The brownout has ended, and builds that were previously failing over the last 24 hours should execute normally as they had prior to the brownout
We have seen an increase in topics and tickets related to the following error:
ERROR: You're using an RSA key with SHA-1, which is no longer allowed
That is happening with the
- checkout step. This is related to some changes on GitHub’s end, a bit more details here:
With the above in mind, the path forward is to get on a newer version of openSSH, this can be done by upgrading to a newer image version or installing openSSH directly before your
- checkout step.
If you are on the
machine executor, you can upgrade to a newer version by specifying an image in your config, so you would update:
jobs: jobname: machine: true ...
To something like the following:
jobs: jobname: machine: image: ubuntu-2004:202010-01 ...
We have a list of machine images available here, most of the newer ones should work.
If you are using the
docker executor, you’ll need to find a newer version of the docker image you are using that has the proper openSSH items installed. Usually, the most recent image should suffice.
If you are unable to update your image and instead want to install openSSH manually, this can be done in a
- run step before you call
- checkout . This will do that on Linux based images:
jobs: jobname: machine: true steps: - run: name: Install OpenSSH 8.1p1 command: | sudo apt-get update mkdir ~/tempdownload; cd ~/tempdownload; wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.1p1.tar.gz; tar zxvf openssh-8.1p1.tar.gz; cd openssh-8.1p1 && ./configure && make && sudo make install - checkout ...
If the image you are using isn’t Linux-based, you’ll need to investigate what options are available for your operating system to install the newer version.
EDIT: One other item discovered in the discussion of this thread is there are situations where openSSH may be on the proper version (7.2+) but
git isn’t installed on the docker image you are utilizing. You can install it, as an example like this:
- run: name: Install git for checkout command: | apt-get update && apt-get --no-install-recommends -y install git
If you are using an Orb job you can utilize a
pre-step to have it execute before any other code in that job as well. More information on pre-steps here.
We have done some testing and the above two options should allow for the
- checkout step to work again without modifying any keys. If you encounter any further issues please let us know!