failed to authenticate SSH session #4488

stacyharper · 2024-09-17T07:52:53Z

Description

I'm not sure what I did wrong here. But I also encountered this on another machine. So maybe something is wrong?

The repo here is hosted on git.sr.ht. Also, I note that I am not asked for my ssh passphrase, while ssh -F /dev/null [email protected] does.

Remotes are:

$ git remote -v
origin	[email protected]:~stacyharper/dotfiles (fetch)
origin	[email protected]:~stacyharper/dotfiles (push)
$ jj git remote list
origin [email protected]:~stacyharper/dotfiles

Steps to Reproduce the Problem

Just push

Expected Behavior

It pushs correctly

Actual Behavior

It fails with this error

$ jj git push
Branch changes to push to origin:
  Move forward branch master from 81814485b3b3 to e8ba7c520132
Error: failed to authenticate SSH session: Unable to extract public key from private key file: Wrong passphrase or invalid/unrecognized private key file format; class=Ssh (23)
Hint: Jujutsu uses libssh2, which doesn't respect ~/.ssh/config. Does `ssh -F /dev/null` to the host work?

Specifications

Platform: alpine linux
Version: 0.21.0

Complementary

I can git push, a vanilla way:

$ jj
@  zzqxtwpu [email protected] 2024-09-17 09:46:56 e601c582
│  (empty) (no description set)
○  klzwoxvq [email protected] 2024-09-17 09:46:39 master* HEAD@git e8ba7c52
│  bin: new diffd to diff edit directories
◆  ltowlwsu [email protected] 2024-09-13 15:39:29 master@origin 81814485
│  Less spam please
~
$ git log origin/master^..HEAD
e8ba7c52 bin: new diffd to diff edit directories Willow Barraco (HEAD, master) 2024-09-17 09:46
81814485 Less spam please Willow Barraco (origin/master, origin/HEAD) 2024-09-13 15:39
$ git push origin master 
Enter passphrase for key '/home/stacy/.ssh/id_rsa': 
Enumerating objects: 12, done.
Counting objects: 100% (12/12), done.
Delta compression using up to 12 threads
Compressing objects: 100% (6/6), done.
Writing objects: 100% (7/7), 1.67 KiB | 1.67 MiB/s, done.
Total 7 (delta 4), reused 3 (delta 0), pack-reused 0 (from 0)
To git.sr.ht:~stacyharper/dotfiles
   81814485..e8ba7c52  master -> master

The text was updated successfully, but these errors were encountered:

essiene · 2024-09-17T21:19:49Z

$ git push origin master
Enter passphrase for key '/home/stacy/.ssh/id_rsa':

Looking at the log of the successfull git push, it looks like the SSH key is an rsa ssh key.

The last time I ran into something like this, that turned out to be the problem and the error message and hint were both wrong.

Would it be possible for you to try out an ed25519 key, just to rule that out? They can be created with $ ssh-keygen -t ed25519.

if that doesn't work, I'll see if I can try to repro this locally.

essiene · 2024-09-17T21:34:56Z

Hmmmm, I found a similar problem with cargo-generate[1]. It seems the problem is because the private key file was passwd protected. Maybe you could try with a non-passwd protected file or use ssh-agent[2]. jj can work with keys loaded into the agent.

If that turns out to be the problem, we can probably add another hint.

[1] - cargo-generate/cargo-generate#470
[2] - https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#adding-your-ssh-key-to-the-ssh-agent

stacyharper · 2024-09-18T06:47:07Z

The fetch works after the initial unlock from vanilla git:

$ jj git fetch
Error: failed to authenticate SSH session: Unable to extract public key from private key file: Wrong passphrase or invalid/unrecognized private key file format; class=Ssh (23)
Hint: Jujutsu uses libssh2, which doesn't respect ~/.ssh/config. Does `ssh -F /dev/null` to the host work?
$ git fetch 
Enter passphrase for key '/home/stacy/.ssh/id_rsa': 
$ jj git fetch
Nothing changed.

So I guess the problem come with the passphrase.

essiene · 2024-09-18T13:38:29Z

As a workaround you can use either use password less ssh certs or use ssh-add to add the keys to ssh-agent, then jj will work well with keys in the agent.

