Host key verification failed when cloning github.com Submodules

[bmaximuml]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Mend Renovate hosted app on github.com

Reproduction

https://github.com/bmaximuml/renovate-minimal-submodule

Please tell us more about your question or problem

I'm seeing an error around a submodule in my repository. I keep seeing a go.mod: no such file or directory referring to the file in the submodule.

I have checked:

• renovate has permission to read the submodule
• I have "git-submodules": {"enabled": true}, in my renovate.json
• EDIT: I have "cloneSubmodules": true, in my renovate.json

Any help here would be appreciated!

Logs (if relevant)

Logs

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:
File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: github.com/my_org/my_submodule@v0.0.0-00010101000000-000000000000 (replaced by ./my_submodule): reading proto-buffet/go.mod: open /tmp/renovate/repos/github/my_org/my_repo/my_submodule/go.mod: no such file or directory

[rarkins]

Look up cloneSubmodules in docs

[rarkins]

GitHub apps aren't granted ssh credentials unfortunately. Although I'm not sure if this is still a limitation. We'd need a reproduction

[bmaximuml]

Hi @rarkins, I've put together a minimal reproduction here: https://github.com/bmaximuml/renovate-minimal-submodule

Here's the logs I get from https://developer.mend.io/github/bmaximuml/renovate-minimal-submodule/-/job/01917c91-e9cf-7d85-b029-f48ec05c75b8

WARN: Unable to initialise git submodule at go-module-demo
{
  "err": {
    "task": {
      "commands": [
        "submodule",
        "update",
        "--init",
        "--recursive",
        "go-module-demo"
      ],
      "format": "utf-8",
      "parser": "[function]"
    },
    "message": "Submodule 'go-module-demo' (git@github.com:bmaximuml/go-module-demo.git) registered for path 'go-module-demo'\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo'. Retry scheduled\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo' a second time, aborting\n",
    "stack": "Error: Submodule 'go-module-demo' (git@github.com:bmaximuml/go-module-demo.git) registered for path 'go-module-demo'\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo'. Retry scheduled\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo' a second time, aborting\n\n    at Object.action (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.<anonymous> (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/dist/cjs/index.js:52:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"
  }
}

[rarkins]

When I look in that repo:

• I don't see cloneSubmodules=true
• I see non-minimal config like hostRules and ignorePaths

[bmaximuml]

My apologies, I had based that off the larger codebase I was using, and hadn't properly slimmed it down. I have no idea how I manage to leave out submodule options, but I seem to have done so. I've added that back and slimmed it down further. My renovate.json now looks like:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:best-practices"],
  "git-submodules": {
    "enabled": true
  },
  "cloneSubmodules": true
}

And the error I'm seeing is:

WARN: Unable to initialise git submodule at go-module-demo
{
  "err": {
    "task": {
      "commands": [
        "submodule",
        "update",
        "--init",
        "--recursive",
        "go-module-demo"
      ],
      "format": "utf-8",
      "parser": "[function]"
    },
    "message": "Submodule 'go-module-demo' (git@github.com:bmaximuml/go-module-demo.git) registered for path 'go-module-demo'\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo'. Retry scheduled\nCloning into '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo'...\nHost key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\nfatal: clone of 'git@github.com:bmaximuml/go-module-demo.git' into submodule path '/tmp/renovate/repos/github/bmaximuml/renovate-minimal-submodule/go-module-demo' failed\nFailed to clone 'go-module-demo' a second time, aborting\n",

[rarkins]

I also get the host key error when running against a fork:

DEBUG: Cloning git submodule at go-module-demo (repository=renovate-reproductions/30942)
DEBUG: Git function thrown (repository=renovate-reproductions/30942)
       "err": {
         "task": {
           "commands": [
             "submodule",
             "update",
             "--init",
             "--recursive",
             "go-module-demo"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "Submodule 'go-module-demo' (git@github.com:bmaximuml/go-module-demo.git) registered for path 'go-module-demo'\nCloning into '/private/tmp/renovate/repos/github/renovate-reproductions/30942/go-module-demo'...\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is\nSHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s.
Please contact your system administrator.
Add correct host key in /Users/rhys/.ssh/known_hosts to get rid of this message.

When I remove the host key from my /Users/rhys/.ssh/known_hosts then the message changes a little:

Cloning into '/private/tmp/renovate/repos/github/renovate-reproductions/30942/go-module-demo'...
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Now when I try to clone manually it also fails:

❯ git clone git@github.com:bmaximuml/go-module-demo.git
Cloning into 'go-module-demo'...
The authenticity of host 'github.com (140.82.121.3)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Second time with no fingerprint prompt:

❯ git clone git@github.com:bmaximuml/go-module-demo.git
Cloning into 'go-module-demo'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

https works fine though:

❯ git clone https://github.com/bmaximuml/go-module-demo
Cloning into 'go-module-demo'...
remote: Enumerating objects: 188, done.
remote: Counting objects: 100% (188/188), done.
remote: Compressing objects: 100% (172/172), done.
remote: Total 188 (delta 74), reused 57 (delta 4), pack-reused 0 (from 0)
Receiving objects: 100% (188/188), 175.93 KiB | 1.61 MiB/s, done.
Resolving deltas: 100% (74/74), done.

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

Good luck,

The Renovate team