Host key verification failed

[liangjl76]

pnpm version:

8.6.7

Code to reproduce the issue:

pnpm add jsdoc@3.2.0

Actual behavior:

pnpm: Command failed with exit code 128: git -c core.longpaths=true fetch --depth 1 origin 95c5d505
Host key verification failed.
fatal: Could not read from remote repository.

Additional information:

 ERROR  Command failed with exit code 128: git -c core.longpaths=true fetch --depth 1 origin 95c5d505
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

pnpm: Command failed with exit code 128: git -c core.longpaths=true fetch --depth 1 origin 95c5d505
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
at makeError (E:\prog\npm\node_modules\pnpm\dist\pnpm.cjs:24796:17)
at handlePromise (E:\prog\npm\node_modules\pnpm\dist\pnpm.cjs:25367:33)
at runMicrotasks ()
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async gitFetcher (E:\prog\npm\node_modules\pnpm\dist\pnpm.cjs:113063:11)
at async fetcher (E:\prog\npm\node_modules\pnpm\dist\pnpm.cjs:125600:16)
at async run (E:\prog\npm\node_modules\pnpm\dist\pnpm.cjs:124984:23)
Progress: resolved 8, reused 0, downloaded 8, added 0

• node -v prints:v16.18.1
• Windows, macOS, or Linux?:windows -- Microsoft Windows [版本 10.0.14393]

[liangjl76]

The code that generates the problem is as follows:

        const tempLocation = await cafs.tempDir();
        if (allowedHosts.size > 0 && shouldUseShallow(resolution.repo, allowedHosts)) {
          await execGit(["init"], { cwd: tempLocation });
          await execGit(["remote", "add", "origin", resolution.repo], { cwd: tempLocation });
          await execGit(["fetch", "--depth", "1", "origin", resolution.commit], { cwd: tempLocation });
        } else {
          await execGit(["clone", resolution.repo, tempLocation]);
        }

The actual execution is the following command

git init
git remote add origin git+ssh://git@github.com/dominictarr/crypto-browserify.git
git -c core.longpaths=true fetch --depth 1 origin 95c5d505

After multiple steps, the following error is finally reported:
fatal: couldn't find remote ref 95c5d505
This is the fundamental reason

Remove +ssh from the url, it directly reports the above error

git init
git remote add origin git://git@github.com/dominictarr/crypto-browserify.git
git -c core.longpaths=true fetch --depth 1 origin 95c5d505

Why use git+ssh here instead of directly using git?
this makes the error very clear and understandable

[KSXGitHub]

While this is certainly a bug on pnpm's part, for the time being, the latest version of jsdoc (v4.0.2) can be installed successfully by pnpm.

[KSXGitHub]

@liangjl76 I forgot to say thank you for your own investigation on this bug, without it, it would have taken me a longer time to find the cause and solve it.

[zkochan]

I had to temporarily revert the fix but we'll have another fix.

[KSXGitHub]

#6832 should fix both this bug and the other bug. Please let me know if it doesn't.

[orgoj]

I can't install repo https://github.com/signal-ai/angular-sha1.git

ERROR  Command failed with exit code 128: git ls-remote git+ssh://git@github.com/SignalMedia/angular-sha1.git HEAD
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

With https protocol command git ls-remote working, with git+ssh not.

Pnpm Version 7.33.4 is ok, but 7.33.6 or 8.7.1 have this error..

[KSXGitHub]

@orgoj Why would you want to use ssh on a public repo?

[orgoj]

@KSXGitHub I don't use ssh on public repo. In package.json i have https, but pnpm try git ls-remote with git+ssh.

[KSXGitHub]

I can't install repo https://github.com/signal-ai/angular-sha1.git

This repo doesn't even have package.json. Can you try a public repo that have one?

[orgoj]

Repo https://github.com/signal-ai/angular-sha1.git is instalable by npm, yarn. Pnpm only version 7.33.4 install it. Last 7 or 8 version do error on install.

[KSXGitHub]

Repo https://github.com/signal-ai/angular-sha1.git is instalable by npm, yarn.

npm certainly does not:

[KSXGitHub]

Interestingly enough, pnpm@8.7.1 supports it, and run it without issue:

So I'm not sure why it fails on your machine.

[1zilc]

8.6.x has no problem, 8.7.x will encounter the problem in the screenshot above