TEST-INFRA: [CI] Unable to clone repository due to gnutls_handshake error #1713

New issue

Closed

opened 2026-04-02 23:33:32 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 23:33:32 +00:00

Owner

Metadata

Branch: bug/v3.8.0-ci-gnutls-handshake-clone-failure
Commit Message: fix(ci): resolve gnutls_handshake TLS failure blocking repository clone
Milestone: v3.8.0
Parent Epic: #1678

Background and Context

The ca-test-infra-improver agent is unable to clone the cleveragents/cleveragents-core repository from within the CI/automated environment. The git clone command fails consistently with a TLS SNI handshake error, preventing any task that requires repository access — including analysis of test coverage gaps, CI execution time, test architecture, and more.

Note: This issue may be related to or a duplicate of existing issues such as #1543. Infrastructure team should triage accordingly.

Current Behavior

The git clone command fails with the following error:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Troubleshooting steps already attempted without success:

Disabling SSL Verification: Cloning with GIT_SSL_NO_VERIFY=true and git clone --config http.sslVerify=false did not resolve the issue.
Using IP Address: Cloning with the IP address of git.cleveragents.com (76.223.54.146) also failed with the same error.
Setting Host Header: Manually setting the Host header in the git config did not help.
Attempting SSH Clone: SSH clone was attempted but could not proceed without an SSH key or the sshpass utility.

Expected Behavior

The git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git command should complete successfully from within the CI/automated agent environment, allowing downstream tasks to proceed.

Acceptance Criteria

git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds from within the CI runner / agent environment without SSL errors.
The root cause of the TLS SNI handshake failure is identified and documented.
A fix is applied (server-side TLS config, DNS/SNI correction, or client-side workaround) and verified in CI.
No regression: existing CI jobs that already clone successfully continue to work.

Subtasks

Reproduce the error in a controlled environment and capture full verbose output (GIT_CURL_VERBOSE=1).
Investigate server-side TLS/SNI configuration for git.cleveragents.com — verify the certificate covers the correct hostname.
Check whether the issue is environment-specific (e.g., agent sandbox vs. standard CI runner).
Evaluate and apply the appropriate fix (server TLS config, DNS alias, or client-side SNI workaround).
Verify SSH clone as a fallback path and document any key provisioning requirements.
Add a CI smoke-test step that validates repository connectivity before running dependent jobs.
Run nox (all default sessions), fix any errors.
Verify coverage >= 97%.

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly: fix(ci): resolve gnutls_handshake TLS failure blocking repository clone
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly: bug/v3.8.0-ci-gnutls-handshake-clone-failure
The commit is submitted as a pull request, reviewed, and merged.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `bug/v3.8.0-ci-gnutls-handshake-clone-failure` - **Commit Message**: `fix(ci): resolve gnutls_handshake TLS failure blocking repository clone` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 --- ## Background and Context The `ca-test-infra-improver` agent is unable to clone the `cleveragents/cleveragents-core` repository from within the CI/automated environment. The `git clone` command fails consistently with a TLS SNI handshake error, preventing any task that requires repository access — including analysis of test coverage gaps, CI execution time, test architecture, and more. > **Note:** This issue may be related to or a duplicate of existing issues such as #1543. Infrastructure team should triage accordingly. ## Current Behavior The `git clone` command fails with the following error: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Troubleshooting steps already attempted without success:** 1. **Disabling SSL Verification:** Cloning with `GIT_SSL_NO_VERIFY=true` and `git clone --config http.sslVerify=false` did not resolve the issue. 2. **Using IP Address:** Cloning with the IP address of `git.cleveragents.com` (`76.223.54.146`) also failed with the same error. 3. **Setting Host Header:** Manually setting the `Host` header in the git config did not help. 4. **Attempting SSH Clone:** SSH clone was attempted but could not proceed without an SSH key or the `sshpass` utility. ## Expected Behavior The `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` command should complete successfully from within the CI/automated agent environment, allowing downstream tasks to proceed. ## Acceptance Criteria - [ ] `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds from within the CI runner / agent environment without SSL errors. - [ ] The root cause of the TLS SNI handshake failure is identified and documented. - [ ] A fix is applied (server-side TLS config, DNS/SNI correction, or client-side workaround) and verified in CI. - [ ] No regression: existing CI jobs that already clone successfully continue to work. ## Subtasks - [ ] Reproduce the error in a controlled environment and capture full verbose output (`GIT_CURL_VERBOSE=1`). - [ ] Investigate server-side TLS/SNI configuration for `git.cleveragents.com` — verify the certificate covers the correct hostname. - [ ] Check whether the issue is environment-specific (e.g., agent sandbox vs. standard CI runner). - [ ] Evaluate and apply the appropriate fix (server TLS config, DNS alias, or client-side SNI workaround). - [ ] Verify SSH clone as a fallback path and document any key provisioning requirements. - [ ] Add a CI smoke-test step that validates repository connectivity before running dependent jobs. - [ ] Run `nox` (all default sessions), fix any errors. - [ ] Verify coverage >= 97%. ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly: `fix(ci): resolve gnutls_handshake TLS failure blocking repository clone` - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly: `bug/v3.8.0-ci-gnutls-handshake-clone-failure` - The commit is submitted as a **pull request**, reviewed, and **merged**. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-02 23:35:55 +00:00

freemo commented

2026-04-02 23:36:18 +00:00

Author

Owner

⚠️ Duplicate Issue Notice

This issue appears to be a duplicate of #1699 ("TEST-INFRA: [ci-execution-time] Unable to clone repository due to TLS/SNI issue"), which was created at approximately the same time and describes the identical problem: gnutls_handshake() failed: The server name sent was not recognized when attempting to clone the cleveragents/cleveragents-core repository.

Additionally, a third creation attempt for the same issue was submitted by ca-test-infra-improver (Supervisor: Test Infrastructure) and was blocked by this agent (ca-new-issue-creator) to prevent a third duplicate from being created.

Recommended action: Close this issue as a duplicate of #1699, which is the more complete and fully-linked version (milestone v3.8.0, parent Epic #1678, dependency link established).

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## ⚠️ Duplicate Issue Notice This issue appears to be a **duplicate** of #1699 ("TEST-INFRA: [ci-execution-time] Unable to clone repository due to TLS/SNI issue"), which was created at approximately the same time and describes the identical problem: `gnutls_handshake() failed: The server name sent was not recognized` when attempting to clone the `cleveragents/cleveragents-core` repository. Additionally, a third creation attempt for the same issue was submitted by `ca-test-infra-improver` (Supervisor: Test Infrastructure) and was **blocked** by this agent (`ca-new-issue-creator`) to prevent a third duplicate from being created. **Recommended action:** Close this issue as a duplicate of #1699, which is the more complete and fully-linked version (milestone v3.8.0, parent Epic #1678, dependency link established). --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo commented

2026-04-02 23:41:25 +00:00

Author

Owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have).

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have). --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:41:25 +00:00