git clone works; git submodule fails "Permission denied"

Question

On a private repository from gitlab, when I run git clone [email protected]:group/project-submodule.git the clone completes successfully.
As part of the cloning process, I'm asked for the passphrase of my private key.

When I run submodule update --init "group/project-submodule"
It fails with:

Permission denied, please try again. Permission denied, please try again. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). fatal: Could not read from remote repository.

While trying to process the submodule getting, I'm not asked for the passphrase for my private key.

(I had to anonymize it)

fatal: clone of '[email protected]:group/project-submodule.git' into submodule path 'C:/Users/user/repos/project-module/project-submodule' failed

I've checked the .gitmodules file and it contains the right data (I think it can be confirmed by the error message).

The main element that calls my attention is that I'm not asked for my private key passphrase. Even weirder because, when I use git clone directly, it runs as expected.

I also already diagnosed by accessing with ssh and it asks me for the passphrase just like it happens when I execute a pull or a clone

Using git for windows "git version 2.16.2.windows.1"

Solution 1

Git tries to clone the submodule using ssh and not https. If you haven't configured your ssh key this will fail.
You can setup ssh-agent to cache the password for the ssh key and get git to use that. Or change to https.
Git is a bit confusing regarding submodules. They are configured in the .gitmodules file in the directory, but changing the url here from ssh to https won't help. Git uses the url that is configured in .git/config.
Open this file and you will find something like this.

[submodule "project-submodule"]
    url = [email protected]:project-submodule.git

Change this url to the https equivalent and try again.

Solution 2

You can also just change your ssh key to one that does not need a passphrase. I had same issue and now git submodule update --init --recursive works fine after using no passphrase.

It seems to be a bug in Windows git that when it updates a submodule, it does not ask for the paraphrase key. (git version 2.19.1.windows.1)

Solution 3

The answer from lukas-reineke correctly describes the problem and a possible solution using ssh-agent to enable cloning of git submodules that are configured such that they should be cloned over ssh instead of https.

As an alternative to using ssh-agent you could use putty's pageant. That way you can configure the host where the git repository lies as saved session in putty, and then clone the submodule with:

set GIT_SSH=plink & git submodule update

Of course you have to make sure that plink.exe can actually be found in your %PATH%, and that you have added your private key to the running pageant instance (there should be a little systray icon that you can click to 'Add Keys').

Since ssh-agent can be a little tricky to get running correctly from the native cmd.exe of windows, I found this alternative method quite helpful.

Solution 4

I was also facing same issue. While downloading submodules, GIT doesn't ask for ssh key password and that's where problem is.

Creating new ssh key without passphrase worked for me.

Solution 5

The problem seems to be OpenSSH 3.8 throws up a dialog box that isn't accessible from win32?

If you switch to Git Bash (installed by default with git), then the dialog box pops up and you can enter your private key passcode.

As others have pointed out, the alternative is to use putty and set up plink to work with ssh. I usually use that method and it works flawlessly with pageant. The tricky part is setting up plink: https://makandracards.com/makandra/1303-how-to-use-git-on-windows-with-putty

*Update: I tried putty/pageant and couldn't make it work. The options passed by the jenkins git addon aren't compatible with pageant.

Finding the dialog box doesn't help with my Jenkins setup though...

View more solutions

Comments

[brunoais]

Using HTTPS with password worked as I wanted because such feature is enabled in this server. Is there any alternatives when such feature is not enabled?

[lukas-reineke]

I don't use windows, so I can't try, but this looks like what you want for ssh. github.com/ericblade/ssh-agent-cmd

[brunoais]

That's for use for someone who doesn't want to write the passphrase multiple times. Thanks anyway.

[pacoverflow]

Thanks. To change to the HTTPS equivalent, I changed [email protected]:username/repository.git to https://git.mydomain.com/username/repository.git as described here.

[Broper]

Nice! I was definitely trying to update the .gitmodules file. In my case, I did not have a missing "https" in my path, but did need to include "mygitusername@" into the path to authenticate myself for cloning the submodule (in the end: https://user@whatever/repo.git). Lastly, a git submodule update at the project directory successfully cloned my submodule.

[Jean-David Lanz]

I've tried it to no avail. Here's how I modified the submodule entry in .git/config : [submodule "SubModuleName"] url = https://[email protected]/in/project_submodule‌​name.git However, Git doggedly denies permission (with "[email protected]" instead of yours_truly). Did I forget or mistype something?

[brunoais]

I no longer use Windows so I can't confirm what you answer.

[Dinsdale]

Ya, I bailed out and installed Jenkins on Ubuntu. The project built on my first attempt. :-/