Bug 2175969

Summary:	gh codespace ssh fails to connect
Product:	[Fedora] Fedora	Reporter:	Trevor Benson <trevor.benson>
Component:	gh	Assignee:	Mikel Olasagasti Uranga <mikel>
Status:	CLOSED ERRATA	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	37	CC:	go-sig, maxwell, mikel, trevor.benson
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	gh-2.25.1-2.fc39 gh-2.27.0-1.fc38 gh-2.27.0-1.fc37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-03 21:34:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2183701
Bug Blocks:

Description Trevor Benson 2023-03-07 01:09:51 UTC

Description of problem:
When using `gh codespace ssh` the client fails to connect and receives the following error message:
```
failed to connect to Live Share: error connecting to ssh session: error creating ssh client connection: ssh: handshake failed: ssh: unknown key algorithm: rsa-sha2-512
```

Version-Release number of selected component (if applicable):

2.23.0-1.fc37.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Browse to a github.com repository
2. Click the green Code button and select Codespaces tab, create a new codespace
3. In codespaces create ~/.ssh/authorized_keys with correct permissions, insert an ed25519 public key.
4. Open Fedora37 terminal from a user with the ed25519 keys.
5. Execute `gh codespace ssh` and select the codespace.
6. Observe the error


Actual results:
RSA error is returned every time.

Expected results:
The gh client requests the passphrase for the ed25519 private key. When the correct passphrase is entered the connection is established to the codespace.

Additional info:
Removing the Fedora gh RPM and installing the same version of the gh client from GitHub releases at https://github.com/cli/cli fixes the issue. Instead of an error the client requests the passphrase for the id_ed25519 private key and connects to the codespace.

Upstream RPM that works:
`gh-2.23.0-1.x86_64`

Comment 1 Trevor Benson 2023-03-31 16:56:58 UTC

@mikel any updates? Patching F37 leads to reinstallation of the F37 RPM breaking the `gh codespace ssh` functionality. Requiring removing and reinstalling the upstream RPM multiple times when the functionality is relied upon.

Thanks

Comment 2 Maxwell G 2023-03-31 19:35:19 UTC

I think we'll need to package gh's fork of golang/x/crypto [1] and manually handle the replace directives [2] (see [3] for how this is done in aerc) to use that instead.


[1] https://github.com/cli/crypto
[2] https://github.com/cli/cli/blob/1fc98f6808728cb72bffb6642c81e47632b7cb54/go.mod#L87
[3] https://src.fedoraproject.org/rpms/aerc/blob/rawhide/f/aerc.spec#_58

Comment 3 Mikel Olasagasti Uranga 2023-03-31 21:32:46 UTC

Thanks for checking this Maxwell, I've been quite busy lately.

I'll work in a copr repo to generate the forked crypto library and test if gh works fine with it.

Comment 4 Mikel Olasagasti Uranga 2023-04-01 09:28:09 UTC

I've created a build for F37 in copr:

https://copr.fedorainfracloud.org/coprs/mikelo2/gh/

I'm able to connect to the codespace with this build:

> gh codespace ssh 
> ? Choose codespace: foo/bar (main): glowing goldfish
> Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-1105-azure x86_64)
> (...)

Trevor, can you confirm?

F38 is broken at the moment and packages can't be built.

The specs are available at:

https://github.com/mikelolasagasti/github-cli

There are many old specs used in the initial work to bring gh to Fedora.

Now, to have this in the official repos:

- Requires new package golang-github-cli-crypto, the forked crypto repo that implements RFC8332 by GitHub. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2183701
- https://src.fedoraproject.org/rpms/golang-github-cenkalti-backoff 4.2.0 in F37. I'll contact fab again about backporting this and about my related cleanup PR.

Comment 5 Trevor Benson 2023-04-03 14:28:28 UTC

(In reply to Mikel Olasagasti Uranga from comment #4)
> I've created a build for F37 in copr:
> 
> https://copr.fedorainfracloud.org/coprs/mikelo2/gh/
> 
> I'm able to connect to the codespace with this build:
> 
> > gh codespace ssh 
> > ? Choose codespace: foo/bar (main): glowing goldfish
> > Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-1105-azure x86_64)
> > (...)
> 
> Trevor, can you confirm?
> 
> F38 is broken at the moment and packages can't be built.
> 
> The specs are available at:
> 
> https://github.com/mikelolasagasti/github-cli
> 
> There are many old specs used in the initial work to bring gh to Fedora.
> 
> Now, to have this in the official repos:
> 
> - Requires new package golang-github-cli-crypto, the forked crypto repo that
> implements RFC8332 by GitHub.
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2183701
> - https://src.fedoraproject.org/rpms/golang-github-cenkalti-backoff 4.2.0 in
> F37. I'll contact fab again about backporting this and about my related
> cleanup PR.

Mikel,

  The copr repo RPM resolves the RSA error and establishes a connection to the codespace as expected.

Thanks

Comment 6 Fedora Update System 2023-04-03 21:31:28 UTC

FEDORA-2023-a7423af03f has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a7423af03f

Comment 7 Fedora Update System 2023-04-03 21:34:24 UTC

FEDORA-2023-a7423af03f has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Trevor Benson 2023-04-03 22:58:55 UTC

@mikel Did this issue get split into separate tickets? I noticed this one got closed with the mention of F39, but nothing about F37 or F38 (which I believe is only a couple of weeks out).

Thanks

Comment 9 Mikel Olasagasti Uranga 2023-04-04 08:54:05 UTC

This case has been automatically closed as a build for rawhide that has the fix has been built. As I reference the BZ in the changelog it gets automatically closed.

The fix is not part of F38 or F37 yet. I'm waiting the ACK from fab on backporting `golang-github-cenkalti-backoff` 4.2.0 required by latest `gh` version. I try to keep the branches equal to rawhide so I can backport commits between branches, that's why I'm waiting the `golang-github-cenkalti-backoff` backport.

I'll link the updates for F38 and F37 to this BZ and it should report updates about the status of those releases.

I could clone the BZ for each release as Red Hat does for this kind of situations, but I rather not because of the extra work. Sorry for the confusion.

Comment 10 Trevor Benson 2023-04-04 17:46:13 UTC

Great. Thank you for the quick response.

Comment 11 Fedora Update System 2023-04-11 18:27:24 UTC

FEDORA-2023-b3b4f45dcf has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-b3b4f45dcf

Comment 12 Fedora Update System 2023-04-11 18:28:19 UTC

FEDORA-2023-cb20f08a4e has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-cb20f08a4e

Comment 13 Fedora Update System 2023-04-11 22:15:07 UTC

FEDORA-2023-b3b4f45dcf has been pushed to the Fedora 38 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-b3b4f45dcf

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2023-04-12 02:43:02 UTC

FEDORA-2023-cb20f08a4e has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-cb20f08a4e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-cb20f08a4e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2023-04-19 01:38:56 UTC

FEDORA-2023-b3b4f45dcf has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2023-04-20 02:53:28 UTC

FEDORA-2023-cb20f08a4e has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.