Support Private GIT Repos #187

Activity

1. TheLunaticScripter

   added

   Design ProposalCommunity survey of a proposalCommunity survey of a proposal

   on Jan 2, 2020
2. TheLunaticScripter commented on Mar 25, 2020

   

   TheLunaticScripter

   on Mar 25, 2020

   Contributor

   More actions

   I did some research and opened an issue for this against habitat and here are the results of what needs to be done to make this work.

   First, you need to be using the Habitat Docker Studio to do the builds. The reason for this is so that you can mount your .ssh folder into the studio. Before launching the studio or running hab pkg build you need to set the HAB_DOCKER_OPTS environment variable. Here is an example of how to do this on Windows and Linux
   windows:

   $env:HAB_DOCKER_OPTS = 'c:/users/<your_username>/.ssh:<full path studio user>/.ssh'
   

   Linux:

   export HAB_DOCKER_OPTS='/home/<your_username>/.ssh:/root/.ssh'
   

   The user for a Linux studio is root and the user for a Windows studio is ContainerAdministrator.

   If you are doing this on windows the file permissions for the ssh key won't work when building a Linux habitat package. To fix this, you will need to mount the .ssh directory to /tmp instead of directly to the /root location and then copy the directory to /root/.ssh. Once that is done you will then need to change the permissions on the id_rsa key as well as the id_ras.pub key so that chef can use it here is a little script to do that

   cp -R /tmp/.ssh /root/.ssh
   chmod 0700 /root/.ssh
   chmod 0644 /root/.ssh/id_rsa.pub
   chmod 0600 /root/.ssh/id_rsa
   

   This should be all the steps needed to get you working with using git in your policyfiles.

   I'm going to leave this open as a Design Proposal as this is not the greatest way to do this and there may be room for improvement.
3. TheLunaticScripter

   added

   DocumentationHow do we use this project?How do we use this project?

   on Mar 25, 2020
4. mbainter commented on Aug 28, 2020

   

   mbainter

   on Aug 28, 2020

   More actions

   FYI - the above description leaves out the required option flag (--volume or -v).
5. mbainter commented on Sep 3, 2020

   

   mbainter

   on Sep 3, 2020

   More actions

   This solution has a few problems:

   1. To work, the key has to be unencrypted on disk.
   2. If you have too many keys in your SSH dir it may not work, as you may hit the attempt limit before it finds the right key

   The best solution here would be to use an external secrets management service like Vault, AWS SecretsManager, Habitat Builder origin secrets, etc. What would be helpful then is if the scaffolding could look for a particular variable (git_private_key) and base64decode its contents and put them in an ssh key file for use by git automatically. This could then be configured using origin secrets or alternately exported into the habitat environment by the user or CI system with something like HAB_STUDIO_SECRET_git_private_key=<keydata> hab pkg build -D ..
6. tas50

   added

   Aspect: DocumentationHow do we use this project?How do we use this project?

   and removed

   DocumentationHow do we use this project?How do we use this project?

   on May 12, 2021