TEST-INFRA: [ci-environment] Unable to clone repository due to TLS/SSL handshake failure #1601

New issue

Closed

opened 2026-04-02 23:07:50 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:07:50 +00:00

Owner

Metadata

Branch: fix/ci-tls-ssl-handshake-failure
Commit Message: fix(ci): resolve TLS/SSL handshake failure preventing repository clone in CI environment
Milestone: v3.2.0
Parent Epic: #739

Background and Context

The CI environment is failing to clone the repository due to a TLS/SSL handshake error. This prevents all CI pipeline jobs from running, as the repository checkout step is a prerequisite for every job. The failure manifests as a gnutls_handshake() error (or equivalent OpenSSL error) when the CI runner attempts to connect to git.cleverthis.com over HTTPS.

This is a blocking infrastructure issue that must be resolved before any CI-dependent work can proceed.

Current Behavior

When the CI runner attempts to clone the repository, the following error (or similar) is observed:

fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/':
gnutls_handshake() failed: The TLS connection was non-properly terminated.

or equivalently with OpenSSL:

fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/':
SSL_connect: SSL_ERROR_SYSCALL in connection to git.cleverthis.com:443

All CI pipeline jobs fail at the checkout step with exit code non-zero.

Expected Behavior

The CI runner should be able to successfully clone the repository over HTTPS without any TLS/SSL errors. All pipeline jobs should proceed past the checkout step normally.

Acceptance Criteria

The CI runner can clone the repository without TLS/SSL errors
All CI pipeline jobs pass the repository checkout step
The fix is verified on the affected runner environment(s)
No regression is introduced for other CI jobs or environments

Troubleshooting Steps

The following steps should be investigated and attempted in order:

Verify the server certificate chain — Confirm that git.cleverthis.com presents a valid, complete certificate chain (including intermediates). Use openssl s_client -connect git.cleverthis.com:443 -showcerts to inspect.
Check runner CA bundle — Ensure the CI runner's CA certificate bundle is up to date. On Debian/Ubuntu: sudo update-ca-certificates. On Alpine: apk update && apk add ca-certificates.
Check for expired or self-signed certificates — Verify the server certificate has not expired and is signed by a trusted CA.
Check TLS version compatibility — Confirm the runner's TLS library (GnuTLS or OpenSSL) supports the TLS version negotiated by the server (TLS 1.2 minimum; TLS 1.3 preferred).
Check SNI configuration — Ensure the server is correctly configured for Server Name Indication (SNI) for the git.cleverthis.com hostname.
Check network/proxy interference — Verify that no intermediate proxy or firewall is performing TLS inspection that could corrupt the handshake.
Test with curl -v — Run curl -v https://git.cleverthis.com from the runner to get verbose TLS negotiation output.
Pin or update the git SSL backend — If the issue is environment-specific, consider setting GIT_SSL_NO_VERIFY=false (never disable verification in production) or updating the git SSL backend.

Supporting Information

Related issues: #1593, #1592, #1590, #1543, #1532
This issue is similar in nature to previously reported TLS failures on git.cleveragents.com and git.dev.cleveragents.com
The CI environment uses the standard runner image; any OS-level CA bundle updates should be applied at the image level, not via GIT_SSL_NO_VERIFY

