Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-75383

Host Key Verification Strategy : "Manually provided keys" returns "No RSA host key is known"

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • git-client-plugin

      Ever since performing a Jenkins + plugins update today we're running into host verification issues:

      The recommended git tool is: git
using credential BUILDER-ssh
Cloning the remote Git repository
Using shallow clone with depth 1
Honoring refspec on initial clone
ERROR: Error cloning remote repo 'origin'
hudson.plugins.git.GitException: Command "git fetch --tags --force --progress --depth=1 -- ssh://git@bitbucket.mega.corp:7999/project/repo.git +refs/heads/develop:refs/remotes/origin/develop" returned status code 128:
stdout: 
stderr: No RSA host key is known for [bitbucket.mega.corp]:7999 and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2852)
  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2188)
  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:638)
  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.CliGitAPIImpl$2.execute(CliGitAPIImpl.java:880)
  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:173)
  at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:164)
  at hudson.remoting.UserRequest.perform(UserRequest.java:225)
  at hudson.remoting.UserRequest.perform(UserRequest.java:50)
  at hudson.remoting.Request$2.run(Request.java:391)
  at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:81)
  at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:140)
  at java.base/java.lang.Thread.run(Unknown Source)
  Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to JNLP4-connect connection from 10.247.49.135/10.247.49.135:44718
   at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1923)
   at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:384)
   at hudson.remoting.Channel.call(Channel.java:1112)
   at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:155)
   at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
   at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
   at java.base/java.lang.reflect.Method.invoke(Method.java:569)
   at PluginClassLoader for git-client//org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:140)
   at PluginClassLoader for git-client/jdk.proxy76/jdk.proxy76.$Proxy174.execute(Unknown Source)
   at PluginClassLoader for git//hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1221)
   at PluginClassLoader for git//hudson.plugins.git.GitSCM._checkout(GitSCM.java:1311)
   at PluginClassLoader for git//hudson.plugins.git.GitSCM.checkout(GitSCM.java:1278)
   at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:136)
   at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:101)
   at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:88)
   at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:49)
   at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
   at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
   at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
   at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
   at java.base/java.lang.Thread.run(Thread.java:840)
ERROR: Error cloning remote repo 'origin'
ERROR: Maximum checkout retry attempts reached, aborting

      In our Jenkins under /manage/configureSecurity/ we have configured:

      Git Host Key Verification Configuration : Host Key Verification Strategy

      Manually provided keys:

      [bitbucket.mega.corp]:7999,[145.119.169.129]:7999 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjOC6HsxRChjRMFzTlznEz3b5bf4/H6aTsl1GMQS7JXaR6aN75lmnAYasA1QMa9+aBWhtyhv3uBSltqGB8ubpejcbY1Q/lutRqugHIHtACsmbCorw+yTSADNHSj7UbJKKoMsg7pJhCF8/efEldsBP3DfEs9k1IHSIBFFdcYizAKj9ubhWW/2T/8jGTCHGa9v+OOcZL6VuhLLMsILm/RsMoxu0VEinVorZlEu/cJlaBzL9SUcYy0dnu+6qhMuNlGzNn/RFpNkhFl8ppCCuXjWUGC00PoKhY4OhFYoy6Zw90XzWRtX20ExqOh8H3h0zbbObTGAdRtVYEeRepCsfjW18d
[bitbucket-lab.mega.corp]:7999,[145.119.169.36]:7999 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjOC6HsxRChjRMFzTlznEz3b5bf4/H6aTsl1GMQS7JXaR6aN75lmnAYasA1QMa9+aBWhtyhv3uBSltqGB8ubpejcbY1Q/lutRqugHIHtACsmbCorw+yTSADNHDj7UbJKKoMsg7pJhCF8/efEldsBP3DfEs9k1IHSIBMFdcYizAKj9ubhWW/2T/8jGTCHGa9v+OOcZL6VuhLLMsILm/RsMoxu0VEinVorZlEu/cJlaBzL9SUcYy0dnu+6qhMuNlGzNn/RFpNkhFl8ppCCuXjWUGC00PoKhY4OhFYoy6Zw90XzWRtX20ExqOh8H3h0zbbObTGAdRtVYEeRepCsfjW18d

      The hosts haven't changed and this setup was working right up untill we updated our Jenkins + plugins.

      It's hard to say which update is responsible, but since this functionality is most directly tied to the Jenkins Git client plugin: that's my best guess.

      We have switched to "Accept first connection" for the time being, which appears to work.

        1. Screenshot 2025-03-06 at 23.27.11.png
          Screenshot 2025-03-06 at 23.27.11.png
          17 kB

            Unassigned Unassigned
            paybas Pay Bas
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: