Azure-pipelines-tasks: Copy Files over SSH: Update ssh2 to support Ed25519 keys

[tero-dev]

Question, Bug, or Feature?
Type: Feature

Issue Description

Are any efforts being made to update to a newer ssh2 version that fully supports ed25519 keys?
because as of now you cant use them on "Copy Files over SSH" (results in Error: Cannot parse privateKey: Unsupported key format.)

[tero-dev]

Not sure but it seems like other tasks are also affected, such as SSH inline script

[coldacid]

The current version of the task uses a version of ssh2-streams which _does_ include ed25519 support, but it seems to have that support turned off for some reason. As far as I can tell from a bit of code and issue walking is that the task fails at https://github.com/mscdex/ssh2-streams/blob/master/lib/keyParser.js#L749 which means that the EDDSA_SUPPORTED flag is false, indicating that the NodeJS crypto library used by ssh2-streams itself is either broken or doesn't support ed25519 on the agent (based on the test at https://github.com/mscdex/ssh2-streams/blob/8a9d6992595a2251ccb818dca8d0f6001f5f4bff/lib/constants.js#L5 which determines the flag's eventual value).

It's a good chance that this is a bug.

[tero-dev]

The current version of the task uses a version of ssh2-streams which _does_ include ed25519 support, but it seems to have that support turned off for some reason. As far as I can tell from a bit of code and issue walking is that the task fails at https://github.com/mscdex/ssh2-streams/blob/master/lib/keyParser.js#L749 which means that the EDDSA_SUPPORTED flag is false, indicating that the NodeJS crypto library used by ssh2-streams itself is either broken or doesn't support ed25519 on the agent (based on the test at https://github.com/mscdex/ssh2-streams/blob/8a9d6992595a2251ccb818dca8d0f6001f5f4bff/lib/constants.js#L5 which determines the flag's eventual value).

It's a good chance that this is a bug.

Seems like the task is 1 minor version behind (https://github.com/mscdex/ssh2/issues/352#issuecomment-486511390)

[AlexandrKravchuk]

@tero-dev We use Node.js v6 for running this task and ssh2 library for connection and it requires Node.js v12.
This issue requires a big effort to make the usage of ed25519 key based connection possible.
We will discuss with the team, if it's possible to do it now and will let you know in the comment section to this issue. So, please be tuned.

[AlexandrKravchuk]

@tero-dev We use Node.js v6 for running this task and ssh2 library for connection and it requires Node.js v12.
This issue requires a big effort to make the usage of ed25519 key based connection possible.
We will discuss with the team, if it's possible to do it now and will let you know in the comment section to this issue. So, please be tuned.

@leantk could you please check this one out

[leantk]

@damccorm @zachariahcox for comment

[damccorm]

@AlexandrKravchuk I agree this probably isn't worth the investment right now. There's been talk in the past of upgrading our node handler from v6 to a newer node version which would make this more feasible, for the moment I think we should just keep this issue open as a future feature and not act on it. If we do upgrade our node handler then we could do this more easily.

[anatolybolshakov]

Created relation issue for node update - https://github.com/microsoft/azure-pipelines-agent/issues/2967

[github-actions[bot]]

This issue is stale because it has been open for 180 days with no activity. Remove the stale label or comment on the issue otherwise this will be closed in 5 days

[coldacid]

Still waiting for this.

[tero-dev]

Still waiting for this.

Looks like some effort is being made https://github.com/microsoft/azure-pipelines-agent/issues/3042#issuecomment-739942994