From: "brian m. carlson" <sandals@crustytoothpaste.net>
To: Bryan Turner <bturner@atlassian.com>
Cc: LL L <lll@xeltek-cn.com>, Git Users <git@vger.kernel.org>
Subject: Re: Git failed to pull after upgrading to 2.33.1, using choco
Date: Tue, 19 Oct 2021 23:19:55 +0000 [thread overview]
Message-ID: <YW9SmwZOp+HYHScP@camp.crustytoothpaste.net> (raw)
In-Reply-To: <CAGyf7-GV62dHzsiV7KD2h8Rgg2HBWn1TgimodzcPUWravowUGQ@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2107 bytes --]
On 2021-10-19 at 02:48:59, Bryan Turner wrote:
> On Mon, Oct 18, 2021 at 7:34 PM LL L <lll@xeltek-cn.com> wrote:
> >
> > What happened instead? (Actual behavior)
> >
> > git@e.coding.net: Permission denied (publickey).
> > fatal: Could not read from remote repository.
> >
> > Please make sure you have the correct access rights
> > and the repository exists.
>
> Most likely you're running afoul of an OpenSSH 8.8p1 upgrade in Git
> for Windows 2.33. OpenSSH 8.8 disables ssh-rsa key exchanges by
> default[1], which results in this sort of error. Git for Windows
> 2.32.2 was using OpenSSH 8.7 (or perhaps OpenSSH 8.5).
>
> [1] https://www.openssh.com/txt/release-8.8; see the
> "Potentially-incompatible changes" section.
Yes, this is almost certainly the problem. Note that this change was
made because while RSA _keys_ are still secure, the SHA-1 signatures
being used are not, and so folks need to either use those RSA keys with
SHA-2 or switch keys.
> > debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
> > debug1: Remote protocol version 2.0, remote software version Go-CodingGit
> > debug1: no match: Go-CodingGit
Go's SSH library is known to have various problems with RSA keys and
SHA-2, so if this site is using that library, then it may be the cause
of your problems. I know they're aware of this problem, so hopefully
they'll be able to work on it soon.
> > debug1: Authenticating to e.coding.net:22 as 'git'
> > debug1: SSH2_MSG_KEXINIT sent
> > debug1: SSH2_MSG_KEXINIT received
> > debug1: kex: algorithm: curve25519-sha256@libssh.org
> > debug1: kex: host key algorithm: rsa-sha2-512
>
> Looks like the server supports more secure RSA key exchanges, which is good.
This is encouraging, but I don't think it's sufficient in this case.
You may want to generate a new Ed25519 SSH key with "ssh-keygen -t
ed25519" and use that instead, provided the site supports that. Many
sites do, and those keys aren't subject to any of the problems you've
seen here.
--
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 262 bytes --]
prev parent reply other threads:[~2021-10-19 23:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-19 2:27 Git failed to pull after upgrading to 2.33.1, using choco LL L
2021-10-19 2:48 ` Bryan Turner
2021-10-19 2:57 ` 答复: " LL L
2021-10-19 23:19 ` brian m. carlson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YW9SmwZOp+HYHScP@camp.crustytoothpaste.net \
--to=sandals@crustytoothpaste.net \
--cc=bturner@atlassian.com \
--cc=git@vger.kernel.org \
--cc=lll@xeltek-cn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).