Julia v1.6.0-rc1 and SSH host verification

[goretkin]

If I remove the corresponding entry from ~/.ssh/known_hosts, the Julia 1.6 version succeeds. But all other ssh operations insist on adding the entry back in (of course).

$ julia1.5
               _
   _       _ _(_)_     |  Documentation: https://docs.julialang.org
  (_)     | (_) (_)    |
   _ _   _| |_  __ _   |  Type "?" for help, "]?" for Pkg help.
  | | | | | | |/ _` |  |
  | | |_| | | | (_| |  |  Version 1.5.3 (2020-11-09)
 _/ |\__'_|_|_|\__'_|  |  Official https://julialang.org/ release
|__/                   |

(@v1.5) pkg> registry
add    remove  status  update
(@v1.5) pkg> registry update
   Updating registry at `~/.julia/registries/MyRegistry`
   Updating git-repo `git@gitlab.com:myregistry/localjuliaregistry.git`
   Updating registry at `~/.julia/registries/General`

In the same breath:

$ julia1.6
               _
   _       _ _(_)_     |  Documentation: https://docs.julialang.org
  (_)     | (_) (_)    |
   _ _   _| |_  __ _   |  Type "?" for help, "]?" for Pkg help.
  | | | | | | |/ _` |  |
  | | |_| | | | (_| |  |  Version 1.6.0-rc1 (2021-02-06)
 _/ |\__'_|_|_|\__'_|  |  Official https://julialang.org/ release
|__/                   |

(@v1.6) pkg> registry update
    Updating registry at `~/.julia/registries/MyRegistry`
    Updating git-repo `git@gitlab.com:myregistry/localjuliaregistry.git`
SSH host verification: the identity of the server `gitlab.com:22` does not match its known hosts record. Someone could be trying to man-in-the-middle your connection. It is also possible that the server has changed its key, in which case you should check with the server administrator and if they confirm that the key has been changed, update your known hosts file.
    Updating registry at `~/.julia/registries/General`
┌ Warning: Some registries failed to update:
│     — /Users/goretkin/.julia/registries/MyRegistry — failed to fetch from repo
└ @ Pkg.Types /Users/julia/buildbot/worker/package_macos64/build/usr/share/julia/stdlib/v1.6/Pkg/src/Types.jl:1220

[goretkin]

This is still the case on "v1.6.0". If there's any additional info I can provide, or hint for how to fix this, please let me know.

[goretkin]

My workaround is to do

ENV["JULIA_NO_VERIFY_HOSTS"]="gitlab.com"

beforehand.

More details:
https://github.com/JuliaLang/NetworkOptions.jl
JuliaLang/julia#38506

[iamed2]

@goretkin have you run ssh-keyscan gitlab.com >> ~/.ssh/known_hosts?

[goretkin]

@iamed2 I hadn't tried that, and it seems to fix the issue for me. Thank you!

[StefanKarpinski]

The weird thing about this is that lots of people seem to have old, no-longer-valid known hosts entries for gitlab.com. When there's no entry at all, the error message tell you to run ssh-keyscan. Telling people to do this when there is a mismatch is a bad idea because a key mismatch is an actual indication of a possible MITM attack and you don't want to tell people to do something that will allow the attack.