Merge branch 'feature/ssh-agent' into dev

Author: Andrea Negri

.github/workflows/main.yml

@@ -31,7 +31,7 @@ jobs:
           - ubuntu-20.04
         turbovnc-version:
           - "3.1"
-          - "2.2.7"
+          # - "2.2.7"
         include:
           - os: macos-13
             turbovnc-version: "none"
@@ -42,7 +42,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     permissions:
       attestations: write
-      contents: read
+      contents: write
       id-token: write
 
     # Steps represent a sequence of tasks that will be executed as part of the job
@@ -76,48 +76,72 @@ jobs:
             }
             echo "EXT=.exe" >> "${env:GITHUB_ENV}"
 
-      - name: Define artifact basename
+      # ======================================================================
+      # CI VARIABLES
+      # ======================================================================
+      - name: Define platform
         uses: carlkidcrypto/os-specific-runner@v2.0.0
         env:
           RUNNER_ARCH: ${{ runner.arch }}
         with:
           macos: |
             runner_arch=$(echo "${RUNNER_ARCH}" |  tr '[:upper:]' '[:lower:]')
-            echo "ARTIFACT_BASENAME=RCM-client_${{ matrix.os }}_${runner_arch}" >> "${GITHUB_ENV}"
-          linux: echo "ARTIFACT_BASENAME=RCM-client_${{ matrix.os }}_${RUNNER_ARCH,,}_turbovnc_${{ matrix.turbovnc-version }}" >> "${GITHUB_ENV}"
+            echo "ARTIFACT_PLATFORM=${{ matrix.os }}_${runner_arch}" >> "${GITHUB_ENV}"
+          linux: |
+            echo "ARTIFACT_PLATFORM=${{ matrix.os }}_${RUNNER_ARCH,,}" >> "${GITHUB_ENV}"
           windows: |
             $runner_arch=${env:RUNNER_ARCH}.toLower()
-            echo "ARTIFACT_BASENAME=RCM-client_${{ matrix.os }}_${runner_arch}_turbovnc_${{ matrix.turbovnc-version }}" >> "${env:GITHUB_ENV}"
+            echo "ARTIFACT_PLATFORM=${{ matrix.os }}_${runner_arch}" >> "${env:GITHUB_ENV}"
+
+      - name: Define artifact basename
+        shell: bash
+        run: echo "ARTIFACT_BASENAME=RCM-client--${{ env.ARTIFACT_PLATFORM }}" >> "${GITHUB_ENV}"
+
+      - name: Define artifact version for tag
+        if: ${{ github.event_name == 'push' && contains(github.ref, 'refs/tags/') }}
+        shell: bash
+        run: echo "ARTIFACT_VERSION=${{ github.ref_name }}" >> "${GITHUB_ENV}"
+
+      - name: Define artifact version for normal commit
+        if: ${{ github.event_name != 'push' && !contains(github.ref, 'refs/tags/') }}
+        shell: bash
+        run: echo "ARTIFACT_VERSION=${{ github.sha }}" >> "${GITHUB_ENV}"
 
+      # ======================================================================
       # CACHE
+      # ======================================================================
       - name: (GHO) Cache pyenv
         uses: actions/cache@v4.0.0
         id: cache-pyenv
         with:
           path: .pyenv
-          key: pyenv-${{ env.PYENV_VERSION }}-python-${{ env.PYTHON_VERSION }}-${{ matrix.os }}
+          key: pyenv-${{ env.PYENV_VERSION }}-python-${{ env.PYTHON_VERSION }}-${{ matrix.os }}-${{ hashFiles('scripts/ci/02-install-python.*') }}
 
       - name: (GHO) Cache venv
         uses: actions/cache@v4.0.0
         id: cache-venv
         with:
           path: .venv
-          key: venv-python-${{ env.PYTHON_VERSION }}-${{ hashFiles( format('{0}/rcm/client/requirements.txt', env.RCM_CHECKOUT ) ) }}-paramiko-${{ env.PARAMIKO_PULL }}-${{env.PARAMIKO_COMMIT}}-${{ matrix.os }}
+          key: venv-python-${{ env.PYTHON_VERSION }}-paramiko-${{ env.PARAMIKO_PULL }}-${{env.PARAMIKO_COMMIT}}-${{ matrix.os }}-${{ hashFiles('scripts/ci/03-install-venv.*', '**/requirements.txt') }}
 
