fix(aur): make host-key setup deterministic and diagnosable#45
Merged
Conversation
The AUR push failed with Cloning into '/tmp/aur-repo'... Host key verification failed. Publishing to the AUR is a git push over SSH, so aur.archlinux.org's host key must be in known_hosts before git will connect. The step already ran ssh-keyscan, but with 2>/dev/null -- and ssh-keyscan can return NOTHING while still exiting 0, so an empty result passed silently and surfaced three lines later as an error about the host key rather than about the scan. Now asserts the scan produced something and prints the count, so an empty result fails at the point it happens with a message naming the cause. Also drops ~/.ssh and the ssh config file in favour of absolute paths and an explicit GIT_SSH_COMMAND. The shell and the ssh that git spawns each resolve ~ from HOME independently, and in a container that is one more thing that can quietly differ -- another way to arrive at exactly this error while the host key was never the problem. IdentitiesOnly stops ssh offering some other key and being rejected before it reaches ours.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
thinkutils | e0a8990 | Jul 20 2026, 07:17 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The AUR publish for v0.2.0 failed:
Publishing to the AUR is a
git pushover SSH, soaur.archlinux.org's host key must be inknown_hostsbefore git will connect.Why it failed silently
The step already ran
ssh-keyscan— but with2>/dev/null.ssh-keyscancan return nothing while still exiting 0, so an empty result passed theset -echeck and surfaced three lines later as an error about the host key, rather than about the scan that produced no keys.That's the same shape as several bugs found this session: a step that can succeed while accomplishing nothing, where the eventual error names the wrong cause.
Changes
GIT_SSH_COMMAND, replacing~/.sshand a config file. The shell and thesshthat git spawns each resolve~fromHOMEindependently, and in a container that's one more thing that can quietly differ — another route to exactly this error while the host key was never the problem.IdentitiesOnly=yesso ssh doesn't offer some other key and get rejected before reaching ours.StrictHostKeyChecking=yesretained — the point is to verify the host, not to skip verifying it.Context
The key itself is known-good: I verified it authenticates as
vietanhdevagainstaur.archlinux.orgbefore setting the secret, and the dry run passed every step (Push to AURis the one step a dry run skips).Three of four channels are already live for v0.2.0 — GitHub release, the signed APT repo, and COPR (both arches). AUR is the last one.