For a workaround, I guess we could add a hint about passwd protected private key files as well.

For long term fix, we should probably optionally collect and pass in the passphrase, but I don't know a good way to detect if an ssh private key file is passwd protected, so this can be a pain.

@martinvonz @yuja may have ideas for a long term fix.

yuja · 2024-09-19T11:01:21Z

#3191 might help if ssh command tries hard to obtain tty.

Reasoning: `jj` fails to push/fetch over ssh depending on the system. Issue jj-vcs#4979 lists over 20 related issues on this and proposes spawning a `git` subprocess for tasks related to the network (in fact, just push/fetch are enough). This PR implements this. Users can either enable shelling out to git in a config file: ```toml [git] subprocess = true ``` Implementation Details: This PR implements shelling out to `git` via `std::process::Command`. There are 2 sharp edges with the patch: - it relies on having to parse out git errors to match the error codes (and parsing git2's errors in one particular instance to match the error behaviour). This seems mostly unavoidable - to ensure matching behaviour with git2, the tests are maintained across the two implementations. This is done using test_case, as with the rest of the codebase Testing: Run the rust tests: ``` $ cargo test ``` Build: ``` $ cargo build ``` Clone a private repo: ``` $ path/to/jj git clone --shell <REPO_SSH_URL> ``` Create new commit and push ``` $ echo "TEST" > this_is_a_test_file.txt $ path/to/jj describe -m 'test commit' $ path/to/jj git push --shell -b <branch> ``` Issues Closed With a grain of salt, but most of these problems should be fixed (or at least checked if they are fixed). They are the ones listed in jj-vcs#4979 . SSH: - jj-vcs#63 - jj-vcs#440 - jj-vcs#1455 - jj-vcs#1507 - jj-vcs#2931 - jj-vcs#2958 - jj-vcs#3322 - jj-vcs#4101 - jj-vcs#4333 - jj-vcs#4386 - jj-vcs#4488 - jj-vcs#4591 - jj-vcs#4802 - jj-vcs#4870 - jj-vcs#4937 - jj-vcs#4978 - jj-vcs#5120 - jj-vcs#5166 Clone/fetch/push/pull: - jj-vcs#360 - jj-vcs#1278 - jj-vcs#1957 - jj-vcs#2295 - jj-vcs#3851 - jj-vcs#4177 - jj-vcs#4682 - jj-vcs#4719 - jj-vcs#4889 - jj-vcs#5147 - jj-vcs#5238 Notable Holdouts: - Interactive HTTP authentication (jj-vcs#401, jj-vcs#469) - libssh2-sys dependency on windows problem (can only be removed if/when we get rid of libgit2): jj-vcs#3984

Reasoning: `jj` fails to push/fetch over ssh depending on the system. Issue jj-vcs#4979 lists over 20 related issues on this and proposes spawning a `git` subprocess for tasks related to the network (in fact, just push/fetch are enough). This PR implements this. Users can either enable shelling out to git in a config file: ```toml [git] subprocess = true ``` Implementation Details: This PR implements shelling out to `git` via `std::process::Command`. There are 2 sharp edges with the patch: - it relies on having to parse out git errors to match the error codes (and parsing git2's errors in one particular instance to match the error behaviour). This seems mostly unavoidable - to ensure matching behaviour with git2, the tests are maintained across the two implementations. This is done using test_case, as with the rest of the codebase Testing: Run the rust tests: ``` $ cargo test ``` Build: ``` $ cargo build ``` Clone a private repo: ``` $ path/to/jj git clone --shell <REPO_SSH_URL> ``` Create new commit and push ``` $ echo "TEST" > this_is_a_test_file.txt $ path/to/jj describe -m 'test commit' $ path/to/jj git push --shell -b <branch> ```  Issues Closed With a grain of salt, but most of these problems should be fixed (or at least checked if they are fixed). They are the ones listed in jj-vcs#4979 . SSH: - jj-vcs#63 - jj-vcs#440 - jj-vcs#1455 - jj-vcs#1507 - jj-vcs#2931 - jj-vcs#2958 - jj-vcs#3322 - jj-vcs#4101 - jj-vcs#4333 - jj-vcs#4386 - jj-vcs#4488 - jj-vcs#4591 - jj-vcs#4802 - jj-vcs#4870 - jj-vcs#4937 - jj-vcs#4978 - jj-vcs#5120 - jj-vcs#5166 Clone/fetch/push/pull: - jj-vcs#360 - jj-vcs#1278 - jj-vcs#1957 - jj-vcs#2295 - jj-vcs#3851 - jj-vcs#4177 - jj-vcs#4682 - jj-vcs#4719 - jj-vcs#4889 - jj-vcs#5147 - jj-vcs#5238 Notable Holdouts: - Interactive HTTP authentication (jj-vcs#401, jj-vcs#469) - libssh2-sys dependency on windows problem (can only be removed if/when we get rid of libgit2): jj-vcs#3984

