Libgit2 doesn't support hashed hosts in known_hosts file

[mikesir87]

Describe the bug

While experimenting with ImageUpdateAutomation, I ran into the following issue. IUA uses only libgit2 (since fluxcd/image-automation-controller#177) while the GitRepository defaults to go-git. My repos were able to fetch and sync correctly on the GitRepository -> Kustomization flow, but I repeatedly got errors when IUA was trying to sync. It failed during the git clone with a message simply indicating auth error: EOF.

After doing some digging, I found it was an issue with the configured known_hosts in the SSH credential secret referenced on the GitRepository. It appears that libgit2 only supports one format while go-fit supports both formats.

known_hosts without hashed hosts

> ssh-keyscan -t rsa github.com
# github.com:22 SSH-2.0-babeld-4cec2db4
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

known_hosts with hashed hosts

> # github.com:22 SSH-2.0-babeld-4cec2db4
|1|JjNNIoOyXpYOUxQYCq4iFNKTlSg=|IFUINCl+BFmqhiANWm1qgP/9YA8= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

I had originally created my known_hosts config with the hashed option, but it appears libgit2 doesn't know how to use it. By swapping to the first option, it worked. My GitRepository was still using the default (go-git), so appears to be happy with it too.

To Reproduce

Steps to reproduce the behaviour:

1. Configure the known_hosts for the SSH credential using ssh-keyscan -H <host>.
2. Create your GitRepository and ImageUpdateAutomation objects.
3. Wait for the next sync. You'll see the GitRepository will sync, but the IUA will fail with a message of auth error: EOF.

Expected behavior

Both known_hosts formats should be supported or at least an error message informing the administrator to use the other method of creating the file.

[hiddeco]

This may be another version, or related to: fluxcd/source-controller#397

[pjbgf]

@mikesir87 just as an update, this has been recently merged into main and will be contained in the next source-controller release.