git clone works; git submodule fails "Permission denied"

Question

On a private repository from gitlab, when I run git clone [email protected]:group/project-submodule.git the clone completes successfully.
As part of the cloning process, I'm asked for the passphrase of my private key.

When I run submodule update --init "group/project-submodule"
It fails with:

Permission denied, please try again. Permission denied, please try again. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). fatal: Could not read from remote repository.

While trying to process the submodule getting, I'm not asked for the passphrase for my private key.

(I had to anonymize it)

fatal: clone of '[email protected]:group/project-submodule.git' into submodule path 'C:/Users/user/repos/project-module/project-submodule' failed

I've checked the .gitmodules file and it contains the right data (I think it can be confirmed by the error message).

The main element that calls my attention is that I'm not asked for my private key passphrase. Even weirder because, when I use git clone directly, it runs as expected.

I also already diagnosed by accessing with ssh and it asks me for the passphrase just like it happens when I execute a pull or a clone

Using git for windows "git version 2.16.2.windows.1"

Residue

Answer 1

Git tries to clone the submodule using ssh and not https. If you haven't configured your ssh key this will fail.
You can setup ssh-agent to cache the password for the ssh key and get git to use that. Or change to https.
Git is a bit confusing regarding submodules. They are configured in the .gitmodules file in the directory, but changing the url here from ssh to https won't help. Git uses the url that is configured in .git/config.
Open this file and you will find something like this.

[submodule "project-submodule"]
    url = [email protected]:project-submodule.git

Change this url to the https equivalent and try again.

Cetinje

Using HTTPS with password worked as I wanted because such feature is enabled in this server. Is there any alternatives when such feature is not enabled? – Residue

I don't use windows, so I can't try, but this looks like what you want for ssh. github.com/ericblade/ssh-agent-cmd – Cetinje

That's for use for someone who doesn't want to write the passphrase multiple times. Thanks anyway. – Residue

Thanks. To change to the HTTPS equivalent, I changed [email protected]:username/repository.git to https://git.mydomain.com/username/repository.git as described here. – Naca

Nice! I was definitely trying to update the .gitmodules file. In my case, I did not have a missing "https" in my path, but did need to include "mygitusername@" into the path to authenticate myself for cloning the submodule (in the end: https://user@whatever/repo.git). Lastly, a git submodule update at the project directory successfully cloned my submodule. – Crocoite

I've tried it to no avail. Here's how I modified the submodule entry in .git/config : [submodule "SubModuleName"] url = https://[email protected]/in/project_submodulename.git However, Git doggedly denies permission (with "[email protected]" instead of yours_truly). Did I forget or mistype something? – Us

Answer 2

You can also just change your ssh key to one that does not need a passphrase. I had same issue and now git submodule update --init --recursive works fine after using no passphrase.

It seems to be a bug in Windows git that when it updates a submodule, it does not ask for the paraphrase key. (git version 2.19.1.windows.1)

Selffulfillment

Same issue with 2.19.2 - did you try to report bug somehow? – Josephinajosephine

Answer 3

The problem seems to be OpenSSH 3.8 throws up a dialog box that isn't accessible from win32?

If you switch to Git Bash (installed by default with git), then the dialog box pops up and you can enter your private key passcode.

As others have pointed out, the alternative is to use putty and set up plink to work with ssh. I usually use that method and it works flawlessly with pageant. The tricky part is setting up plink: https://makandracards.com/makandra/1303-how-to-use-git-on-windows-with-putty

*Update: I tried putty/pageant and couldn't make it work. The options passed by the jenkins git addon aren't compatible with pageant.

Finding the dialog box doesn't help with my Jenkins setup though...

Zoellick

I no longer use Windows so I can't confirm what you answer. – Residue

Ya, I bailed out and installed Jenkins on Ubuntu. The project built on my first attempt. :-/ – Zoellick

Answer 4

I was also facing same issue. While downloading submodules, GIT doesn't ask for ssh key password and that's where problem is.

Creating new ssh key without passphrase worked for me.

Hallowed

Answer 5

The answer from lukas-reineke correctly describes the problem and a possible solution using ssh-agent to enable cloning of git submodules that are configured such that they should be cloned over ssh instead of https.

As an alternative to using ssh-agent you could use putty's pageant. That way you can configure the host where the git repository lies as saved session in putty, and then clone the submodule with:

set GIT_SSH=plink & git submodule update

Of course you have to make sure that plink.exe can actually be found in your %PATH%, and that you have added your private key to the running pageant instance (there should be a little systray icon that you can click to 'Add Keys').

Since ssh-agent can be a little tricky to get running correctly from the native cmd.exe of windows, I found this alternative method quite helpful.

Lamellar

This seems to be the correct solution when using putty on Windows and git on the default command line. Switching to https is a bad workaround... – Hirsch

Answer 6

I ran into the same error message but it had a different reason/solution:

TLDR

I need to run export GIT_SSH_COMMAND='ssh -i ~/.ssh/some_ssh_id' before the submodule command.

Details

My repository uses a custom ssh-file, i.e. I have one personal key (.ssh/id_rsa) and a company specific git-only key (.ssh/company_git_id). Git defaults to using the id_rsa key, which has no access to the git repository.

The following adjustments make git work with the company-specific git key:

# Sets the SSH key of the repository to `company_git_id`:
git config core.sshCommand 'ssh -i ~/.ssh/company_git_id'
git fetch # works!

# The config.sshCommand does not work for submodules. Use this instead:
export GIT_SSH_COMMAND='ssh -i ~/.ssh/company_git_id'
git submodule update --rebase --remote my_module_dir # works!

Note that this changes the GIT_SSH_COMMAND for all following commands you run.

To void this environment change, you can run the submodule requests inside a sub-shell, like this here:

(export GIT_SSH_COMMAND='ssh -i ~/.ssh/company_git_id' && git submodule update --rebase --remote my_module_dir)

or for shells such as Bash and zsh, no need for a subshell

GIT_SSH_COMMAND='ssh -i ~/.ssh/company_git_id' git submodule update --rebase --remote my_module_dir

Nestling

Answer 7

if git doesn't ask you to enter your ssh password, add your ssh key to ssh-agent by default it will configure for you. To do this type following command into your terminal, I used Git Bash, probably other this can work in other terminals

ssh-add ~/.ssh/id_rsa

Culdesac