cleveragents/cleveragents-core

Fork 3

TEST-INFRA: [CI] Unable to clone repository due to TLS handshake failure #1655

New issue

Closed

opened 2026-04-02 23:24:16 +00:00 by freemo · 3 comments

freemo commented

2026-04-02 23:24:16 +00:00

Owner

Metadata

Branch: fix/ci-tls-handshake-clone-failure
Commit Message: fix(ci): resolve TLS handshake failure preventing repository clone in agent execution environment
Milestone: v3.7.0
Parent Epic: #376

Description

The ca-test-infra-improver agent is unable to clone the cleveragents/cleveragents-core repository, which is a critical first step for any code analysis. This failure blocks all automated test infrastructure improvement tasks.

Error Details

The agent consistently encounters the following error during the git clone operation:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Troubleshooting Steps Taken

The agent attempted the following workarounds, all of which failed with the same error:

Standard Clone:

git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git

Clone with SSL Verification Disabled:

git -c http.sslVerify=false clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git

Clone using IP Address and Host Header:

Resolved git.cleveragents.com to 13.248.169.48.
Attempted clone with explicit IP and Host header:

git -c http.sslVerify=false clone https://<PAT>@13.248.169.48/cleveragents/cleveragents-core.git --config "http.extraHeader=Host: git.cleveragents.com"

The persistence of the gnutls_handshake() failure despite these measures suggests a deep-seated issue, potentially related to:

The server's TLS/SSL configuration (missing or misconfigured SNI/SAN entries).
A network proxy or firewall within the execution environment that is interfering with the TLS handshake.
A misconfiguration in the runner's DNS or network settings.

Impact

This is a blocking issue. No automated code analysis or test infrastructure improvement can proceed until the agent can successfully clone the repository.

Subtasks

Investigate server-side TLS/SNI configuration for git.cleveragents.com (verify SAN entries and virtual-host routing)
Investigate network proxy/firewall configuration in the agent execution environment
Verify DNS resolution and routing from the agent execution environment to git.cleveragents.com
Identify and document the root cause of the TLS handshake failure
Implement the fix (server-side config, network config, or runner environment config as appropriate)
Verify that a standard git clone with PAT succeeds from the agent execution environment
Run nox (all default sessions), fix any errors
Verify coverage >= 97% via nox -s coverage_report

Definition of Done

The root cause of the TLS handshake failure is identified and documented.
The ca-test-infra-improver agent can successfully clone the cleveragents/cleveragents-core repository without workarounds.
A standard git clone command works reliably from the agent's execution environment.
No SSL verification bypass flags (http.sslVerify=false, GIT_SSL_NO_VERIFY) are required.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-tls-handshake-clone-failure` - **Commit Message**: `fix(ci): resolve TLS handshake failure preventing repository clone in agent execution environment` - **Milestone**: v3.7.0 - **Parent Epic**: #376 ## Description The `ca-test-infra-improver` agent is unable to clone the `cleveragents/cleveragents-core` repository, which is a critical first step for any code analysis. This failure blocks all automated test infrastructure improvement tasks. ### Error Details The agent consistently encounters the following error during the `git clone` operation: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` ### Troubleshooting Steps Taken The agent attempted the following workarounds, all of which failed with the same error: 1. **Standard Clone:** ```bash git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` 2. **Clone with SSL Verification Disabled:** ```bash git -c http.sslVerify=false clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` 3. **Clone using IP Address and Host Header:** - Resolved `git.cleveragents.com` to `13.248.169.48`. - Attempted clone with explicit IP and Host header: ```bash git -c http.sslVerify=false clone https://<PAT>@13.248.169.48/cleveragents/cleveragents-core.git --config "http.extraHeader=Host: git.cleveragents.com" ``` The persistence of the `gnutls_handshake()` failure despite these measures suggests a deep-seated issue, potentially related to: - The server's TLS/SSL configuration (missing or misconfigured SNI/SAN entries). - A network proxy or firewall within the execution environment that is interfering with the TLS handshake. - A misconfiguration in the runner's DNS or network settings. ### Impact This is a **blocking issue**. No automated code analysis or test infrastructure improvement can proceed until the agent can successfully clone the repository. ## Subtasks - [ ] Investigate server-side TLS/SNI configuration for `git.cleveragents.com` (verify SAN entries and virtual-host routing) - [ ] Investigate network proxy/firewall configuration in the agent execution environment - [ ] Verify DNS resolution and routing from the agent execution environment to `git.cleveragents.com` - [ ] Identify and document the root cause of the TLS handshake failure - [ ] Implement the fix (server-side config, network config, or runner environment config as appropriate) - [ ] Verify that a standard `git clone` with PAT succeeds from the agent execution environment - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done - [ ] The root cause of the TLS handshake failure is identified and documented. - [ ] The `ca-test-infra-improver` agent can successfully clone the `cleveragents/cleveragents-core` repository without workarounds. - [ ] A standard `git clone` command works reliably from the agent's execution environment. - [ ] No SSL verification bypass flags (`http.sslVerify=false`, `GIT_SSL_NO_VERIFY`) are required. - [ ] All nox stages pass. - [ ] Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-02 23:24:29 +00:00

freemo referenced this issue

2026-04-02 23:26:47 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo added a new dependency

2026-04-02 23:27:15 +00:00

#376 Legendary: Hardening, Testing & Security

freemo referenced this issue

2026-04-02 23:28:19 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo commented

2026-04-02 23:30:20 +00:00

Author

Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:30:21 +00:00

closed this issue
added the
State
Duplicate
label

freemo referenced this issue

2026-04-02 23:30:48 +00:00

TEST-INFRA: [ci-execution-time] Unable to clone repository #1694

freemo commented

2026-04-02 23:33:41 +00:00

Author

Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo commented

2026-04-02 23:39:13 +00:00

Author

Owner

Closing as duplicate. This issue was marked State/Duplicate indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure).

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate. This issue was marked `State/Duplicate` indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure). --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo referenced this issue

2026-04-02 23:40:27 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463

freemo referenced this issue

2026-04-02 23:55:03 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463