Jenkins：使用 Git 检索子模块

Jenkins: Retrieving submodules with Git

提问by ItWillDo

Currently I've been stuck on an issue trying to retrieve the submodules of a repository from within Jenkins. My configuration is fine and I can pull repositories without any submodules just fine.

目前我一直被困在一个问题上，试图从 Jenkins 中检索存储库的子模块。我的配置很好，我可以在没有任何子模块的情况下提取存储库。

I can also pull the main components of a repo with submodules (both with authentication in the repository-name as with SSH). The problem only arises when I have to pull the submodule-components. I'm running the latest version of Jenkins and I've added a part at the bottom which is for "Advanced sub-modules behaviours". I selected "Recursively update submodules" here and ran the build several times to no avail.

我还可以使用子模块提取存储库的主要组件（两者都在存储库名称中进行身份验证，就像使用 SSH 一样）。只有当我必须拉取子模块组件时才会出现问题。我正在运行最新版本的 Jenkins，我在底部添加了一个用于“高级子模块行为”的部分。我在这里选择了“递归更新子模块”并多次运行构建无济于事。

When I try adding an extra build step at the bottom with shell-commands, the updating of the repositories doesn't work either. When I try these commands outside of jenkins in my terminal, this works just fine. The issue I always get in Jenkins is:

当我尝试使用 shell 命令在底部添加额外的构建步骤时，存储库的更新也不起作用。当我在终端中在 jenkins 之外尝试这些命令时，效果很好。我在 Jenkins 中经常遇到的问题是：

FATAL: Command "git submodule update" returned status code 1:

stdout: 

stderr: Cloning into 'thisismysubmodule'...
fatal: Authentication failed for 'https://git.thisismyrepo.com/scm/ap/thisismysubmodule.git/'

I've found this issue: https://issues.jenkins-ci.org/browse/JENKINS-20941but I can't use the suggested solution at the bottom due to security concerns. Does anyone here have any experience with this problem or a possible solution?

我发现了这个问题：https: //issues.jenkins-ci.org/browse/JENKINS-20941但由于安全问题，我无法在底部使用建议的解决方案。这里有没有人对这个问题或可能的解决方案有任何经验？

回答by Benoit Blanchon

Here is a workaround using SSH agent forwarding. It worked fine for me.

这是使用SSH 代理转发的解决方法。它对我来说很好。

1. First, edit <jenkins_home>/.ssh/configand set ForwardAgent yes
2. Then, install SSH Agent pluginfor Jenkins.
3. Then, in project configuration, reset the Git credentials.
4. Finally, in project configuration, set the SSH Agent credential.

1. 首先，编辑<jenkins_home>/.ssh/config并设置ForwardAgent 是
2. 然后，为 Jenkins安装SSH 代理插件。
3. 然后，在项目配置中，重置 Git 凭据。
4. 最后，在项目配置中，设置 SSH 代理凭据。

回答by JamesD

Beta versions of the git-client and git-plug-in modules have been released now to solve this issue. To quote the JIRA issue.

现在已经发布了 git-client 和 git-plug-in 模块的 Beta 版本来解决这个问题。引用 JIRA 问题。

The git client plugin 2.0.0-beta1 has been released to the experimental update center. It includes git submodule authentication, JGit 4.3, and requires JDK 7. It requires at least Jenkins 1.625 (the first version to mandate JDK 7)

git客户端插件2.0.0-beta1已经发布到实验更新中心。它包括 git 子模块认证、JGit 4.3，并且需要 JDK 7。它至少需要 Jenkins 1.625（第一个强制要求 JDK 7 的版本）

Using the above there is an option under the Additional Behaviours section called:

使用上面的“附加行为”部分下有一个选项，称为：

Use credentials from default remote of parent repository

使用来自父存储库默认远程的凭据

This solved my issue when using Jenkins 2.11 and the beta versions of the plug-in running a Windows server and slave. I have not checked other build machines. Also you must use the same authentication method, if using http you must use that for submodules as well, if use SSH you must use this for the submodules, trying to mix methods will not work correctly.

这解决了我在使用 Jenkins 2.11 和运行 Windows 服务器和从站的插件的测试版时的问题。我没有检查其他构建机器。此外，您必须使用相同的身份验证方法，如果使用 http，您也必须将其用于子模块，如果使用 SSH，您必须将其用于子模块，尝试混合方法将无法正常工作。

-- UPDATE --
Beta versions are not required anymore, please see the following pages:
Git Client Plugin
Git Plugin

-- 更新 --
不再需要 Beta 版本，请参阅以下页面：
Git 客户端插件
Git 插件

回答by The Pax Bisonica

I actually just moved it to a shell command and in the shell command I told it which credentials helper to use, since I'm on windows it was wincred:

我实际上只是将它移动到一个 shell 命令，在 shell 命令中我告诉它使用哪个凭据助手，因为我在 Windows 上它是 wincred：

git config --global credential.helper wincred
git submodule init 
git submodule sync 
git submodule update --init --recursive

回答by VonC

One solution would be to declare in the global git config file a netrc credential help, which would provide the necessary credentials for any http query coming from git.

