SSH fingerprint failed to verify

[yakuhzi]

I have set up a Xcode project with a private repository as dependency using Swift Package Manager. Therefore I have to add the ssh key for the dependency. Cloning the repository in a Github Action step is working well, but when I try to build the app in a step with xcodebuild I get the following error:

xcodebuild: error: Could not resolve package dependencies: The server SSH fingerprint failed to verify.

[mpdude]

I don't know about the Swift Package Manager... Do you want to clone the private repo from GitHub at all?

[yakuhzi]

No I dont want to clone the repository directly. I only want to build my app with xcodebuild. But the application depends on the private repository. Normally xcodebuild pulls all the dependencies added with SPM, but here it fails due to the fingerprint. The dependency was added via ssh, so I added the ssh keys to my action.

[mpdude]

I think the issue here is that your host containing the private repo does not have its public key in the /etc/ssh/ssh_known_hosts file?

[mpdude]

Can you provide a public demo project that shows the error?

[yakuhzi]

Finally I figured it out. It seems like its a known issue in Xcode 11 (https://developer.apple.com/documentation/xcode_release_notes/xcode_11_release_notes).

Thanks to Dosium in this post (https://discuss.bitrise.io/t/xcode-11-resolving-packages-fails-with-ssh-fingerprint/10388), I was able to get it work.

The solution is to run the following command before running xcodebuild:
for ip in $(dig @8.8.8.8 github.com +short); do ssh-keyscan github.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts

[x-yuri]

@yakuhzi It's generally safer to not rely on ssh-keyscan (that equals to disabling host key verification in case of ci scripts). First, webfactory/ssh-agent adds GitHub host keys anyway. Second, you can find a workaround here.

[mpdude]

It’s been a while, but maybe the answer is that by default, xcodebuild uses its own version of Git which has a separate set of config files.

see https://github.com/webfactory/ssh-agent#using-deploy-keys-with-swift-package-manager

[th-mustache-dk]

I think the issue here is that your host containing the private repo does not have its public key in the /etc/ssh/ssh_known_hosts file?

I'm fucking buying you a beer i've spent hours on this problem. You are my hero today