1

ACTION: I have a git project on my work azure devops that I pull normally using ssh authentication. I tryed to run a pipeline on my work azure devops and work self-hosted windows computer from azure GUI to test CI features. It's a hello word project, just testing if everything is set-up correctly.

EXPECTED:

Seeing "Hello word" results from Azure Pipelines jobs terminal.

RESULT:

Pipeline use an automated script and run some git commands witch try to init and fetch a https project with wrong credentials and fails. Here's the log with some redacted info.

2020-09-21T20:35:25.0633203Z ##[command]git init "C:\agentW\_work\1\s"
2020-09-21T20:35:25.1242756Z Initialized empty Git repository in C:/agentW/_work/1/s/.git/
2020-09-21T20:35:25.1279844Z ##[command]git remote add origin https://********(REDACTED)
2020-09-21T20:35:25.1703998Z ##[command]git config gc.auto 0
2020-09-21T20:35:25.2109482Z ##[command]git config --get-all http.https://********(REDACTED).extraheader
2020-09-21T20:35:25.2498108Z ##[command]git config --get-all http.proxy
2020-09-21T20:35:25.2898438Z ##[command]git -c http.extraheader="AUTHORIZATION: bearer ***" fetch --force --tags --prune --progress --no-recurse-submodules origin
2020-09-21T20:35:25.5928108Z fatal: unable to access 'https:********(REDACTED)': SSL certificate problem: unable to get local issuer certificate

INFO:

  1. I tried going to C:\agentW_work\1\s and using git remote set-url origin ssh... as specified here : https://learn.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops and make a pull manually. it succeeded.

  2. I tried changing C:\agentW.credentials authorizationUrl and oauthEndpointUrl values to values given to me by our DevOps.

  3. I tried running another pipeline projects(from other personal azure repo, but same self-hosted computer) with a HTTP settings in configuration #2, it works. See below.

  4. I have acess to my C:\Users*****(REDACTED).ssh, if i need to paste my public ssh key somewhere.

Question:

  1. How do I change setting on the automated script to pull my ssh repo instead?
  2. How do I change my Https Git setting so that pulling the https project works too?

Configuration#1: Work Computer + Work Azure DevOps.

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
  branches: 
    include:
      - feature/azure-pipelines
pool:
  name: Default
  demands:
    - agent.name -equals WORK

steps:
- script: echo Hello, world!
  displayName: 'Run a one-line script'

- script: |
    echo Add other tasks to build, test, and deploy your project.
    echo See https://aka.ms/yaml
  displayName: 'Run a multi-line script'

Configuration#2: Work Computer + Personal Azure DevOps.

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
  branches: 
    include:
      - master
pool:
  name: Default
  demands:
    - agent.name -equals WORK

steps:
  - task: RunMATLABCommand@0
    inputs:
      command: runBatchT
  - task: RunMATLABTests@0
    inputs:
      testResultsJUnit: test-results/results.xml
      codeCoverageCobertura: code-coverage/coverage.xml
      sourceFolder: src;test
  - task: PublishTestResults@2
    condition: succeededOrFailed()
    inputs:
      testResultsFiles: test-results/results.xml
  - task: PublishCodeCoverageResults@1
    inputs:
      codeCoverageTool: Cobertura
      summaryFileLocation: code-coverage/coverage.xml

2
  • 1
    Dose this document help you? Commented Sep 22, 2020 at 11:06
  • It's instructive, but it has destructive steps so i can't use it. Using --mirror will overwrite all branches in the target repo which includes deleting any branches not in the source repo Commented Sep 22, 2020 at 11:30

1 Answer 1

1

It's a temporary fix, But I found that deleting my self hosted agent and creating a new one with sslcert skip worked.

.\config.cmd --sslskipcertvalidation 

It's going to influence the git script and modify this line to use the ssl skip paramter:

2020-09-22T12:34:55.3658192Z ##[command]git -c http.extraheader="AUTHORIZATION: bearer ***" -c http.sslVerify=false fetch --force --tags --prune --

Source:

  1. https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/certificate?view=azure-devops-2020

  2. https://confluence.atlassian.com/bitbucketserverkb/ssl-certificate-problem-unable-to-get-local-issuer-certificate-816521128.html

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.