一种解决方案是在全局 git 配置文件中声明 netrc 凭据帮助，它将为来自 git 的任何 http 查询提供必要的凭据。

git config --global credential.helper "netrc -f C:/path/to/_netrc.gpg -v"

(make sure to use the same account as the one used for running Jenkins)

（确保使用与运行 Jenkins 相同的帐户）

I use an encrypted netrc file, but you can start some test with an un-encrypted one.

我使用加密的 netrc 文件，但您可以使用未加密的文件开始一些测试。

回答by ItWillDo

Considering I have tried pretty much all available options to get this working (SSH, .netrc, hardcoded credentials,...) the only option was the one which was mentioned on the bottom of the JENKINS-20941 issue by 'andreg':

考虑到我已经尝试了几乎所有可用的选项（SSH、.netrc、硬编码凭据，...），唯一的选项是“andreg”在 JENKINS-20941 问题底部提到的选项：

Yeah, this issue is a real pain for us too. The only way we could get it working for our Stash/Jenkins setup was to create a read-only user and to hard code this user's credentials in the reference to the submodule. Although bad practise, all users working on the git repo already have at least read-only access, so we didn't feel it was too much of a security concern. e.g. in the parent repo .gitmodules file:

[submodule "shared-library"] path = shared-library url = https://username:[email protected]/scm/project/shared-library.git

and then the Jenkins job has "Recursively update submodules" selected.

是的，这个问题对我们来说也很痛苦。我们让它为我们的 Stash/Jenkins 设置工作的唯一方法是创建一个只读用户并在对子模块的引用中硬编码此用户的凭据。尽管这种做法很糟糕，但所有在 git 存储库上工作的用户都至少拥有只读访问权限，因此我们认为这并没有造成太大的安全问题。例如在父仓库 .gitmodules 文件中：

[子模块“共享库”] 路径 = 共享库 url = https://username:[email protected]/scm/project/shared-library.git

然后 Jenkins 作业选择了“递归更新子模块”。

回答by sdw

This solution worked for me:

这个解决方案对我有用：

1. Make sure ssh credentials are the same for the parent repo and the submodule repo.
2. Setup credentials for the parent repo in Jenkins. (Source Code Management (choose "Git") > Repositories)

3. Setup your .gitmodule file so that it uses the ssh credentials from the parent repo:

   [submodule "foo/repository"]
      path = foo/repository
      url = ssh://[email protected]/repository
   

4. There is a small caveat to this solution. Anytime that someone clones the parent repo, they will need to sync the url to one that they have access to. The first time a user initializes the submodule, they need to first edit the .gitmodules file and change the url:

   [submodule "foo/repository"]
      path = foo/repository
      url = ssh://[email protected]/repository
   

   Then, in the terminal:

   git submodule sync
   git submodule init repository
   git submodule update --remote repository
   

   And then change the url back to the jenkins build url. Unless you sync again, the submodule will use the url associated with the user.

1. 确保父存储库和子模块存储库的 ssh 凭据相同。
2. 在 Jenkins 中为父存储库设置凭据。（源代码管理（选择“Git”）> 存储库）

3. 设置您的 .gitmodule 文件，以便它使用来自父存储库的 ssh 凭据：

   [submodule "foo/repository"]
      path = foo/repository
      url = ssh://[email protected]/repository
   

4. 此解决方案有一个小警告。任何时候有人克隆父存储库，他们都需要将 url 同步到他们有权访问的那个。用户第一次初始化子模块时，需要先编辑 .gitmodules 文件并更改 url：

   [submodule "foo/repository"]
      path = foo/repository
      url = ssh://[email protected]/repository
   

   然后，在终端中：

   git submodule sync
   git submodule init repository
   git submodule update --remote repository
   

   然后将 url 改回 jenkins 构建 url。除非您再次同步，否则子模块将使用与用户关联的 url。

In September 2016, Jenkins is planning to release a new feature that will allow submodules to share the credentials of the parent repository. Then a HTTP url can be used in .gitmodule instead of ssh.

2016 年 9 月，Jenkins 计划发布一项新功能，允许子模块共享父存储库的凭据。然后可以在 .gitmodule 中使用 HTTP url 而不是 ssh。

回答by math0ne

I managed to get this working by simply adding a .netrc file with the credentials on linux. Not the most secure solution but if you need to get it working quickly it will get you going.

我设法通过简单地在 linux 上添加一个带有凭据的 .netrc 文件来使其工作。不是最安全的解决方案，但如果您需要使其快速运行，它将助您一臂之力。

回答by Tim Brown

I just hit this issue. For anyone coming at this with a recent version of Jenkins (post December 2016) try enabling this option in the Advanced sub-modules behaviourssection of your git repo config. Use credentials from default remote of parent repository

我刚碰到这个问题。对于使用最新版本的 Jenkins（2016 年 12 月之后）进行此操作的任何人，请尝试在Advanced sub-modules behaviours您的 git repo 配置部分启用此选项。 Use credentials from default remote of parent repository