4

I have two repositories hosted in Bitbucket - I have an access key setup that I can use to clone each project individually. Repository A has repository B as a submodule.

On Windows... after successfully cloning the repo A, git submodule update --init fails due to the following:

Cloning into 'C:/Path/to/submodules/B'...
git@bitbucket.org: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and that the repository exists.
fatal: clone of 'git@bitbucket.org:org/B.git' into submodule path 'C:/path/to/submodules/B' failed
Failed to clone 'submodules/B'. Retry scheduled

The .gitmodules setup is as the following

[submodule "submodules/B"]
    path = submodules/B
    url = git@bitbucket.org:org/B.git
...

If I take that URL as specified in the .gitmodules and clone that repository, it works perfectly fine git clone git@bitbucket.org:org/B.git

It seems like repositories that are trying to be cloned via git submodule update --init cannot see/use the ssh access key I have added.

Git Submodule - Permission Denied suggestions haven't worked

  • maybe the key needs to be refreshed? No, the key works perfectly fine for downloading all other repositories
  • maybe there is an issue with the key itself, try ssh -vT git@github.com After changing it to bitbucket.org it works perfectly fine, with successful authentication.
  • I didn't have this problem with http :/ - I didn't either and I hate ssh for this, but, alas it's required.

How can resolve this issue? Or what configuration am I missing?

I will be doing this in a development docker container environment so it needs to not preclude that.

This is not like the following problems:

Abdulrahman Hasanato
  • 447
  • 3
  • 9
hi im Bacon
  • 374
  • 1
  • 12
  • Consider using GIT_TRACE and/or whatever system tracing facilities you have, to see if for some reason the submodule clone is using a different ssh implementation than a manual `git clone`. That's the most likely culprit, I think: that you have two different `ssh` commands on your computer, one of which works here and one of which doesn't. – torek Oct 12 '22 at 23:46
  • Thanks for the suggestion - will try it today. I know that PowerShell has aliases things like curl so potentially two different SSH implementations are causing the issue. – hi im Bacon Oct 17 '22 at 09:01

3 Answers3

0

You need to make sure what key is actually used when cloning your repository.
If your access key is not your default key (default as in ~/.ssh/id_rsa for instance), then the URL of your subrepository needs to be reference that second key (the access key)

You can change the remote URL of a submodule:

git submodule set-url -- accessKey:me/mySubmoduleRepository

It will use a ~/.ssh/config file with:

Host accessKey
  hostname bitbucket.or
  User git
  IdentityFile ~/.ssh/myAccessKey

That way a git submodule update --init will use an SSH URL directly referencing your access key: the submodule should be cloned.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Yes, the key is the default and only key on my machine, I am not doing anything special when I clone repo A, it correctly fetches the key from the "~/.ssh/id_rsa". that is a good suggestion but won't it mean that colleagues would need to configure their ssh in the same way? Otherwise, they would have their own permissions issues trying to find a key unspecified. – hi im Bacon Oct 17 '22 at 08:58
  • @hiimBacon If a direct `git clone git@bitbucket.org:org/B.git` is working, then you do not need a `~/.ssh/config` file. Still, double-check the content of said `~/.ssh/config`, and check also any "`insteadOf`" directive from your global Git config: `git config --global -l|grep -i inseadof` – VonC Oct 17 '22 at 11:22
0

It might be easier to clone the submodule using https and not ssh: change from git@bitbucket.org: to https://bitbucket.org/ in the .gitmodule, then

git submodule sync
git submodule update --init

See Git submodule: git@github.com: Permission denied (publickey). fatal: Could not read from remote repository

Ferdinando M. Ametrano
  • 1
  • 2
  • Unfortunately, I work as part of a team and changing the system over to use HTTPS would likely not be appreciated. Though I agree this would avoid the problem. – hi im Bacon Jan 09 '23 at 13:02
0

I had the same issue, and it was because the MING terminal does not use the same authentication method as the Sourcetree UI.

Short answer, type this into the terminal before you run git submodule update --init

git config credential.helper sourcetree

I found this answer here: https://jira.atlassian.com/browse/SRCTREE-2029

NOTE: You must make sure your 'parent' repository is setup to use ssh in Sourcetree. You can check this by clicking Repository->Repository Settings and looking at the source path. If this start's "http://" then you need to change it otherwise this answer will not work. A bit more on this here: How can I set Sourcetree to use ssh paths by default when cloning a remote repo?

SamWH
  • 1