CRITICAL: Unable to clone repository cleveragents/cleveragents-core #1686

New issue

Closed

opened 2026-04-02 23:29:38 +00:00 by freemo · 3 comments

freemo commented

2026-04-02 23:29:38 +00:00

Owner

Metadata

Branch: fix/v3.6.0-clone-tls-sni-handshake-failure
Commit Message: fix(infra): resolve TLS SNI handshake failure blocking repository clone
Milestone: v3.6.0
Parent Epic: #376

Background and Context

The repository cleveragents/cleveragents-core cannot be cloned due to a TLS/SNI (Server Name Indication) misconfiguration on the Forgejo host. This completely blocks all development, analysis, and automated agent work on this repository. The failure occurs at the TLS handshake stage and persists even when SSL verification is disabled, indicating a server-side SNI configuration issue rather than a certificate trust problem.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage with an SNI error:

fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/':
gnutls_handshake() failed: The server name sent was not recognized

Troubleshooting Steps Taken:

Attempted standard clone using the provided Forgejo PAT — failed.
Attempted clone with SSL verification disabled (git -c http.sslVerify=false clone ...) — failed with the same error.

The error persists regardless of SSL verification settings, confirming this is a server-side TLS/SNI configuration issue.

Expected Behavior

git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is accessible to all developers and automated agents.

Acceptance Criteria

git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git succeeds without TLS errors.
The TLS/SNI configuration on the Forgejo host is corrected so the server name is recognized.
The fix is verified from multiple network environments (local dev, CI, automated agents).
No regression: all other repository operations (push, pull, fetch) continue to work correctly.

Supporting Information

Error: gnutls_handshake() failed: The server name sent was not recognized
This error occurs even with GIT_SSL_NO_VERIFY=true and http.sslVerify=false, ruling out client-side certificate trust as the root cause.
Related issues: #1648, #1645, #1640, #1638, #1637, #1636, #1630, #1626, #1615 (multiple prior reports of the same or similar TLS/SNI clone failure).
This is a critical infrastructure blocker — no development or automated analysis work can proceed until resolved.

Subtasks

Investigate TLS/SNI configuration on the Forgejo host (git.cleverthis.com)
Identify the root cause: misconfigured SNI, missing virtual host, or reverse proxy misconfiguration
Apply the server-side fix to correct the SNI configuration
Verify git clone succeeds from a clean environment
Verify git clone succeeds from CI pipeline environment
Verify git clone succeeds from automated agent environment
Confirm no regression on push/pull/fetch operations
Run nox (all default sessions), fix any errors
Verify coverage >=97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git succeeds reliably from all environments (local, CI, automated agents).
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (fix(infra): resolve TLS SNI handshake failure blocking repository clone), followed by a blank line, then additional lines providing relevant details about the fix.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (fix/v3.6.0-clone-tls-sni-handshake-failure).
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Unknown | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/v3.6.0-clone-tls-sni-handshake-failure` - **Commit Message**: `fix(infra): resolve TLS SNI handshake failure blocking repository clone` - **Milestone**: v3.6.0 - **Parent Epic**: #376 --- ## Background and Context The repository `cleveragents/cleveragents-core` cannot be cloned due to a TLS/SNI (Server Name Indication) misconfiguration on the Forgejo host. This completely blocks all development, analysis, and automated agent work on this repository. The failure occurs at the TLS handshake stage and persists even when SSL verification is disabled, indicating a server-side SNI configuration issue rather than a certificate trust problem. ## Current Behavior All attempts to clone the repository fail at the TLS handshake stage with an SNI error: ``` fatal: unable to access 'https://git.cleverthis.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Troubleshooting Steps Taken:** 1. Attempted standard clone using the provided Forgejo PAT — failed. 2. Attempted clone with SSL verification disabled (`git -c http.sslVerify=false clone ...`) — failed with the same error. The error persists regardless of SSL verification settings, confirming this is a server-side TLS/SNI configuration issue. ## Expected Behavior `git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is accessible to all developers and automated agents. ## Acceptance Criteria - [ ] `git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git` succeeds without TLS errors. - [ ] The TLS/SNI configuration on the Forgejo host is corrected so the server name is recognized. - [ ] The fix is verified from multiple network environments (local dev, CI, automated agents). - [ ] No regression: all other repository operations (push, pull, fetch) continue to work correctly. ## Supporting Information - Error: `gnutls_handshake() failed: The server name sent was not recognized` - This error occurs even with `GIT_SSL_NO_VERIFY=true` and `http.sslVerify=false`, ruling out client-side certificate trust as the root cause. - Related issues: #1648, #1645, #1640, #1638, #1637, #1636, #1630, #1626, #1615 (multiple prior reports of the same or similar TLS/SNI clone failure). - This is a **critical infrastructure blocker** — no development or automated analysis work can proceed until resolved. ## Subtasks - [ ] Investigate TLS/SNI configuration on the Forgejo host (`git.cleverthis.com`) - [ ] Identify the root cause: misconfigured SNI, missing virtual host, or reverse proxy misconfiguration - [ ] Apply the server-side fix to correct the SNI configuration - [ ] Verify `git clone` succeeds from a clean environment - [ ] Verify `git clone` succeeds from CI pipeline environment - [ ] Verify `git clone` succeeds from automated agent environment - [ ] Confirm no regression on push/pull/fetch operations - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >=97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - `git clone https://<token>@git.cleverthis.com/cleveragents/cleveragents-core.git` succeeds reliably from all environments (local, CI, automated agents). - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`fix(infra): resolve TLS SNI handshake failure blocking repository clone`), followed by a blank line, then additional lines providing relevant details about the fix. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`fix/v3.6.0-clone-tls-sni-handshake-failure`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Unknown | Agent: ca-new-issue-creator

freemo added this to the v3.6.0 milestone

2026-04-02 23:32:29 +00:00

freemo commented

2026-04-02 23:33:50 +00:00

Author

Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo closed this issue

2026-04-02 23:34:22 +00:00

freemo added a new dependency

2026-04-02 23:40:17 +00:00

#376 Legendary: Hardening, Testing & Security

freemo referenced this issue

2026-04-02 23:40:27 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463

freemo reopened this issue

2026-04-02 23:41:42 +00:00

freemo commented

2026-04-02 23:42:08 +00:00

Author

Owner

Closing as duplicate of #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com). This issue describes the same underlying TLS/repository clone failure that is already being tracked. Please follow #1532 and #1543 for updates on the fix.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer