GitPython - cloning with ssh key - Host key verification failed

Question

i have a problem with cloning git repository in my application.

KEY_FILE = "/opt/app/.ssh/id_rsa"

def read_git_branch(config_id, branch):
    config = RepoConfig.objects.get(id=config_id)
    save_rsa_key(Credentials.objects.get(id=1).key)
    git_ssh_identity_file = os.path.expanduser(KEY_FILE)
    git_ssh_cmd = 'ssh -i %s' % git_ssh_identity_file
    with Git().custom_environment(GIT_SSH_COMMAND=git_ssh_cmd):
        with tempfile.TemporaryDirectory() as tmpdir:
            repo = Repo.clone_from(config.url, tmpdir, branch=branch)
            branch_obj, _ = Branch.objects.get_or_create(name=branch)
            ....

def save_rsa_key(key):
    if not os.path.exists(os.path.dirname(KEY_FILE)):
        try:
            os.makedirs(os.path.dirname(KEY_FILE))
        except OSError as exc:
            if exc.errno != errno.EEXIST:
                raise
    with open(KEY_FILE, 'w') as id_rsa:
        id_rsa.write(key)
        os.chmod(KEY_FILE, 0o600)

Expected result is to clone repository to temporary directory, do something with it and delete all files.
Instead I'm getting:

DEBUG/ForkPoolWorker-2] AutoInterrupt wait stderr: b'Host key verification failed.\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n'

git.exc.GitCommandError: Cmd('git') failed due to: exit code(128) cmdline: git clone --branch=master -v [email protected]:bar/project.git /tmp/tmpi_w2xhgt stderr: 'Host key verification failed.

When i try to connect to the same repo directly from machine with key file created by code above with:

ssh-agent bash -c 'ssh-add /opt/app/.ssh/id_rsa; git clone [email protected]:bar/project.git'

Repo is cloned without problems + host is added to known_hosts. After doing that my code works as expected...

It has to be something with known_hosts. Anyone had similar problem?

Thanks for your help.

It's a security feature. Relevant how-to-add-hostname-to-known-hosts-using-python and paramiko-add-host-key-to-known-hosts-permanently — stovfl
– stovfl, Commented Oct 1, 2018 at 15:00

Armali · Accepted Answer · 2019-02-21 08:52:51Z

3

You should use env of clone_from.

with Git().custom_environment(GIT_SSH_COMMAND=git_ssh_cmd):
    repo = Repo.clone_from(config.url, tmpdir, branch=branch)

→

git.Repo.clone_from(url, repo_dir, env={"GIT_SSH_COMMAND": 'ssh -i /PATH/TO/KEY'})

edited Feb 21, 2019 at 8:52

Armali

19.6k15 gold badges64 silver badges184 bronze badges

answered Feb 21, 2019 at 8:32

yuta

511 silver badge5 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Shadi Over a year ago

This answer should be upvoted more. I was mislead by another answer here which didnt work for the clone_from case.

Can O'Spam feels disassociated · Accepted Answer · 2020-01-24 14:51:32Z

2

This variant:

git.Repo.clone_from("[email protected]:user/coolrepo.git", r"..\coolrepo", env=dict(GIT_SSH_COMMAND="ssh -i id_rsa"))

works fine for me!

edited Jan 24, 2020 at 14:51

Can O'Spam feels disassociated

1183 gold badges16 silver badges30 bronze badges

answered Jan 24, 2020 at 14:49

Viktoriya Medvinskaya

211 bronze badge

Comments

bsplosion · Accepted Answer · 2020-10-16 16:26:17Z

0

While the existing answers cover cases where missing the SSH env was the issue, I had a scenario where the remote host key would only be accepted via GitPython, and the environment wasn't able to be modified to include that host key in known hosts.

To ensure host key mismatches never break your code, disable strict host key checks through manipulation of the ssh command:

git.Repo.clone_from(
    url, 
    repo_dir, 
    env={
        "GIT_SSH_COMMAND": "ssh -o StrictHostKeyChecking=no -i /path/to/key"
    }
)

answered Oct 16, 2020 at 16:26

bsplosion

2,9261 gold badge30 silver badges41 bronze badges

Collectives™ on Stack Overflow

GitPython - cloning with ssh key - Host key verification failed

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related