I have added an ssh key to the repository and also call: git remote set-url origin ${BITBUCKET_GIT_SSH_ORIGIN} but get this error in pipeline: git@bitbucket.org : Permission denied (publickey). fatal: Could not read from remote repository. + git pull --tags Warning: Permanently added the RSA host key for IP address '18.205.93.2' to the list of known hosts.

@Ronald C_do you have any additional help for me after my additional debugging information has been shared? I know you've likely been busy but is anyone else available to inspect it?

Originally, I had this repository variable named: GOOGLE_API_KEY_JSON and a value of JSON: { "type": "service_account", "project_id": "some-value-here", "private_key_id": "private-key-id-value", "private_key": "-----BEGIN PRIVATE KEY----- -----END PRIVATE KEY-----\n", "client_email": "email address here", "client_id": "client-id-here", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", "client_x509_cert_url": "cert-url-here" } Note the "private_key" variable in the JSON above. When I would run the pipeline that private_key above is what would get set in the /opt/atlassian/pipelines/agent/ssh/id_rsa file. So knowing this, I then tried to add the private key to my repository SSH Keys, but that still didn't work.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why getting permission denied when repo has SSH key and BITBUCKET_GIT_SSH_ORIGIN is set

Michael Brizic

I have added an ssh key to the repository and also call:

<span>git remote set-url origin ${BITBUCKET_GIT_SSH_ORIGIN}</span>

but get this error in pipeline:

<span><br>Warning: Permanently added the RSA host key for IP address '18.205.93.2' to the list of known hosts.</span><span><a href="mailto:git@bitbucket.org" target="_blank" rel="noopener nofollow noreferrer">git@bitbucket.org</a>: Permission denied (publickey).</span><span>fatal: Could not read from remote repository.</span><span>+ git pull --tags</span>

Accepted answers

All comments

Ronald C.

Hi @Michael Brizic

Would you be able to try running the following commands in your build to check the home directory and also share us the docker image that you're using?

 script:
    - whoami
    - echo $HOME

I'm suspecting that you encounter similar issue here:
https://community.atlassian.com/t5/Bitbucket-Pipelines-questions/Re-Re-Pulling-a-private-repo-from-bitbucket-in-pipelines/qaq-p/1347516/comment-id/2387#M2387

Regards
Ronald

Michael Brizic

Additional debugging reveals the following:

* The pipeline is building and deploying an Android APK

* It uses Triple-T/gradle-play-publisher (from GitHub)

* This requires a Google API key (set as a Repository Variable)

* The Repository Variable is a JSON string that contains a field named 'private_key'

* For whatever reason, even though the pipeline/step does not use this Repository Variable directly, the 'private_key' from this JSON string is set to

/opt/atlassian/pipelines/agent/ssh/id_rsa

* I have tried to take this 'private_key', generate the public key, and then set those as the SSH keys added to my repository and rerun the pipeline/step but I'm still getting a failure

Is there any way to mask a Repository Variable in a given pipeline/step?

What other troubleshooting/debugging steps should I take?

I'm able to modify the pipeline/step to print additional debugging information.

Thanks for responding

Ronald C.

Hi @Michael Brizic

Yes, you can mask the variable's value by checking the Secured checkbox while setting up variable.
Variables in Pipelines - Atlassian Documentation

Are you still getting the SSH permission denied issue which initially mentioned?
What do you observe when you run the following command in your build?

 script:
    - whoami
    - echo $HOME

Would you also share us the docker image that you're using so that we can try reproduce on our end?

Regards,
Ronald

Michael Brizic

whoami = root

$HOME = /root

Image = python:3.8.1

Also, when I asked if there was a way to "mask" a Repository Variable I meant, is there a way to make it not be processed or present for a given pipeline or step?

Again, the Repository Variable in questions is a JSON string which contains a 'private_key' and this is what the image is getting for the value in /opt/atlassian/pipelines/agent/ssh/id_rsa

Even when I take this same private_key, get the public key, and set it in the repository SSH keys (selecting Use My Own) it does not work.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud