Github Actions: xcodebuild fails due to server fingerprint

Question

I am trying to build a macOS app with Github Actions. This already worked very well, until I migrated my dependencies to Swift Package Manager. Now I am getting the following error while building my app:

xcodebuild: error: Could not resolve package dependencies: The server SSH fingerprint failed to verify.

I have a private GitHub repository as a dependeny in my application added as a Swift Package using a ssh location. Therefore I need to add my ssh key for the dependency in the Set up ssh-agent step. Manually cloning the repository in a step using git clone is working fine but I need to get it work with xcodebuild in order to successfully build my app.

Workflow file

name: Main
on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  build:
    name: Release
    runs-on: macOS-latest
    steps:
      - name: Checkout
        uses: actions/checkout@master
        with:
          fetch-depth: 1
      - name: Set up ssh-agent
        uses: yakuhzi/action-ssh-agent@v1
        with:
          public: ${{ secrets.SSH_PUBLIC_KEY }}
          private: ${{ secrets.SSH_PRIVATE_KEY }}
      - name: Build application
        run: |
          sudo xcode-select -switch /Applications/Xcode_11.app
          xcodebuild -project Application.xcodeproj -scheme Application -configuration Release -derivedDataPath $HOME/Application build

The server SSH fingerprint isn't your SSH key, it's the fingerprint in your `.ssh/known_hosts` file. You need to add a step that registers the right fingerprint in `known_hosts`, and perhaps store the correct fingerprint as a file in your repo. (Or a repo secret if you want, but it doesn't have to be a secret since it's a public key fingerprint). I don't know the syntax off the top of my head, but I'll look it up and write up an answer if nobody else beats me to it. — rmunn, Sep 27 '19 at 01:59
The `Set up ssh-agent` step that I wrote to add my ssh keys also adds the fingerprint of github.com to the known_hosts, but this doesn't seem to help. — Yakuhzi, Sep 27 '19 at 10:47
Hmmm. Looking at the source code for your `yakuhzi/action-ssh-agent` repo, it all *looks* right to me... I'm stumped, sorry. — rmunn, Sep 27 '19 at 16:02
same problem on the azure CI, but don't really know how to implement the solution in the yaml file — itMaxence, Feb 02 '21 at 18:52

score 23 · Accepted Answer · answered Oct 01 '19 at 13:38

23

Finally I figured it out. It seems like its a known issue in Xcode 11 (https://developer.apple.com/documentation/xcode_release_notes/xcode_11_release_notes).

Thanks to Dosium in this post (https://discuss.bitrise.io/t/xcode-11-resolving-packages-fails-with-ssh-fingerprint/10388), I was able to get it work.

The solution is to run the following command before running xcodebuild: for ip in $(dig @8.8.8.8 github.com +short); do ssh-keyscan github.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts

answered Oct 01 '19 at 13:38

Yakuhzi

969
6
20

This worked for me on bitbucket.org as well. Was trying a shorter version of this step and it did not work, so my suggestion for others who are running into this, is to use this! – Procrastin8 Dec 21 '19 at 10:07
1

@yakuhzi Can you please share your workflow file after adding this command. Thanks – Abin Baby Feb 13 '20 at 14:02
3

I can't figure out why this doesn't work for me, can you post the yml file or run phase? – SRMR Mar 31 '20 at 13:40
3

We had this issue on CircleCI after upgrading to Xcode 12, and this solution worked for us. – vicegax Sep 24 '20 at 07:50
1

Seriously, shame on Apple, Xcode 12.1 is out problem is still persisting. Basically Xcode Server can NOT connect properly to private git libraries. one sentence explanation of all this problem! – Trevor Oct 29 '20 at 21:15
For some strange reason didn't worked with `SpriteKit-Spring` module. I have no idea why, ended up using another solution. – kelin Sep 01 '21 at 18:47

score 5 · Answer 2 · answered Jun 10 '20 at 05:21

5

TS asked for a problem with dependency on private repository, but just in case there're some people who ran into this problem for a public repository dependency, make sure that you're using HTTPS instead of SSH for that dependency repository address.

Example:

https://github.com/Alamofire/Alamofire.git

instead of

git@github.com:Alamofire/Alamofire.git

answered Jun 10 '20 at 05:21

Muhammad Yusuf

396
3
14

1

This was the solution for me running into the abovementioned error, `xcodebuild: error: Could not resolve package dependencies: The server SSH fingerprint failed to verify.`, when running a build pipeline in Azure DevOps. Thanks! – Kent Robin Feb 12 '21 at 12:29
1

This simplest solution also worked for me, because the package was lightweight. Note: the `HTTPS` repo URL may not work for big projects, in that case you have to use `SSH`. – kelin Sep 01 '21 at 18:46

score 5 · Answer 3 · answered Jan 06 '21 at 17:17

For CircleCI:

Adding onto Yakuhzi's answer, here's what the step looks like in Circle Ci's yaml file:

- run:
    name: Enable SSH
    command: |
       for ip in $(dig @8.8.8.8 github.com +short); do ssh-keyscan github.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts

Tycho Pandelaar · Answer 4 · 2020-03-29T16:53:17.540

3

Open the project on the machine that does the building. Go to the Workspace logs. Double click on the red log entry that says the package failed to validate. Now you get a window that asks you to trust the host. Trust it, and you're good to go.

Edit: I was wrong. While it does trust the host and you can open & run the project on the CI machine, the CI process still fails...

edited Mar 29 '20 at 16:53

answered Mar 27 '20 at 13:11

Tycho Pandelaar

7,367
8
44
70

Because the build machines are hosted by GitHub, I don't have direct access to the machine. But the issue is already resolved as you can see in my accepted answer. – Yakuhzi Mar 28 '20 at 15:16
Well, tuns out my solution doesn't help the CI process. I've updated the answer to reflect that... – Tycho Pandelaar Mar 29 '20 at 16:54
1

this helped me when I had this issue with local builds – Jason Mar 01 '21 at 20:22
1

I wish I had seen this yesterday! For local builds this is the best solution! – choli Mar 04 '21 at 09:16

score 1 · Answer 5 · answered Apr 03 '21 at 01:29

If you're looking for something specific to GitHub actions, I updated the answer by @rob-caraway to match GitHub's syntax. I found the following step, inserted before attempting to build works for me:

    - name: Trust the GitHub SSH keys
      run: |
        for ip in $(dig @8.8.8.8 github.com +short); do ssh-keyscan github.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts

score 1 · Answer 6 · answered Nov 17 '21 at 09:01

1

In Xcode 13 it is easy - you simply click on the error and an alert appears asking do you trust the server

answered Nov 17 '21 at 09:01

Konrad Leszczyński

150
5

Thanks for this! I was also able to resolve this way in Xcode 12.5.1. – Harry Bloom Nov 28 '21 at 12:31

score 0 · Answer 7 · edited Dec 23 '20 at 02:46

try adding a Github Token as secret and use it in the checkout step:

build:
    runs-on: macOS-latest
    steps:
    - uses: actions/checkout@v2.3.3
      with: 
        token:  ${{ secrets.YOUR_CI_ACCOUNT_TOKEN }}

or add your SSH private key as secret and use it:

build:
    runs-on: macOS-latest
    steps:
    - uses: actions/checkout@v2.3.3
      with: 
        ssh-key:  ${{ secrets.YOUR_CI_ACCOUNT_SSH_KEY }}

Github Actions: xcodebuild fails due to server fingerprint

Workflow file

7 Answers7

Example:

Linked