threads / discuss / 56736

Git failed to pull after upgrading to 2.33.1, using choco

Subject: Git failed to pull after upgrading to 2.33.1, using choco

## tl;dr

4 messages between Oct 19, 2021 and Oct 19, 2021.

replies: 3people: 3as markdown or json

LL L· Oct 19, 2021, 02:27 UTC · lore

Thank you for filling out a Git bug report! Please answer the following questions to help us understand your issue.

What did you do before the bug happened? (Steps to reproduce your issue)
1. uninstall git for windows 2.32.2
2. install git again with： choco install -y git
3. git pull emit error:

git@e.coding.net: Permission denied (publickey). fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists.

4. I am sure it is caused by the upgrading, I observed same issue on my other windows 10 machine..
What did you expect to happen? (Expected behavior)
pull from origin;
What happened instead? (Actual behavior)

git@e.coding.net: Permission denied (publickey). fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists.

What's different between what you expected and what actually happened?
It doesn't work.
Anything else you want to add:

coding:/mytex on  trunk [?] ❯ git pull git@e.coding.net: Permission denied (publickey). fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists.

coding:/mytex on  trunk [?] took 13s
❯ ssh -Tv git@e.coding.net
OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
debug1: Reading configuration data C:\\Users\\LL L/.ssh/config
debug1: Connecting to e.coding.net [81.69.155.167] port 22.
debug1: Connection established.
debug1: identity file C:\\Users\\LL L/.ssh/id_rsa type 0
debug1: identity file C:\\Users\\LL L/.ssh/id_rsa-cert type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_dsa type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_dsa-cert type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa-cert type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519 type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519-cert type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_xmss type -1
debug1: identity file C:\\Users\\LL L/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version Go-CodingGit
debug1: no match: Go-CodingGit
debug1: Authenticating to e.coding.net:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: rsa-sha2-512
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa SHA256:jok3FH7q5LJ6qvE7iPNehBgXRw51ErE77S0Dn+Vg/Ik
debug1: Host 'e.coding.net' is known and matches the RSA host key.
debug1: Found key in C:\\Users\\LL L/.ssh/known_hosts:28
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory
debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_dsa
debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ecdsa
debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ed25519
debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_xmss
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
debug1: Server accepts key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
debug1: Authentication succeeded (publickey).
Authenticated to e.coding.net ([81.69.155.167]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: pledge: network
CODING 提示: Hello eyl, You've connected to coding.net via SSH. This is a Personal Key.
eyl，你好，你已经通过 SSH 协议认证 coding.net 服务，这是一个个人公钥.
公钥指纹：e9:6c:54:c8:72:42:36:ac:b2:29:7e:ad:b1:a5:09:42
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2624, received 1924 bytes, in 1.5 seconds
Bytes per second: sent 1791.8, received 1313.8
debug1: Exit status 0

Please review the rest of the bug report below. You can delete any lines you don't wish to share.

[System Info] git version: git version 2.33.1.windows.1 cpu: x86_64 built from commit: 05d80adb775077d673fab685009ede4a1003ed92 sizeof-long: 4 sizeof-size_t: 8 shell-path: /bin/sh feature: fsmonitor--daemon uname: Windows 10.0 19044 compiler info: gnuc: 10.3 libc info: no libc information available $SHELL (typically, interactive shell): <unset>

[Enabled Hooks]
Bryan Turner· Oct 19, 2021, 02:48 UTC · re: LL L · lore

Re: Git failed to pull after upgrading to 2.33.1, using choco

On Mon, Oct 18, 2021 at 7:34 PM LL L <lll@xeltek-cn.com> wrote:
Show 29 quoted lines
>
> Thank you for filling out a Git bug report!
> Please answer the following questions to help us understand your issue.
>
> What did you do before the bug happened? (Steps to reproduce your issue)
>
> 1. uninstall git for windows 2.32.2
> 2. install git again with： choco install -y git
> 3. git pull emit error:
>
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights
> and the repository exists.
>
> 4. I am sure it is caused by the upgrading, I observed same issue on my other windows 10 machine..
>
> What did you expect to happen? (Expected behavior)
>
> pull from origin;
>
> What happened instead? (Actual behavior)
>
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights
> and the repository exists.

Most likely you're running afoul of an OpenSSH 8.8p1 upgrade in Git for Windows 2.33. OpenSSH 8.8 disables ssh-rsa key exchanges by default[1], which results in this sort of error. Git for Windows 2.32.2 was using OpenSSH 8.7 (or perhaps OpenSSH 8.5).

[1] https://www.openssh.com/txt/release-8.8; see the "Potentially-incompatible changes" section.

Show 18 quoted lines
>
> What's different between what you expected and what actually happened?
>
> It doesn't work.
>
> Anything else you want to add:
>
> coding:/mytex on  trunk [?]
> ❯ git pull
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights
> and the repository exists.
>
> coding:/mytex on  trunk [?] took 13s
> ❯ ssh -Tv git@e.coding.net
> OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2

These details end up being for the OpenSSH Windows package, which is _not_ the SSH being used by your Git for Windows install--it's almost certainly using the bundled OpenSSH 8.8p1. You should double check by explicitly running the ssh.exe that's in your Git for Windows install instead.

> debug1: Reading configuration data C:\\Users\\LL L/.ssh/config
> debug1: Connecting to e.coding.net [81.69.155.167] port 22.
> debug1: Connection established.
> debug1: identity file C:\\Users\\LL L/.ssh/id_rsa type 0
So you're using an RSA key. This may be a problem.
Show 17 quoted lines
> debug1: identity file C:\\Users\\LL L/.ssh/id_rsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_dsa type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_dsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519 type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_xmss type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_xmss-cert type -1
> debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
> debug1: Remote protocol version 2.0, remote software version Go-CodingGit
> debug1: no match: Go-CodingGit
> debug1: Authenticating to e.coding.net:22 as 'git'
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug1: kex: algorithm: curve25519-sha256@libssh.org
> debug1: kex: host key algorithm: rsa-sha2-512
Looks like the server supports more secure RSA key exchanges, which is good.
Show 59 quoted lines
> debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
> debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
> debug1: Server host key: ssh-rsa SHA256:jok3FH7q5LJ6qvE7iPNehBgXRw51ErE77S0Dn+Vg/Ik
> debug1: Host 'e.coding.net' is known and matches the RSA host key.
> debug1: Found key in C:\\Users\\LL L/.ssh/known_hosts:28
> debug1: rekey out after 134217728 blocks
> debug1: SSH2_MSG_NEWKEYS sent
> debug1: expecting SSH2_MSG_NEWKEYS
> debug1: SSH2_MSG_NEWKEYS received
> debug1: rekey in after 134217728 blocks
> debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_dsa
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ecdsa
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ed25519
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_xmss
> debug1: SSH2_MSG_SERVICE_ACCEPT received
> debug1: Authentications that can continue: publickey
> debug1: Next authentication method: publickey
> debug1: Offering public key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Server accepts key: C:\\Users\\LL L/.ssh/id_rsa RSA SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Authentication succeeded (publickey).
> Authenticated to e.coding.net ([81.69.155.167]:22).
> debug1: channel 0: new [client-session]
> debug1: Entering interactive session.
> debug1: pledge: network
> CODING 提示: Hello eyl, You've connected to coding.net via SSH. This is a Personal Key.
> eyl，你好，你已经通过 SSH 协议认证 coding.net 服务，这是一个个人公钥.
> 公钥指纹：e9:6c:54:c8:72:42:36:ac:b2:29:7e:ad:b1:a5:09:42
> debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
> debug1: channel 0: free: client-session, nchannels 1
> Transferred: sent 2624, received 1924 bytes, in 1.5 seconds
> Bytes per second: sent 1791.8, received 1313.8
> debug1: Exit status 0
>
> Please review the rest of the bug report below.
> You can delete any lines you don't wish to share.
>
>
> [System Info]
> git version:
> git version 2.33.1.windows.1
> cpu: x86_64
> built from commit: 05d80adb775077d673fab685009ede4a1003ed92
> sizeof-long: 4
> sizeof-size_t: 8
> shell-path: /bin/sh
> feature: fsmonitor--daemon
> uname: Windows 10.0 19044
> compiler info: gnuc: 10.3
> libc info: no libc information available
> $SHELL (typically, interactive shell): <unset>
>
>
> [Enabled Hooks]
>
>
>
LL L· Oct 19, 2021, 02:57 UTC · re: Bryan Turner · lore

答复: Git failed to pull after upgrading to 2.33.1, using choco

-----邮件原件----- 发件人: Bryan Turner [mailto:bturner@atlassian.com] 发送时间: Tuesday, October 19, 2021 10:49 AM 收件人: LL L <lll@xeltek-cn.com> 抄送: Git Users <git@vger.kernel.org> 主题: Re: Git failed to pull after upgrading to 2.33.1, using choco

On Mon, Oct 18, 2021 at 7:34 PM LL L <lll@xeltek-cn.com> wrote:
Show 30 quoted lines
>
> Thank you for filling out a Git bug report!
> Please answer the following questions to help us understand your issue.
>
> What did you do before the bug happened? (Steps to reproduce your 
> issue)
>
> 1. uninstall git for windows 2.32.2
> 2. install git again with： choco install -y git 3. git pull emit 
> error:
>
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights and the repository 
> exists.
>
> 4. I am sure it is caused by the upgrading, I observed same issue on my other windows 10 machine..
>
> What did you expect to happen? (Expected behavior)
>
> pull from origin;
>
> What happened instead? (Actual behavior)
>
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights and the repository 
> exists.

Most likely you're running afoul of an OpenSSH 8.8p1 upgrade in Git for Windows 2.33. OpenSSH 8.8 disables ssh-rsa key exchanges by default[1], which results in this sort of error. Git for Windows 2.32.2 was using OpenSSH 8.7 (or perhaps OpenSSH 8.5).

[1] https://www.openssh.com/txt/release-8.8; see the "Potentially-incompatible changes" section.
Show 18 quoted lines
>
> What's different between what you expected and what actually happened?
>
> It doesn't work.
>
> Anything else you want to add:
>
> coding:/mytex on  trunk [?]
> ❯ git pull
> git@e.coding.net: Permission denied (publickey).
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights and the repository 
> exists.
>
> coding:/mytex on  trunk [?] took 13s
> ❯ ssh -Tv git@e.coding.net
> OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
These details end up being for the OpenSSH Windows package, which is _not_ the SSH being used by your Git for Windows install--it's almost certainly using the bundled OpenSSH 8.8p1. You should double check by explicitly running the ssh.exe that's in your Git for Windows install instead.
> debug1: Reading configuration data C:\\Users\\LL L/.ssh/config
> debug1: Connecting to e.coding.net [81.69.155.167] port 22.
> debug1: Connection established.
> debug1: identity file C:\\Users\\LL L/.ssh/id_rsa type 0
So you're using an RSA key. This may be a problem.
Show 18 quoted lines
> debug1: identity file C:\\Users\\LL L/.ssh/id_rsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_dsa type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_dsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ecdsa-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519 type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_ed25519-cert type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_xmss type -1
> debug1: identity file C:\\Users\\LL L/.ssh/id_xmss-cert type -1
> debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
> debug1: Remote protocol version 2.0, remote software version 
> Go-CodingGit
> debug1: no match: Go-CodingGit
> debug1: Authenticating to e.coding.net:22 as 'git'
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug1: kex: algorithm: curve25519-sha256@libssh.org
> debug1: kex: host key algorithm: rsa-sha2-512
Looks like the server supports more secure RSA key exchanges, which is good.
Show 66 quoted lines
> debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: 
> <implicit> compression: none
> debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: 
> <implicit> compression: none
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
> debug1: Server host key: ssh-rsa 
> SHA256:jok3FH7q5LJ6qvE7iPNehBgXRw51ErE77S0Dn+Vg/Ik
> debug1: Host 'e.coding.net' is known and matches the RSA host key.
> debug1: Found key in C:\\Users\\LL L/.ssh/known_hosts:28
> debug1: rekey out after 134217728 blocks
> debug1: SSH2_MSG_NEWKEYS sent
> debug1: expecting SSH2_MSG_NEWKEYS
> debug1: SSH2_MSG_NEWKEYS received
> debug1: rekey in after 134217728 blocks
> debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or 
> directory
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_rsa RSA 
> SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_dsa
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ecdsa
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_ed25519
> debug1: Will attempt key: C:\\Users\\LL L/.ssh/id_xmss
> debug1: SSH2_MSG_SERVICE_ACCEPT received
> debug1: Authentications that can continue: publickey
> debug1: Next authentication method: publickey
> debug1: Offering public key: C:\\Users\\LL L/.ssh/id_rsa RSA 
> SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Server accepts key: C:\\Users\\LL L/.ssh/id_rsa RSA 
> SHA256:SzTwSmfmiLOTlZGuTIhP2VctForj8wVH866bFSWWLH0
> debug1: Authentication succeeded (publickey).
> Authenticated to e.coding.net ([81.69.155.167]:22).
> debug1: channel 0: new [client-session]
> debug1: Entering interactive session.
> debug1: pledge: network
> CODING 提示: Hello eyl, You've connected to coding.net via SSH. This is a Personal Key.
> eyl，你好，你已经通过 SSH 协议认证 coding.net 服务，这是一个个人公钥.
> 公钥指纹：e9:6c:54:c8:72:42:36:ac:b2:29:7e:ad:b1:a5:09:42
> debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
> debug1: channel 0: free: client-session, nchannels 1
> Transferred: sent 2624, received 1924 bytes, in 1.5 seconds Bytes per 
> second: sent 1791.8, received 1313.8
> debug1: Exit status 0
>
> Please review the rest of the bug report below.
> You can delete any lines you don't wish to share.
>
>
> [System Info]
> git version:
> git version 2.33.1.windows.1
> cpu: x86_64
> built from commit: 05d80adb775077d673fab685009ede4a1003ed92
> sizeof-long: 4
> sizeof-size_t: 8
> shell-path: /bin/sh
> feature: fsmonitor--daemon
> uname: Windows 10.0 19044
> compiler info: gnuc: 10.3
> libc info: no libc information available $SHELL (typically, 
> interactive shell): <unset>
>
>
> [Enabled Hooks]
>
>
>
Thanks. Really appreciated. I will check it out.
brian m. carlson· Oct 19, 2021, 23:19 UTC · re: Bryan Turner · lore

