Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 654406 - Sci overlay access for chymera
Summary: Sci overlay access for chymera
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Git (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Infrastructure
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-30 09:37 UTC by David Seifert
Modified: 2018-05-23 06:12 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
SSH key (id_rsa.pub,401 bytes, application/vnd.ms-publisher)
2018-05-11 22:34 UTC, Horea Christian
Details

Note You need to log in before you can comment on or make changes to this bug.
Description David Seifert gentoo-dev 2018-04-30 09:37:26 UTC
Christian Horea would like to make the sci overlay more interesting for neuroscientists. I hereby ask Infra to give him access to our Gentoo sci overlay.

Reproducible: Always
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-04-30 19:13:40 UTC
I don't seem to be able to find his key in gitolite-admin, so public SSH key, plz.
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-04-30 20:40:02 UTC
Ok, all should be set now.  Please test and close the bug if it works.
Comment 3 Horea Christian 2018-05-06 12:15:04 UTC
It didn't work, I have a number of machines, so I might not have been on the correct one for the public SSH key to work. Could you please enable the PGP key (the same I used to sign the quizzes) instead?

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFYK4LUBCADGk7dnLs0Kpleq+x8YlBl8r2tePbwE0/CAsrmB+6eaNoz8hiFT
BgR9SJJ83wauCjthNOvNQ30JnPK4khPhBNvrr/4vldbks4gPf1IYui4eUGVhBcg3
qklMG6RNfMpxFXJMvkG1Chjj8HVKZY0dxLCYBd/qqByrohqWY4DRdOZy6E3MUDmy
30QAstuP5C04SP19wvLj98NJs5TB3nX+63w4Xryh56JdjOkWdlYHBvmgojs1pmV6
04cFhnXcNY6gMLKQrCPO/+cVMUkaJLXaucekDo7wSTJrhlUxR9WqEU3eCGGQ8Zzb
EgDnQyuVvWZzgrkcfExo/L39nuXPATK8u3NVABEBAAG0H0hvcmVhIENocmlzdGlh
biA8aC5jaHJAbWFpbC5ydT6JATcEEwEIACEFAlYK4LUCGwMFCwkIBwIGFQgJCgsC
BBYCAwECHgECF4AACgkQ6qkiPuO7N4rBygf/WcaSAIC4UrJqwzHque3lsz4EJScz
LeQZU8js4CeIl8Fndtu1Mzles7e8PMG5MU+1W/mXmaFMCi61/aCbM3he41tnOYGY
Io8Zhc7u6BmoEEa0xBHpPRrThwW92gNRtYuBWVNd6LF1nAZwe32T72oJhcgENu3U
gn0eBEhABbHGGNSEtPfWHwO9iN8Z7YcHbFE2BBSCT/HnsGZm1sKKFbIGiI54oVpr
WprnXPlL5zz0mS9xVBRtmmubwAoEoIqhPzc2G3efdm67oh6fohAfFe/WlMS/wy4w
djERZEUpvUoocaJv+o7Z3tladERl5djqg6Ug2JvjDzim0LNsEZP9vtD4b7QpSG9y
ZWEgQ2hyaXN0aWFuIDxob3JlYS5jaHJpc3RAeWFuZGV4LmNvbT6JATcEEwEIACEF
AlbJPJwCGwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQ6qkiPuO7N4oyowgA
nEd9y+FTzMC81ExQ0wIgoSmxTiryauw0YVG/GMvlsukH68u7GRHl9rq8tzRLlLsd