       - name: (GHO) Cache turbovnc
         uses: actions/cache@v4.0.0
         id: cache-turbovnc
         with:
           path: ${{ env.RCM_CHECKOUT }}/${{ env.TURBOVNC_EXTERNAL }}
-          key: turbovnc-${{ matrix.turbovnc-version }}-${{ matrix.os }}
+          key: turbovnc-${{ matrix.turbovnc-version }}-${{ matrix.os }}-${{ hashFiles('scripts/ci/04*') }}
 
       - name: (GHO) Cache step
         uses: actions/cache@v4.0.0
         id: cache-step
         with:
-          path: ${{ env.RCM_CHECKOUT }}/${{ env.SMALLSTEP_EXTERNAL }}
+          path: ${{ env.RCM_CHECKOUT }}/${{ env.SMALLSTEP_EXTERNAL }}-${{ hashFiles('scripts/ci/05*') }}
           key: step-${{ matrix.os }}
 
+      # ======================================================================
+      # CI STEPS
+      # ======================================================================
+
       # PYTHON
       - name: Setup pyenv environment
         uses: carlkidcrypto/os-specific-runner@v2.0.0
@@ -171,21 +195,31 @@ jobs:
           linux: . "${RCM_CHECKOUT}/scripts/ci/05-extract-step-linux.sh"
           windows: . "${env:RCM_CHECKOUT}\scripts\ci\05-extract-step.ps1"
 
+      # EXTERNAL PLINK
+      - name: External plink (windows)
+        uses: carlkidcrypto/os-specific-runner@v2.0.0
+        with:
+          windows: . "${env:RCM_CHECKOUT}\scripts\ci\06-download-plink.ps1"
+
+      # ======================================================================
       # PYINSTALLER
+      # ======================================================================
       - name: Build pyinstaller
         uses: carlkidcrypto/os-specific-runner@v2.0.0
         with:
           macos: |
             source .venv/bin/activate
-            pyinstaller "${RCM_CHECKOUT}/rcm/client/rcm_client_qt.spec"
+            pyinstaller "${RCM_CHECKOUT}/rcm/client/rcm_client_qt.spec" -- ${{ env.ARTIFACT_VERSION }} ${{ env.ARTIFACT_PLATFORM }}
           linux: |
             source .venv/bin/activate
-            pyinstaller "${RCM_CHECKOUT}/rcm/client/rcm_client_qt.spec"
+            pyinstaller "${RCM_CHECKOUT}/rcm/client/rcm_client_qt.spec" -- ${{ env.ARTIFACT_VERSION }} ${{ env.ARTIFACT_PLATFORM }}
           windows: |
             .venv\Scripts\Activate.ps1
-            pyinstaller "${env:RCM_CHECKOUT}\rcm\client\rcm_client_qt.spec"
+            pyinstaller "${env:RCM_CHECKOUT}\rcm\client\rcm_client_qt.spec" -- ${{ env.ARTIFACT_VERSION }} ${{ env.ARTIFACT_PLATFORM }}
 
-      # ARTIFACT
+      # ======================================================================
+      # ARTIFACTS AND RELESES
+      # ======================================================================
       - name: (GHO) Move preartifacts
         shell: bash
         run: |
@@ -194,42 +228,55 @@ jobs:
           find dist -type f -name "RCM${{ env.EXT }}" -exec cp '{}' . \;
           find dist -type f -name "RCM.zip" -exec cp '{}' . \;
 
-      - name: (Attestation) Attest RCM executable
-        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
-        with:
-          subject-path: RCM${{ env.EXT }}
-          subject-name: ${{ env.ARTIFACT_BASENAME }}
-
-      - name: (Attestation) Attest RCM zip
-        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+      # TAG RELEASE
+      - name: (GHO)(TAG) Upload exe to release
+        if: ${{ github.event_name == 'push' && contains(github.ref, 'refs/tags/') }}
+        uses: svenstaro/upload-release-action@v2
         with:
-          subject-path: RCM.zip
-          subject-name: ${{ env.ARTIFACT_BASENAME }}-dir
+          file: RCM${{ env.EXT }}
+          asset_name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}${{ env.EXT }}
+          prerelease: true
+          overwrite: true
+          tag: ${{ github.ref }}
 
       - name: (GHO)(TAG) Upload exe to release
         if: ${{ github.event_name == 'push' && contains(github.ref, 'refs/tags/') }}
         uses: svenstaro/upload-release-action@v2
         with:
-          file: RCM${{ env.EXT }}
-          asset_name: ${{ env.ARTIFACT_BASENAME }}${{ env.EXT }}
+          file: RCM.zip
+          asset_name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}.zip
           prerelease: true
           overwrite: true
           tag: ${{ github.ref }}
 
