"invalid privatekey: [B@xxxxxx" when connecting to Bitbucket Cloud over SSH

[Stuart Longland]

We have a Bamboo Data Centre deployment here that we've been using for some years, successfully, via SSH.  (OpenSSH, not JSSH.)  The server is an Ubuntu Linux virtual machine hosted in Amazon AWS.  Release is 8.1.1 build 80108.

Today, we had to start migrating repositories in Bitbucket over to a new workspace, and as part of that, we're generating new SSH keys for Bamboo to use when fetching these repositories.

We can't use the old key on the workspace because Bitbucket requires unique SSH keys.  (It's probably high time it was rotated anyway.)

I've tried 3 different keypairs so far… generated with the following commands:

• ssh-keygen -f /tmp/keypair -t ed25519  -N '' -C 'Bamboo CI deployment key'
  
• ssh-keygen -f /tmp/keypair-rsa -t rsa  -N '' -C 'Bamboo CI deployment key'
• ssh-keygen -f /tmp/keypair-pem -t ed25519 -m pem -N '' -C 'Bamboo CI deployment key'

I then went to "Shared Credentials" and tried submitting the private keys (the file without the .pub extension).  I for obvious reasons won't reveal its full content, but I can reveal this:

$ grep --line-number ^----- keypair*
keypair:1:-----BEGIN OPENSSH PRIVATE KEY-----
keypair:8:-----END OPENSSH PRIVATE KEY-----
keypair-pem:1:-----BEGIN OPENSSH PRIVATE KEY-----
keypair-pem:8:-----END OPENSSH PRIVATE KEY-----
keypair-rsa:1:-----BEGIN OPENSSH PRIVATE KEY-----
keypair-rsa:39:-----END OPENSSH PRIVATE KEY-----

When I tell Bamboo to use this key, then test access to a repository, I get this:

We couldn't connect to the repository. Here's what we got back:

ssh://git@bitbucket.org/workspace/repository: invalid privatekey: [B@fd422e6

The `[B@xxxxxx` string changes, but appears nowhere in any file I have uploaded.

In the logs, we see a similar story:

2025-03-26 01:12:25,180 INFO [http-nio-8085-exec-8] [RepositoryResource] Testing connection to repository (type: Bitbucket Cloud, location: https://bitbucket.org/workspace/repository)
2025-03-26 01:12:25,192 INFO [http-nio-8085-exec-8] [RepositoryResource] Failed to connect to repository (type: Bitbucket Cloud, location: https://bitbucket.org/workspace/repository, time: 11.68 ms, errors
: [ssh://git@bitbucket.org/workspace/repository: invalid privatekey: [B@2f7ddda])

I note there's a `]` character not seen in the web UI.

I had a look in the backend database, I see the SSH key gets "wrapped" in some sort of proprietary XML schema (in the `credentials` table).  I'm not sure how the integration of OpenSSH is being done (it could be a SSH agent protocol socket or writing out a file), but something is getting mangled here and I can't see where this is happening.

How on earth do we upload a valid key in Bamboo?

(PS: can someone tell whoever wrote the submission form on this site that CTRL-V should put the text where the cursor is positioned and not append it to the end?  It's mighty frustrating pasting some text, then finding that it didn't put it where you intended, but instead jammed it on the end of the document.  I regard this as broken behaviour.)