Re: Git failed to pull after upgrading to 2.33.1, using choco

On 2021-10-19 at 02:48:59, Bryan Turner wrote:
Show 17 quoted lines
> On Mon, Oct 18, 2021 at 7:34 PM LL L <lll@xeltek-cn.com> wrote:
> >
> > What happened instead? (Actual behavior)
> >
> > git@e.coding.net: Permission denied (publickey).
> > fatal: Could not read from remote repository.
> >
> > Please make sure you have the correct access rights
> > and the repository exists.
> 
> Most likely you're running afoul of an OpenSSH 8.8p1 upgrade in Git
> for Windows 2.33. OpenSSH 8.8 disables ssh-rsa key exchanges by
> default[1], which results in this sort of error. Git for Windows
> 2.32.2 was using OpenSSH 8.7 (or perhaps OpenSSH 8.5).
> 
> [1] https://www.openssh.com/txt/release-8.8; see the
> "Potentially-incompatible changes" section.

Yes, this is almost certainly the problem. Note that this change was made because while RSA _keys_ are still secure, the SHA-1 signatures being used are not, and so folks need to either use those RSA keys with SHA-2 or switch keys.

> > debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
> > debug1: Remote protocol version 2.0, remote software version Go-CodingGit
> > debug1: no match: Go-CodingGit

Go's SSH library is known to have various problems with RSA keys and SHA-2, so if this site is using that library, then it may be the cause of your problems. I know they're aware of this problem, so hopefully they'll be able to work on it soon.

Show 7 quoted lines
> > debug1: Authenticating to e.coding.net:22 as 'git'
> > debug1: SSH2_MSG_KEXINIT sent
> > debug1: SSH2_MSG_KEXINIT received
> > debug1: kex: algorithm: curve25519-sha256@libssh.org
> > debug1: kex: host key algorithm: rsa-sha2-512
> 
> Looks like the server supports more secure RSA key exchanges, which is good.
This is encouraging, but I don't think it's sufficient in this case.

You may want to generate a new Ed25519 SSH key with "ssh-keygen -t ed25519" and use that instead, provided the site supports that. Many sites do, and those keys aren't subject to any of the problems you've seen here.

-- 
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA

← back to recent threads