+      # CI ARTIFACT
       - name: (GHO) Upload artifact exe
         if: ${{ github.event_name != 'push' && !contains(github.ref, 'refs/tags/') }}
         uses: actions/upload-artifact@v4.3.1
         with:
-          name: ${{ env.ARTIFACT_BASENAME }}
+          name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}
           path: RCM${{ env.EXT }}
 
       - name: (GHO) Upload artifact dir
         if: ${{ github.event_name != 'push' && !contains(github.ref, 'refs/tags/') }}
         uses: actions/upload-artifact@v4.3.1
         with:
-          name: ${{ env.ARTIFACT_BASENAME }}-dir
+          name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}-dir
           path: RCM.zip
 
+      # ATTESTATION
+      - name: (Attestation) Attest RCM executable
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: RCM${{ env.EXT }}
+          subject-name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}
+
+      - name: (Attestation) Attest RCM zip
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: RCM.zip
+          subject-name: ${{ env.ARTIFACT_BASENAME }}--${{ env.ARTIFACT_VERSION }}-dir
+
       - name: (Attestation) Verify RCM executable and zip
         shell: bash
         env:

CHANGELOG.md

@@ -17,6 +17,9 @@
 * :herb:`[dep]`: Update *paramiko* to `3.4` (patch required to work with *step*).
 * :herb:`[dep]`: Update *TurboVNC* to `3.x` (Windows executable is changed, patch to *Java* required to work with old RCM servers).
 * :herb:`[dep]`: Add *step* executables in the bundle.
+* :herb:`[dep]`: Add *plink* executables in the bundle (Windows only).
 * :beetle:`[bug]`: Fix `subprocess` call on windows (pop up *cmd* terminal).
+* :beetle:`[bug]`: Patch `paramiko` connection, when `ssh-agent` is disabled.
+* :beetle:`[bug]`: Force `external` tunnelling with OpenSSH, when `ssh-agent` is disabled.
 * :window:`[gui]`: Add **RCM** logo in the GUI.
 * :package:`[release]`: Add GitHub *attestations*.

rcm/client/external/.gitignore

@@ -1,2 +1 @@
-turbovnc
-step
+*

rcm/client/logic/manager.py

@@ -2,7 +2,7 @@
 #
 # Copyright (c) 2014-2019 CINECA.
 #
-# This file is part of RCM (Remote Connection Manager) 
+# This file is part of RCM (Remote Connection Manager)
 # (see http://www.hpc.cineca.it/software/rcm).
 #
 # This program is free software: you can redistribute it and/or modify
@@ -72,6 +72,9 @@ def __init__(self):
                                                         'preload_command',
                                                         fallback=defaults['preload_command']))
 
+        # Check if ssh agent is active
+        self.allow_agent = False if paramiko.agent.get_agent_connection() is None else True
+
     def login_setup(self, host, user, password=None, preload=''):
         self.proxynode = host
         self.preload = preload
@@ -114,7 +117,8 @@ def prex(self, cmd):
         ssh = paramiko.SSHClient()
         ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
         try:
-            ssh.connect(host, username=self.user, password=self.password, timeout=10)
+            ssh.connect(host, username=self.user, password=self.password, timeout=10,
+                        allow_agent=self.allow_agent)
             self.auth_method = ssh.get_transport().auth_handler.auth_method
             stdin, stdout, stderr = ssh.exec_command(fullcommand)
             out = ''.join(stdout)
@@ -237,7 +241,13 @@ def submit(self, session=None, otp='', gui_cmd=None, configFile=None):
             tunnelling_method = json.loads(parser.get('Settings', 'ssh_client'))
         except Exception:
             tunnelling_method = "internal"
-        logic_logger.info("Using " + str(tunnelling_method) + " ssh tunnelling")
+
+        extra_info = ""
+        if not self.allow_agent and not self.password:
+            tunnelling_method = "external"
+            extra_info = " (forced because ssh-agent is not active)"
+
+        logic_logger.info("Using " + str(tunnelling_method) + " ssh tunnelling" + extra_info)
 
         plugin_exe = plugin.TurboVNCExecutable()
         plugin_exe.build(session=session, local_portnumber=local_port_number)
@@ -252,7 +262,8 @@ def submit(self, session=None, otp='', gui_cmd=None, configFile=None):
                                   local_port_number,
                                   compute_node,
                                   port_number,
-                                  tunnelling_method)
+                                  tunnelling_method,
+                                  self.allow_agent)
 
         self.session_threads.append(st)
         st.start()