖系统Git），已在pom.xml配置相关插件及依赖，settings.xml配置GitLab服务器及私钥变量，修改Jenkins脚本如下：

withDockerContainer(image: 'maven:3.6.3-openjdk-8-slim') {
    withCredentials([sshUserPrivateKey(credentialsId: "${GITLAB_CREDS}", keyFileVariable: 'keyFile')]) {
        configFileProvider([configFile(fileId: 'maven-nexus-settings', variable: 'MAVEN_SETTINGS')]) {
             sh "mvn -B -s ${MAVEN_SETTINGS} clean release:prepare release:perform -Dssh.privateKey=${keyFile} -q"
        }
    }
}

执行时出现以下错误：

mvn -B -s /var/lib/jenkins/workspace/jenkins-test@tmp/config6359189442870799267tmp clean release:prepare release:perform -Dssh.privateKey=**** -q
The authenticity of host 'gitlab.host.com' cannot be established.: The EC key's fingerprints are:: MD5:7b:b2:aa:81:25:b9:88:6f:62:4c:13:d4:87:f9:c5:b5: SHA256:PYlJZompVha0FYBp5bTVR56HdGw3ZtfFkVhWol1OLgw: Accept and store this key, and continue connecting? (yes/no): [ERROR] Failed to execute goal org.apache.maven.plugins:maven-release-plugin:3.0.0:prepare (default-cli) on project jenkins-test: An error is occurred in the checkin process: Exception while executing SCM command. JGit checkin failure! git@gitlab.host.com:dev-team/jenkins-test.git: DefaultAuthFuture[ssh-connection]: Failed (IllegalStateException) to execute: Cannot prompt user: Failed to read user response: EOF -> [Help 1]

1. 提前在Docker容器中添加GitLab主机密钥 #

非交互式环境下JGit无法弹出确认提示，需预先将GitLab的主机公钥加入容器的known_hosts文件。修改Jenkins脚本添加对应步骤：

withDockerContainer(image: 'maven:3.6.3-openjdk-8-slim') {
    withCredentials([sshUserPrivateKey(credentialsId: "${GITLAB_CREDS}", keyFileVariable: 'keyFile')]) {
        configFileProvider([configFile(fileId: 'maven-nexus-settings', variable: 'MAVEN_SETTINGS')]) {
             // 提前生成并添加GitLab主机密钥到known_hosts
             sh "mkdir -p ~/.ssh && ssh-keyscan gitlab.host.com >> ~/.ssh/known_hosts"
             sh "mvn -B -s ${MAVEN_SETTINGS} clean release:prepare release:perform -Dssh.privateKey=${keyFile} -q"
        }
    }
}

如果slim版镜像没有ssh-keyscan工具，可换成非slim的maven:3.6.3-openjdk-8镜像，或者手动复制GitLab主机公钥内容写入~/.ssh/known_hosts。

2. 配置JGit跳过主机密钥验证（仅测试环境用） #

在Maven命令中添加参数禁用主机密钥检查，适合快速验证：

mvn -B -s ${MAVEN_SETTINGS} clean release:prepare release:perform -Dssh.privateKey=${keyFile} -DsshStrictHostKeyChecking=no -q

也可以在settings.xml的servers节点中配置：

<server>
  <id>gitlab.host.com</id>
  <configuration>
    <strictHostKeyChecking>no</strictHostKeyChecking>
  </configuration>
</server>

3. 解决Docker镜像用户UID不匹配问题（回归系统Git方案） #

如果不想切换到JGit，可解决最初的UID不匹配错误：启动容器时创建对应UID的用户，或修改容器内用户UID。修改Jenkins脚本如下：

withDockerContainer(image: 'maven:3.6.3-openjdk-8-slim', args: '-u root') {
    withCredentials([sshUserPrivateKey(credentialsId: "${GITLAB_CREDS}", keyFileVariable: 'keyFile')]) {
        configFileProvider([configFile(fileId: 'maven-nexus-settings', variable: 'MAVEN_SETTINGS')]) {
             // 创建jenkins用户（uid332）并调整目录权限
             sh "useradd -u 332 jenkins && chown -R jenkins:jenkins ."
             // 切换用户执行Maven命令
             sh "su jenkins -c 'mvn -B -s ${MAVEN_SETTINGS} clean release:prepare release:perform -q'"
        }
    }
}

若要继续使用sshagent，需确保容器内安装Git客户端，可添加步骤：apt-get update && apt-get install -y git。

内容的提问来源于stack exchange，提问作者Neo