Reasoning: `jj` fails to push/fetch over ssh depending on the system. Issue jj-vcs#4979 lists over 20 related issues on this and proposes spawning a `git` subprocess for tasks related to the network (in fact, just push/fetch are enough). This PR implements this. Users can either enable shelling out to git in a config file: ```toml [git] subprocess = true ``` Implementation Details: This PR implements shelling out to `git` via `std::process::Command`. There are 2 sharp edges with the patch: - it relies on having to parse out git errors to match the error codes (and parsing git2's errors in one particular instance to match the error behaviour). This seems mostly unavoidable - to ensure matching behaviour with git2, the tests are maintained across the two implementations. This is done using test_case, as with the rest of the codebase Testing: Run the rust tests: ``` $ cargo test ``` Build: ``` $ cargo build ``` Clone a private repo: ``` $ path/to/jj git clone --config='git.subprocess=true' <REPO_SSH_URL> ``` Create new commit and push ``` $ echo "TEST" > this_is_a_test_file.txt $ path/to/jj describe -m 'test commit' $ path/to/jj git push --config='git.subprocess=true' -b <branch> ```  Issues Closed With a grain of salt, but most of these problems should be fixed (or at least checked if they are fixed). They are the ones listed in jj-vcs#4979 . SSH: - jj-vcs#63 - jj-vcs#440 - jj-vcs#1455 - jj-vcs#1507 - jj-vcs#2931 - jj-vcs#2958 - jj-vcs#3322 - jj-vcs#4101 - jj-vcs#4333 - jj-vcs#4386 - jj-vcs#4488 - jj-vcs#4591 - jj-vcs#4802 - jj-vcs#4870 - jj-vcs#4937 - jj-vcs#4978 - jj-vcs#5120 - jj-vcs#5166 Clone/fetch/push/pull: - jj-vcs#360 - jj-vcs#1278 - jj-vcs#1957 - jj-vcs#2295 - jj-vcs#3851 - jj-vcs#4177 - jj-vcs#4682 - jj-vcs#4719 - jj-vcs#4889 - jj-vcs#5147 - jj-vcs#5238 Notable Holdouts: - Interactive HTTP authentication (jj-vcs#401, jj-vcs#469) - libssh2-sys dependency on windows problem (can only be removed if/when we get rid of libgit2): jj-vcs#3984

