[JENKINS-69264] [ssh-agent] Use SSH Host Key verification strategies from git-client-plugin

[jenkins-infra-bot]

https://plugins.jenkins.io/git-client/#plugin-content-ssh-host-key-verification is incredibly useful in pipelines.

The ssh-agent-plugin doesn't take advantage of it however. It would be great if it could. That would reduce the need to inject ~/.ssh/known_hosts for Git operations within sshagent pipeline steps.

---

Originally reported by paybas, imported from: [ssh-agent] Use SSH Host Key verification strategies from git-client-plugin

• status: Open
• priority: Minor
• component(s): ssh-agent-plugin
• resolution: Unresolved
• votes: 0
• watchers: 2
• imported: 20260604-211335

Raw content of original issue

https://plugins.jenkins.io/git-client/#plugin-content-ssh-host-key-verification is incredibly useful in pipelines.

The ssh-agent-plugin doesn't take advantage of it however. It would be great if it could. That would reduce the need to inject ~/.ssh/known_hosts for Git operations within sshagent pipeline steps.

[jenkins-infra-bot]

kon:

• Original comment link
• Raw content of original comment:

  Many classes and methods in the org.jenkinsci.plugins.gitclient.verifier package (source, javadoc) reference "CliGit" or "JGit", but they don't seem to actually depend on Git. Rather, AbstractCliGitHostKeyVerifier provides command-line options for the "ssh" executable, and AbstractJGitHostKeyVerifier implements com.trilead.ssh2.ServerHostKeyVerifier.
  
  AFAICT, ssh-agent-plugin runs "ssh-add" and "ssh-agent" on the Jenkins agent, but it does not run "ssh" and does not use the trilead API (except in a test). If ssh-agent-plugin depended on git-client-plugin (which feels somewhat undesirable) and queried the SshHostKeyVerificationStrategy, it is not clear to me how ssh-agent-plugin should then use the information available from there. Perhaps the "sshagent" step could collect the "ssh" command-line options from AbstractCliGitHostKeyVerifier and place them in an environment variable that the pipeline could then reference in "ssh" commands.
  

Many classes and methods in the org.jenkinsci.plugins.gitclient.verifier package (source, javadoc) reference "CliGit" or "JGit", but they don't seem to actually depend on Git. Rather, AbstractCliGitHostKeyVerifier provides command-line options for the "ssh" executable, and AbstractJGitHostKeyVerifier implements com.trilead.ssh2.ServerHostKeyVerifier.

AFAICT, ssh-agent-plugin runs "ssh-add" and "ssh-agent" on the Jenkins agent, but it does not run "ssh" and does not use the trilead API (except in a test). If ssh-agent-plugin depended on git-client-plugin (which feels somewhat undesirable) and queried the SshHostKeyVerificationStrategy, it is not clear to me how ssh-agent-plugin should then use the information available from there. Perhaps the "sshagent" step could collect the "ssh" command-line options from AbstractCliGitHostKeyVerifier and place them in an environment variable that the pipeline could then reference in "ssh" commands.

[jenkins-infra-bot]

paybas:

• Original comment link
• Raw content of original comment:

  kon indeed all valid points. Will have to think on this.
  

kon indeed all valid points. Will have to think on this.

[jenkins-infra-bot]

[Original relates_to from Jira: JENKINS-66601]