Subtasks

Reproduce the TLS/SSL handshake failure in the CI environment
Identify the root cause (expired cert, missing intermediate, TLS version mismatch, SNI issue, etc.)
Apply the appropriate fix (update CA bundle, fix server cert chain, update runner image, etc.)
Verify the fix resolves the clone failure on all affected runner environments
Document the root cause and resolution in this issue
Run nox (all default sessions) to confirm no regressions
Verify coverage >= 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Unknown | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-tls-ssl-handshake-failure` - **Commit Message**: `fix(ci): resolve TLS/SSL handshake failure preventing repository clone in CI environment` - **Milestone**: v3.2.0 - **Parent Epic**: #739 ## Background and Context The CI environment is failing to clone the repository due to a TLS/SSL handshake error. This prevents all CI pipeline jobs from running, as the repository checkout step is a prerequisite for every job. The failure manifests as a `gnutls_handshake()` error (or equivalent OpenSSL error) when the CI runner attempts to connect to `git.cleverthis.com` over HTTPS. This is a blocking infrastructure issue that must be resolved before any CI-dependent work can proceed. ## Current Behavior When the CI runner attempts to clone the repository, the following error (or similar) is observed: ``` fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The TLS connection was non-properly terminated. ``` or equivalently with OpenSSL: ``` fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/': SSL_connect: SSL_ERROR_SYSCALL in connection to git.cleverthis.com:443 ``` All CI pipeline jobs fail at the checkout step with exit code non-zero. ## Expected Behavior The CI runner should be able to successfully clone the repository over HTTPS without any TLS/SSL errors. All pipeline jobs should proceed past the checkout step normally. ## Acceptance Criteria - [ ] The CI runner can clone the repository without TLS/SSL errors - [ ] All CI pipeline jobs pass the repository checkout step - [ ] The fix is verified on the affected runner environment(s) - [ ] No regression is introduced for other CI jobs or environments ## Troubleshooting Steps The following steps should be investigated and attempted in order: 1. **Verify the server certificate chain** — Confirm that `git.cleverthis.com` presents a valid, complete certificate chain (including intermediates). Use `openssl s_client -connect git.cleverthis.com:443 -showcerts` to inspect. 2. **Check runner CA bundle** — Ensure the CI runner's CA certificate bundle is up to date. On Debian/Ubuntu: `sudo update-ca-certificates`. On Alpine: `apk update && apk add ca-certificates`. 3. **Check for expired or self-signed certificates** — Verify the server certificate has not expired and is signed by a trusted CA. 4. **Check TLS version compatibility** — Confirm the runner's TLS library (GnuTLS or OpenSSL) supports the TLS version negotiated by the server (TLS 1.2 minimum; TLS 1.3 preferred). 5. **Check SNI configuration** — Ensure the server is correctly configured for Server Name Indication (SNI) for the `git.cleverthis.com` hostname. 6. **Check network/proxy interference** — Verify that no intermediate proxy or firewall is performing TLS inspection that could corrupt the handshake. 7. **Test with `curl -v`** — Run `curl -v https://git.cleverthis.com` from the runner to get verbose TLS negotiation output. 8. **Pin or update the git SSL backend** — If the issue is environment-specific, consider setting `GIT_SSL_NO_VERIFY=false` (never disable verification in production) or updating the git SSL backend. ## Supporting Information - Related issues: #1593, #1592, #1590, #1543, #1532 - This issue is similar in nature to previously reported TLS failures on `git.cleveragents.com` and `git.dev.cleveragents.com` - The CI environment uses the standard runner image; any OS-level CA bundle updates should be applied at the image level, not via `GIT_SSL_NO_VERIFY` ## Subtasks - [ ] Reproduce the TLS/SSL handshake failure in the CI environment - [ ] Identify the root cause (expired cert, missing intermediate, TLS version mismatch, SNI issue, etc.) - [ ] Apply the appropriate fix (update CA bundle, fix server cert chain, update runner image, etc.) - [ ] Verify the fix resolves the clone failure on all affected runner environments - [ ] Document the root cause and resolution in this issue - [ ] Run `nox` (all default sessions) to confirm no regressions - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Unknown | Agent: ca-new-issue-creator

freemo added this to the v3.2.0 milestone

2026-04-02 23:08:09 +00:00

freemo added a new dependency

2026-04-02 23:10:33 +00:00

#739 Epic: E2E Testing Suite for Acceptance Criteria and Workflow Examples

freemo commented

2026-04-02 23:16:14 +00:00

Author

Owner

Closing as duplicate of #1543.

This issue reports the same TLS/SSL handshake clone failure that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This issue reports the same TLS/SSL handshake clone failure that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:16:50 +00:00