RzKYPzS16KgHxJF2zVpUQn+ZuttnAvd1nyPzv0CYvyNQpBbb/0mR+kFahfDqoNI6
shBrI5W8afjhx3xKUJMuvQD9wpP9k1oLEi7yB2a26AFfV9WE4z+UpvQjnvXhOD5Y
rGKcNfSzuxjkJPEb4SXiG8w4BU/41lAfv2wGsTjEpW3cpKRfNLTEVW2fFHXkqQmw
XGJlcD9maNbtPkfEP1S1Q3vgHM+CBDoMFxaOKK0ak/egjACZmGLoqEk8NPdj8Nyw
6GhZEYjAhPJLrHXhPO8RKLkBDQRWCuC1AQgAziW1HtwnDvMTsPuY6j6Cd/yHYUMY
Q6fSDOEsaVuH5dHqj5WBJeYeXJ+MCxGtpOLPqezETo5ZPw9Itez+b9ZjUnpDWU53
DAghcSDZBLX1OtmYvP7sKDH4Dd2BhZpnGyWX/2PXt7JBBeFGpcAu35t/y+RmknTv
AdO0xbkjE2ndHYF8h0ShSOl/TtfoWcm5HN2DHMvXknfU5GInGrIP/BuNINwFZep7
2JP+ozjqseSdlX6Mh41GVZtoWze3oa9wqnTxE9NgcKd2ZMPsdmH6bpczpp0QqFam
MXPaDXi7nOt5GJZubvOlR98urk9clf9eC3w4oWFt5p60aKWPodJAjcBfHQARAQAB
iQEfBBgBCAAJBQJWCuC1AhsMAAoJEOqpIj7juzeK3BAH/1T5Tu5r9GFMzqV04xA0
rOvvTvlK1AkXTsQRGVgWrEGr//juUulppY1UBf92M2ST8hz3sbWc546UMdZLykdD
mk6acVo5Bg/8MfvM7o4ENe3ywIiFR6S297DDcqfkp7u0A11ewk6JzOpEJz/Flpx8
+nThB+83hYODwBhS3FB4/JsCliK3+zxmU4Yd6JTJPNCf65A/ZweruUcRkPTZ8CMZ
YQ2TkM7DvZYCHWD/Tg9RY1ESf0wmNJUCLljGcuJbbIm47BA3VOapVbLRqiu0tIu7
AQzlC1ipjh9l2SLk5w/mKnLSPY1g8Bj5FeVmichmxrm4SPAdZnBfpDQava3Gv6Ws
UQE=
=IdC6
-----END PGP PUBLIC KEY BLOCK-----
Comment 4 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-06 19:37:40 UTC
Does it fail at SSH authentication or does it reject your signed push?
Comment 5 Horea Christian 2018-05-06 21:28:30 UTC
It rejects my signed push:

chymera@quiethost ~/src/sci/dev-python/pynrrd $ git push -u origin master 
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)
Counting objects: 7, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (7/7), 1.90 KiB | 1.90 MiB/s, done.
Total 7 (delta 2), reused 0 (delta 0)
remote: Unknown GIT_PUSH_CERT_STATUS
remote: Your push was not signed with a known key.
remote: You MUST use git push --signed with a known key.
remote: If you just updated your key, please wait 15 minutes for sync.
remote: git-receive-pack variables:
remote: GIT_PUSH_CERT=''
remote: GIT_PUSH_CERT_KEY=''
remote: GIT_PUSH_CERT_NONCE=''
remote: GIT_PUSH_CERT_NONCE_SLOP=''
remote: GIT_PUSH_CERT_NONCE_STATUS=''
remote: GIT_PUSH_CERT_SIGNER=''
remote: GIT_PUSH_CERT_STATUS=''
To git+ssh://git.gentoo.org/proj/sci.git
 ! [remote rejected]     master -> master (pre-receive hook declined)
error: failed to push some refs to 'git+ssh://git@git.gentoo.org/proj/sci.git'
chymera@quiethost ~/src/sci/dev-python/pynrrd $ git push --signed -u origin master 
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)
Counting objects: 7, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (7/7), 1.90 KiB | 1.90 MiB/s, done.
Total 7 (delta 2), reused 0 (delta 0)
remote: Unknown GIT_PUSH_CERT_STATUS
remote: Your push was not signed with a known key.
remote: You MUST use git push --signed with a known key.
remote: If you just updated your key, please wait 15 minutes for sync.
remote: git-receive-pack variables:
remote: GIT_PUSH_CERT='44601477849d6a5ff9473f9a4e8d70f714af1b30'
remote: GIT_PUSH_CERT_KEY='EAA9223EE3BB378A'
remote: GIT_PUSH_CERT_NONCE='1525642058-b22ac16b00e5fbb4cf33'
remote: GIT_PUSH_CERT_NONCE_SLOP=''
remote: GIT_PUSH_CERT_NONCE_STATUS='OK'
remote: GIT_PUSH_CERT_SIGNER=''
remote: GIT_PUSH_CERT_STATUS='E'
remote: A push-cert was found, and follows:
remote: =====
remote: certificate version 0.1
remote: pusher Horea Christian <horea.christ@yandex.com> 1525642058 +0200
remote: pushee git+ssh://git.gentoo.org/proj/sci.git
remote: nonce 1525642058-b22ac16b00e5fbb4cf33
remote: 
remote: 367a3e9287d0c00636a4845a55fcf97af93026df 24eb5005be717cef4890e5d34fe101b8516bf6d8 refs/heads/master
remote: -----BEGIN PGP SIGNATURE-----
remote: 
remote: iQFLBAABCAA2FiEE6bBeJHjXuRTkCH7V6qkiPuO7N4oFAlrvc0oYHGhvcmVhLmNo
remote: cmlzdEB5YW5kZXguY29tAAoJEOqpIj7juzeK/usH+NtlS+I7tHKhGgn8xjEm6rEX
remote: JT2rcxMag1Ko5UkPPx0TaNa2v4FX7S5yUEIXHrRkjKbpztoq1VwByjhra/p0I6wx
remote: Eq4/ZzkUTPUAZzif0YpZT2ZVHRxZL79oQW6qK7PAlWXukthmAlwMUf4UAnHHHWCV
remote: xmfM6TnaK060nq8xeANMZvltE0dPxDIqPDzZIHO/lVErkJhLizWzuPu9KJ+qjCIG
remote: bpaisVU5FQhgxJsg/FqsZQT2txcK1SX6StU6m+ZU3O6ZBlK9oyG1stYkL3cnlaMQ
remote: ijiPLAbn1BQQvdvGbUZWTjLJODP8LfqWeNMhhNKCm9Yt/TMcm50m7R/4+1/ezQ==
remote: =NJo3
remote: -----END PGP SIGNATURE-----
remote: =====
To git+ssh://git.gentoo.org/proj/sci.git
 ! [remote rejected]     master -> master (pre-receive hook declined)
error: failed to push some refs to 'git+ssh://git@git.gentoo.org/proj/sci.git'
Comment 6 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-07 06:39:22 UTC
I've added your key fingerprint now.  I'm sorry but I don't know how frequently are those updated, so you may need to wait a few hours.
Comment 7 Horea Christian 2018-05-11 03:42:56 UTC
It still doesn't work:

chymera@quiethost ~/src/sci/dev-python/pynrrd $ git push --signed -u origin master 
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)
Counting objects: 7, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (7/7), 1.50 KiB | 1.50 MiB/s, done.
Total 7 (delta 2), reused 0 (delta 0)
remote: Unknown GIT_PUSH_CERT_STATUS
remote: Your push was not signed with a known key.
remote: You MUST use git push --signed with a known key.
remote: If you just updated your key, please wait 15 minutes for sync.
