TEST-INFRA: [ci-execution-time] Critical Failure: Unable to clone repository #1648

Closed
opened 2026-04-02 23:22:56 +00:00 by freemo · 3 comments
Owner

Metadata

  • Branch: fix/v3.6.0-ci-clone-tls-sni-failure
  • Commit Message: fix(infra): resolve TLS SNI handshake failure blocking repository clone in CI
  • Milestone: v3.6.0
  • Parent Epic: #376

Background and Context

The Test Infrastructure Improver agent was unable to clone the cleveragents/cleveragents-core repository, preventing any analysis of CI execution time. The failure occurs at the TLS handshake stage due to an SNI (Server Name Indication) configuration issue on git.cleveragents.com. This completely blocks all automated agents from performing any CI analysis or test infrastructure improvements.

Note

: A closely related issue exists at #1615 ("TEST-INFRA: [ci-execution-time] Git clone fails with TLS error") and #1543 ("fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com"). This issue captures the specific failure encountered during CI execution time analysis and may be a duplicate or a recurrence of those issues.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage with an SNI error.

Error Message:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Troubleshooting Steps Taken:

  1. Attempted to clone the repository using the provided Forgejo PAT.
  2. Attempted to clone with SSL verification disabled (git -c http.sslVerify=false clone ...).

Both attempts failed with the same error, indicating a server-side issue with TLS/SNI configuration on git.cleveragents.com.

Expected Behavior

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is cloned to the local filesystem, allowing CI execution time analysis to proceed.

Acceptance Criteria

  • git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors from a clean CI environment.
  • curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert).
  • The TLS certificate served for git.cleveragents.com includes the hostname as a valid SAN (Subject Alternative Name).
  • The fix is verified in the CI/CD environment used by automated agents.
  • CI execution time analysis can proceed after the fix is applied.

Subtasks

  • Investigate TLS certificate configuration for git.cleveragents.com — confirm whether the hostname is present as a SAN.
  • Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com.
  • Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction).
  • Verify the fix by re-running curl -v https://git.cleveragents.com and a full git clone from the agent environment.
  • Confirm CI execution time analysis agent can successfully clone and analyse the repository post-fix.
  • Document the root cause and resolution in the relevant infrastructure runbook.
  • Run nox (all default sessions), fix any errors.

Definition of Done

  • All subtasks above are completed and checked off.
  • git clone succeeds without TLS errors from the automated agent CI environment.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All nox stages pass.
  • Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/v3.6.0-ci-clone-tls-sni-failure` - **Commit Message**: `fix(infra): resolve TLS SNI handshake failure blocking repository clone in CI` - **Milestone**: v3.6.0 - **Parent Epic**: #376 --- ### Background and Context The Test Infrastructure Improver agent was unable to clone the `cleveragents/cleveragents-core` repository, preventing any analysis of CI execution time. The failure occurs at the TLS handshake stage due to an SNI (Server Name Indication) configuration issue on `git.cleveragents.com`. This completely blocks all automated agents from performing any CI analysis or test infrastructure improvements. > **Note**: A closely related issue exists at #1615 ("TEST-INFRA: [ci-execution-time] Git clone fails with TLS error") and #1543 ("fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com"). This issue captures the specific failure encountered during CI execution time analysis and may be a duplicate or a recurrence of those issues. ### Current Behavior All attempts to clone the repository fail at the TLS handshake stage with an SNI error. **Error Message:** ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Troubleshooting Steps Taken:** 1. Attempted to clone the repository using the provided Forgejo PAT. 2. Attempted to clone with SSL verification disabled (`git -c http.sslVerify=false clone ...`). Both attempts failed with the same error, indicating a server-side issue with TLS/SNI configuration on `git.cleveragents.com`. ### Expected Behavior `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is cloned to the local filesystem, allowing CI execution time analysis to proceed. ### Acceptance Criteria - [ ] `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors from a clean CI environment. - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert). - [ ] The TLS certificate served for `git.cleveragents.com` includes the hostname as a valid SAN (Subject Alternative Name). - [ ] The fix is verified in the CI/CD environment used by automated agents. - [ ] CI execution time analysis can proceed after the fix is applied. --- ## Subtasks - [ ] Investigate TLS certificate configuration for `git.cleveragents.com` — confirm whether the hostname is present as a SAN. - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com`. - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction). - [ ] Verify the fix by re-running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment. - [ ] Confirm CI execution time analysis agent can successfully clone and analyse the repository post-fix. - [ ] Document the root cause and resolution in the relevant infrastructure runbook. - [ ] Run `nox` (all default sessions), fix any errors. ## Definition of Done - [ ] All subtasks above are completed and checked off. - [ ] `git clone` succeeds without TLS errors from the automated agent CI environment. - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - [ ] All nox stages pass. - [ ] Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.6.0 milestone 2026-04-02 23:23:15 +00:00
Author
Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:30:24 +00:00
Author
Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.


Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer
Author
Owner

Closing as duplicate. This issue was marked State/Duplicate indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure).


Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate. This issue was marked `State/Duplicate` indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure). --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
Reference
cleveragents/cleveragents-core#1648
No description provided.