GithubRepo push to remote not work after upgade gitlab to 16.3.4

[Mascherus]

GithubRepo push to remote not work after upgade gitlab to 16.3.4

[Mascherus]

Fixed.
This problem only appears on Debian12 with libssh2-1 1.10.0-3
If you install the libssh package from Ubuntu (libssh2-1 1.11.0-2), everything works fine

[eoli3n]

This is not a fix, but a workaround, I face that same issue with debian12 - libssh2-1 1.10.0-3 and gitlab.

[rkerr]

I had a similar issue - there's quite a few variables here - gitlab can use OpenSSH or it's own built in ssh server depending on what you have configured, and there are lots of different key types you can use to authenticate for ssh.

What I found in my case was if oxidized is using an RSA key it was attempting to use the older ssh-rsa method (ie RSA with SHA1) but the gitlab end wouldn't accept that and only supports rsa-sha2-256 or rsa-sha2-512. OpenSSH deprecated ssh-rsa in version 8.8 so this should really be dependant on the OpenSSH version not the version of gitlab, but maybe you're running gitlab in a container and the gitlab update updated OpenSSH in the container? or maybe you're using gitlabs own ssh server (not the default).

I didn't dig too much further into what changed to break this. For me there was another easy work around - switching to an ED25519 key which is more secure than RSA anyway and doesn't have this issue.

Also see libssh2/libssh2#536 confirming libssh2 didn't add support for SHA2 with RSA until 1.11.0

[eoli3n]

please reopen

[robertcheramy]

Reopening this bug as a request from @eoli3n . This seems an upstream problem from libssh2, so I'm not sure what we could do here...

[YellowJacket51]

Still having issues with this.

[eoli3n]

workaround:

hooks:
  push_to_remote:
    events: [post_store]
    #type: githubrepo
    #remote_repo: [email protected]:username/oxidized-configs.git
    #publickey: /opt/oxidized/.ssh/id_rsa.pub
    #privatekey: /opt/oxidized/.ssh/id_rsa
    type: exec
    cmd: 'git --git-dir /opt/oxidized/oxidized.git remote add origin [email protected]:username/oxidized-configs.git; git --git-dir /opt/oxidized/oxidized.git push origin master --force'

[rkerr]

For people using the docker version of gitlab it's also possible to re-enable SHA1 on the gitlab end by setting GITLAB_ALLOW_SHA1_RSA=true for now:

https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7035

However this option will be removed in gitlab 17, so it would be better to migrate away from RSA keys and start using ED25519 ones that don't have this issue.