Error: invalid or unknown remote ssh hostkey (when using /etc/ssh/ssh_known_hosts)

[bbigras]

Description

I have some keys in /etc/ssh/ssh_known_hosts so they never end up in rm ~/.ssh/known_hosts.

jj (or libssh2) doesn't seem to support /etc/ssh/ssh_known_hosts.

/etc/ssh/ssh_known_hosts

git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf

Steps to Reproduce the Problem

1. create /etc/ssh/ssh_known_hosts with the gitlab key
2. rm ~/.ssh/known_hosts
3. jj git clone --colocate git@gitlab.com:bbigras/my-repo.git
4. ssh -F /dev/null git@gitlab.com
5. jj git clone --colocate git@gitlab.com:bbigras/my-repo.git

Expected Behavior

Actual Behavior

❯ jj git clone --colocate git@gitlab.com:bbigras/my-repo.git
Fetching into new repo in "/home/bbigras/tmp/my-repo"
Error: invalid or unknown remote ssh hostkey; class=Ssh (23); code=Certificate (-17)
Hint: Jujutsu uses libssh2, which doesn't respect ~/.ssh/config. Does `ssh -F /dev/null` to the host work?

~/tmp on ☁️   (ca-central-1)
❯ ssh -F /dev/null git@gitlab.com
PTY allocation request failed on channel 0
Welcome to GitLab, @bbigras!
Connection to gitlab.com closed.

~/tmp on ☁️   (ca-central-1)
❯ jj git clone --colocate git@gitlab.com:bbigras/my-repo.git
Fetching into new repo in "/home/bbigras/tmp/my-repo"
Error: invalid or unknown remote ssh hostkey; class=Ssh (23); code=Certificate (-17)
Hint: Jujutsu uses libssh2, which doesn't respect ~/.ssh/config. Does `ssh -F /dev/null` to the host work?

Specifications

• Platform: nixos
• Version: jj 0.20.0

[bnjmnt4n]

It looks like libgit2's libssh integration only loads ~/.ssh/known_hosts and not any other files: https://github.com/libgit2/libgit2/blob/782e29c906f6e44b120843356f286b6a97d89f88/src/libgit2/transports/ssh_libssh2.c#L435.

This could probably be patched in libgit2. There's also an alternate PR #3191 which attempts to switch to OpenSSH instead of libssh2, which would likely fix this issue as well.