[JENKINS-36871] Advertise the instance identity for the TCP Agent details page

core/src/main/java/hudson/TcpSlaveAgentListener.java

@@ -23,6 +23,11 @@
  */
 package hudson;
 
+import java.nio.charset.Charset;
+import java.security.interfaces.RSAPublicKey;
+import java.security.interfaces.RSAPrivateKey;
+import javax.annotation.Nullable;
+import jenkins.model.identity.InstanceIdentityProvider;
 import jenkins.util.SystemProperties;
 import hudson.slaves.OfflineCause;
 import java.io.DataOutputStream;
@@ -44,6 +49,7 @@ import java.net.Socket;
 import java.nio.channels.ServerSocketChannel;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.io.IOUtils;
 
 /**
@@ -103,6 +109,20 @@ public final class TcpSlaveAgentListener extends Thread {
         return CLI_PORT != null ? CLI_PORT : getPort();
     }
 
+    /**
+     * Gets the Base64 encoded public key that forms part of this instance's identity keypair.
+     * @return the Base64 encoded public key
+     * @since FIXME
+     */
+    @Nullable
+    public String getIdentityPublicKey() {
+        InstanceIdentityProvider<RSAPublicKey, RSAPrivateKey> provider =
+                InstanceIdentityProvider.get(RSAPrivateKey.class);
+        RSAPublicKey key = provider == null ? null : provider.getPublicKey();
+        return key == null ? null : new String(Base64.encodeBase64(key.getEncoded()), Charset.forName("UTF-8"));
+    }
+
+
     @Override
     public void run() {
         try {

core/src/main/resources/hudson/TcpSlaveAgentListener/index.jelly

@@ -34,6 +34,8 @@ THE SOFTWARE.
     if the host name is overriden, advertise that as well
   -->
   <st:header name="X-Jenkins-JNLP-Host" value="${app.tcpSlaveAgentListener.CLI_HOST_NAME}" />
+  <!-- publish the instance identity so that agents can verify match from discovery -->
+  <st:header name="X-Instance-Identity" value="${app.tcpSlaveAgentListener.identityPublicKey}" />
 
   Jenkins
 </j:jelly>