Reasoning: `jj` fails to push/fetch over ssh depending on the system. Issue jj-vcs#4979 lists over 20 related issues on this and proposes spawning a `git` subprocess for tasks related to the network (in fact, just push/fetch are enough). This PR implements this. Implementation Details: This PR implements shelling out to `git` via `std::process::Command`. There are 2 sharp edges with the patch: - it relies on having to parse out git errors to match the error codes (and parsing git2's errors in one particular instance to match the error behaviour). This seems mostly unavoidable - to ensure matching behaviour with git2, the tests are maintained across the two implementations. This is done using test_case, as with the rest of the codebase Testing: Run the rust tests: ``` $ cargo test ``` Build: ``` $ cargo build ``` Clone a private repo: ``` $ path/to/jj git clone --config='git.subprocess=true' <REPO_SSH_URL> ``` Create new commit and push ``` $ echo "TEST" > this_is_a_test_file.txt $ path/to/jj describe -m 'test commit' $ path/to/jj git push --config='git.subprocess=true' -b <branch> ``` Issues Closed With a grain of salt, but most of these problems should be fixed (or at least checked if they are fixed). They are the ones listed in jj-vcs#4979 . SSH: - jj-vcs#63 - jj-vcs#440 - jj-vcs#1455 - jj-vcs#1507 - jj-vcs#2931 - jj-vcs#2958 - jj-vcs#3322 - jj-vcs#4101 - jj-vcs#4333 - jj-vcs#4386 - jj-vcs#4488 - jj-vcs#4591 - jj-vcs#4802 - jj-vcs#4870 - jj-vcs#4937 - jj-vcs#4978 - jj-vcs#5120 - jj-vcs#5166 Clone/fetch/push/pull: - jj-vcs#360 - jj-vcs#1278 - jj-vcs#1957 - jj-vcs#2295 - jj-vcs#3851 - jj-vcs#4177 - jj-vcs#4682 - jj-vcs#4719 - jj-vcs#4889 - jj-vcs#5147 - jj-vcs#5238 Notable Holdouts: - Interactive HTTP authentication (jj-vcs#401, jj-vcs#469) - libssh2-sys dependency on windows problem (can only be removed if/when we get rid of libgit2): jj-vcs#3984

Reasoning: `jj` fails to push/fetch over ssh depending on the system. Issue #4979 lists over 20 related issues on this and proposes spawning a `git` subprocess for tasks related to the network (in fact, just push/fetch are enough). This PR implements this. Implementation Details: This PR implements shelling out to `git` via `std::process::Command`. There are 2 sharp edges with the patch: - it relies on having to parse out git errors to match the error codes (and parsing git2's errors in one particular instance to match the error behaviour). This seems mostly unavoidable - to ensure matching behaviour with git2, the tests are maintained across the two implementations. This is done using test_case, as with the rest of the codebase Testing: Run the rust tests: ``` $ cargo test ``` Build: ``` $ cargo build ``` Clone a private repo: ``` $ path/to/jj git clone --config='git.subprocess=true' <REPO_SSH_URL> ``` Create new commit and push ``` $ echo "TEST" > this_is_a_test_file.txt $ path/to/jj describe -m 'test commit' $ path/to/jj git push --config='git.subprocess=true' -b <branch> ``` Issues Closed With a grain of salt, but most of these problems should be fixed (or at least checked if they are fixed). They are the ones listed in #4979 . SSH: - #63 - #440 - #1455 - #1507 - #2931 - #2958 - #3322 - #4101 - #4333 - #4386 - #4488 - #4591 - #4802 - #4870 - #4937 - #4978 - #5120 - #5166 Clone/fetch/push/pull: - #360 - #1278 - #1957 - #2295 - #3851 - #4177 - #4682 - #4719 - #4889 - #5147 - #5238 Notable Holdouts: - Interactive HTTP authentication (#401, #469) - libssh2-sys dependency on windows problem (can only be removed if/when we get rid of libgit2): #3984

PhilipMetzger added the 🐛bug Something isn't working label Sep 17, 2024

essiene self-assigned this Sep 17, 2024

arxanas mentioned this issue Nov 26, 2024

FR: Resolve many SSH issues by having networked jj git commands shell out to git #4979

Closed

bsdinis mentioned this issue Jan 9, 2025

git: spawn a separate git process for network operations #5228

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

failed to authenticate SSH session #4488

failed to authenticate SSH session #4488

stacyharper commented Sep 17, 2024 •

edited

Loading

essiene commented Sep 17, 2024

essiene commented Sep 17, 2024

stacyharper commented Sep 18, 2024

essiene commented Sep 18, 2024

yuja commented Sep 19, 2024

failed to authenticate SSH session #4488

failed to authenticate SSH session #4488

Comments

stacyharper commented Sep 17, 2024 • edited Loading

Description

Steps to Reproduce the Problem

Expected Behavior

Actual Behavior

Specifications

Complementary

essiene commented Sep 17, 2024

essiene commented Sep 17, 2024

stacyharper commented Sep 18, 2024

essiene commented Sep 18, 2024

yuja commented Sep 19, 2024

stacyharper commented Sep 17, 2024 •

edited

Loading