remote: git-receive-pack variables:
remote: GIT_PUSH_CERT='fe1cdcb1b10ea71d3b9e100a5b0fd294b0f62b72'
remote: GIT_PUSH_CERT_KEY='EAA9223EE3BB378A'
remote: GIT_PUSH_CERT_NONCE='1526010128-e6ffbfd506a47b87955a'
remote: GIT_PUSH_CERT_NONCE_SLOP=''
remote: GIT_PUSH_CERT_NONCE_STATUS='OK'
remote: GIT_PUSH_CERT_SIGNER=''
remote: GIT_PUSH_CERT_STATUS='E'
remote: A push-cert was found, and follows:
remote: =====
remote: certificate version 0.1
remote: pusher Horea Christian <horea.christ@yandex.com> 1526010128 +0200
remote: pushee git+ssh://git.gentoo.org/proj/sci.git
remote: nonce 1526010128-e6ffbfd506a47b87955a
remote: 
remote: 2ae549fb69309b8ab8537b3e9a8ea158d375cf1d 3192a56cfd864af4ba098c54bf5b8729fbd768e2 refs/heads/master
remote: -----BEGIN PGP SIGNATURE-----
remote: 
remote: iQFMBAABCAA2FiEE6bBeJHjXuRTkCH7V6qkiPuO7N4oFAlr1ERAYHGhvcmVhLmNo
remote: cmlzdEB5YW5kZXguY29tAAoJEOqpIj7juzeKuD8H/j0zNd7zc7mu6fb72B4n/ezi
remote: Zm8+arkmPp8hizd14gxeD6P1AwwgT/jy9xE3L2zaHC0yyEAXq3I4eSIZ2UYlZOO/
remote: bdZZOEcp6a3e6rW37gKObovw899kMVFu48wItUI/iGpapYcT6qMb28JlV5sz9SWh
remote: rp5fCWfryfnoNI0jC+rHGnQzJQn9pW8hllx/G27Ose5n5+VySjXJKWD//DfxxX2T
remote: 7R8SYUjAp/jEi3QsK2lOJ0sNeYogrgYLgdFln2YCgC2x/1+/umHDIXsOfT5NXkgb
remote: R6WeXUWnyc46PBLLnh9R3R8B6frJvgjQB7OMyuDFQ1gOsQmLY5ajpU1jSeO3rlw=
remote: =EgBN
remote: -----END PGP SIGNATURE-----
remote: =====
To git+ssh://git.gentoo.org/proj/sci.git
 ! [remote rejected]     master -> master (pre-receive hook declined)
error: failed to push some refs to 'git+ssh://git@git.gentoo.org/proj/sci.git'
chymera@quiethost ~/src/sci/dev-python/pynrrd $ git push -u origin master 
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)
Counting objects: 7, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (7/7), 1.50 KiB | 1.50 MiB/s, done.
Total 7 (delta 2), reused 0 (delta 0)
remote: Unknown GIT_PUSH_CERT_STATUS
remote: Your push was not signed with a known key.
remote: You MUST use git push --signed with a known key.
remote: If you just updated your key, please wait 15 minutes for sync.
remote: git-receive-pack variables:
remote: GIT_PUSH_CERT=''
remote: GIT_PUSH_CERT_KEY=''
remote: GIT_PUSH_CERT_NONCE=''
remote: GIT_PUSH_CERT_NONCE_SLOP=''
remote: GIT_PUSH_CERT_NONCE_STATUS=''
remote: GIT_PUSH_CERT_SIGNER=''
remote: GIT_PUSH_CERT_STATUS=''
To git+ssh://git.gentoo.org/proj/sci.git
 ! [remote rejected]     master -> master (pre-receive hook declined)
error: failed to push some refs to 'git+ssh://git@git.gentoo.org/proj/sci.git'
Comment 8 Horea Christian 2018-05-11 22:34:15 UTC
Created attachment 530958 [details]
SSH key
Comment 9 Horea Christian 2018-05-11 22:34:52 UTC
Additionally, I can't seem to even clone the repository from my laptop (which I use for development just as often as my other machine):

```
chymera@zenbookhost ~/src $ git clone git+ssh://git@git.gentoo.org/proj/sci.gi
Cloning into 'sci.gi'...
git@git.gentoo.org: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
```

I assume this is because it has a different SSH key (attached). Could you add that as well? the PGP key is the same across both machines.
Comment 10 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-12 06:24:25 UTC
The extra key added.
Comment 11 Horea Christian 2018-05-12 15:30:54 UTC
I still can't clone from my laptop (albeit the error message has changes somewhat):

```
chymera@zenbookhost ~/src $ git clone git+ssh://git@git.gentoo.org/proj/sci.gi
Cloning into 'sci.gi'...
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)

FATAL -- ACCESS DENIED
Repo            proj/sci.gi                                                 
User            horea.christ@gmail.com                                      
Stage           Before git was called                                       
Operation       Repo read                                                   

FATAL: R any proj/sci.gi horea.christ@gmail.com DENIED by fallthru
(or you mis-spelled the reponame)
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
```

Also, push still won't work from my other machine (same error message as before).
Comment 12 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-12 15:41:43 UTC
(In reply to Horea Christian from comment #11)
> Repo            proj/sci.gi                                                 
[...]
> (or you mis-spelled the reponame)
Comment 13 Horea Christian 2018-05-12 16:01:22 UTC
Ok, that was silly. Pulling now works in all scenarios, but what about pushing?
Comment 14 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-12 17:56:56 UTC
Moving out of incorrect component.
Comment 15 Matthias Maier gentoo-dev 2018-05-18 02:45:16 UTC
Dear Infra, could you please help resolving this issue?
Horea is still not able to push to the overlay. And it pretty much looks like that the GPG fingerprint hasn't propagated.



chymera@quiethost ~/src/sci $ git push --signed -u origin master
warning: agent returned different signature type ssh-rsa (expected rsa-sha2-512)
Counting objects: 7, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (7/7), 1.50 KiB | 1.50 MiB/s, done.
Total 7 (delta 2), reused 0 (delta 0)
remote: Unknown GIT_PUSH_CERT_STATUS
remote: Your push was not signed with a known key.
remote: You MUST use git push --signed with a known key.
remote: If you just updated your key, please wait 15 minutes for sync.
remote: git-receive-pack variables:
remote: GIT_PUSH_CERT='d537a67e2ce6742fe437afa6adbedee7697d6f94'
remote: GIT_PUSH_CERT_KEY='EAA9223EE3BB378A'
remote: GIT_PUSH_CERT_NONCE='1526597044-f78f47789ea2c19c2ce8'
remote: GIT_PUSH_CERT_NONCE_SLOP=''
remote: GIT_PUSH_CERT_NONCE_STATUS='OK'
remote: GIT_PUSH_CERT_SIGNER=''
remote: GIT_PUSH_CERT_STATUS='E'
remote: A push-cert was found, and follows:
remote: =====
remote: certificate version 0.1
remote: pusher E9B05E2478D7B914E4087ED5EAA9223EE3BB378A 1526597044 +0200
remote: pushee git+ssh://git.gentoo.org/proj/sci.git
remote: nonce 1526597044-f78f47789ea2c19c2ce8
remote: 
remote: 5ef25a48bee2090fbcd6a9e92d4a8299c88edc67 81e64e39ac7e11adfacac4013c5a8781a258f5ed refs/heads/master
remote: -----BEGIN PGP SIGNATURE-----
remote: 
remote: iQEzBAABCAAdFiEE6bBeJHjXuRTkCH7V6qkiPuO7N4oFAlr+BbQACgkQ6qkiPuO7
remote: N4q58ggAiaD6hIGs0MtG53sRr2l0wJTr3zB70HrQmi64Zm3b2K+C9EyD96UnaTT2
remote: UM8YFe+aLbY34em8cO2im1DFAF0R3DgM5IpCjdw/v4wb15MTJnlwECbBNR06dyxy
remote: lT04QFvUO9fv9NAZXed8diidfhQCDi1FSWRReYMaJFljThG2+sHCJpweM5VKoRxH
remote: RW4+f0jcbID4rncKYfpipbH/6vfPteiaM6paj3dzUAL1f6jy6xz/xn9SAfrSo1Cb
remote: 53UU9qsfQ4qaQ8gRBNyxjzzGD8xZ3iZV2u43i2FmKoMWcJzuj1ion6NSdE+XH2eu
remote: IH4krotG2uR+o+t6eQIbD7+Go9V1iQ==
remote: =hHqz
remote: -----END PGP SIGNATURE-----
remote: =====
To git+ssh://git.gentoo.org/proj/sci.git
 ! [remote rejected]     master -> master (pre-receive hook declined)
error: failed to push some refs to 'git+ssh://git@git.gentoo.org/proj/sci.git'
Comment 16 Horea Christian 2018-05-23 00:07:46 UTC
Many thanks everybody, it works now. I'd close it myself, but it seems I don't have permission.
Comment 17 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-23 06:12:34 UTC
Thanks for the confirmation.;