TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue #1732

New issue

Closed

opened 2026-04-02 23:37:19 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 23:37:19 +00:00

Owner

Background and Context

The Test Infrastructure Improver agent is unable to clone the cleveragents/cleveragents-core repository, which blocks all automated analysis tasks. The clone operation fails with a fatal TLS/SNI error. This is a server-side configuration issue where the server at 13.248.169.48 is not correctly configured to handle TLS requests for the git.cleveragents.com hostname (Server Name Indication — SNI).

Current Behavior

The git clone command fails with:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Diagnostic steps performed:

Standard Clone: Failed with the error above.
Clone with SSL Verification Disabled: GIT_SSL_NO_VERIFY=true git clone ... also failed with the exact same error, confirming the issue is not client-side certificate validation.
cURL Verbose Handshake: A curl -v request revealed a TLS alert, unrecognized name from the server during the handshake:

*   Trying 13.248.169.48:443...
* Connected to git.cleveragents.com (13.248.169.48) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name
* Closing connection 0
curl: (35) OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name

Expected Behavior

The git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git command completes successfully without any TLS/SNI errors, allowing automated agents to access the repository.

Acceptance Criteria

The server at git.cleveragents.com correctly handles SNI for the git.cleveragents.com hostname.
git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds from the CI environment.
curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git/info/refs completes the TLS handshake without unrecognized name alert.

Supporting Information

Server IP: 13.248.169.48
Affected hostname: git.cleveragents.com
TLS error code: error:0A000458:SSL routines::tlsv1 unrecognized name
Related issues: #1629, #1626, #1615, #1532

Metadata

Branch: fix/ci-tls-sni-clone-failure
Commit Message: fix(ci): resolve TLS/SNI handshake failure blocking repository clone
Milestone: v3.8.0
Parent Epic: (orphan — no TEST-INFRA ci-pipeline-design Epic found; requires manual linking)

Subtasks

Investigate the TLS/SNI configuration of the git.cleveragents.com server (verify SNI virtual host binding).
Correct the server-side TLS/SNI configuration to properly respond to the git.cleveragents.com hostname.
Verify the fix: confirm git clone succeeds from the CI runner environment.
Verify the fix: confirm curl -v TLS handshake completes without unrecognized name alert.
Run nox (all default sessions), fix any errors.
Verify coverage >= 97% via nox -s coverage_report.

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
The cleveragents/cleveragents-core repository can be cloned successfully without any TLS/SNI errors from the CI environment.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the fix.
The commit is pushed to the remote on branch fix/ci-tls-sni-clone-failure.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Background and Context The Test Infrastructure Improver agent is unable to clone the `cleveragents/cleveragents-core` repository, which blocks all automated analysis tasks. The clone operation fails with a fatal TLS/SNI error. This is a server-side configuration issue where the server at `13.248.169.48` is not correctly configured to handle TLS requests for the `git.cleveragents.com` hostname (Server Name Indication — SNI). ## Current Behavior The `git clone` command fails with: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` Diagnostic steps performed: 1. **Standard Clone:** Failed with the error above. 2. **Clone with SSL Verification Disabled:** `GIT_SSL_NO_VERIFY=true git clone ...` also failed with the exact same error, confirming the issue is **not** client-side certificate validation. 3. **cURL Verbose Handshake:** A `curl -v` request revealed a `TLS alert, unrecognized name` from the server during the handshake: ``` * Trying 13.248.169.48:443... * Connected to git.cleveragents.com (13.248.169.48) port 443 (#0) * ALPN: offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name * Closing connection 0 curl: (35) OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` ## Expected Behavior The `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` command completes successfully without any TLS/SNI errors, allowing automated agents to access the repository. ## Acceptance Criteria - [ ] The server at `git.cleveragents.com` correctly handles SNI for the `git.cleveragents.com` hostname. - [ ] `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds from the CI environment. - [ ] `curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git/info/refs` completes the TLS handshake without `unrecognized name` alert. ## Supporting Information - Server IP: `13.248.169.48` - Affected hostname: `git.cleveragents.com` - TLS error code: `error:0A000458:SSL routines::tlsv1 unrecognized name` - Related issues: #1629, #1626, #1615, #1532 ## Metadata - **Branch**: `fix/ci-tls-sni-clone-failure` - **Commit Message**: `fix(ci): resolve TLS/SNI handshake failure blocking repository clone` - **Milestone**: v3.8.0 - **Parent Epic**: *(orphan — no TEST-INFRA ci-pipeline-design Epic found; requires manual linking)* ## Subtasks - [ ] Investigate the TLS/SNI configuration of the `git.cleveragents.com` server (verify SNI virtual host binding). - [ ] Correct the server-side TLS/SNI configuration to properly respond to the `git.cleveragents.com` hostname. - [ ] Verify the fix: confirm `git clone` succeeds from the CI runner environment. - [ ] Verify the fix: confirm `curl -v` TLS handshake completes without `unrecognized name` alert. - [ ] Run `nox` (all default sessions), fix any errors. - [ ] Verify coverage >= 97% via `nox -s coverage_report`. ## Definition of Done This issue is complete when: - [ ] All subtasks above are completed and checked off. - [ ] The `cleveragents/cleveragents-core` repository can be cloned successfully without any TLS/SNI errors from the CI environment. - [ ] A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the fix. - [ ] The commit is pushed to the remote on branch `fix/ci-tls-sni-clone-failure`. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-02 23:37:50 +00:00

freemo commented

2026-04-02 23:39:28 +00:00

Author

Owner

⚠️ Orphan Issue — Manual Linking Required

This issue could not be automatically linked to a parent Epic. An exhaustive search of all open issues in cleveragents/cleveragents-core found no Type/Epic issues that cover the TEST-INFRA [ci-pipeline-design] category.

Per CONTRIBUTING.md, orphan issues are not permitted. A project owner must either:

Create a new Type/Epic for TEST-INFRA CI pipeline design work and link this issue as a child (this issue should block the parent Epic), or
Link this issue to an existing Epic if one exists in a closed state or was missed.

To create the dependency link once a parent Epic is identified, use:

# This issue (#1732) blocks the parent Epic (<EPIC_NUMBER>)
curl -X POST "https://git.cleveragents.com/api/v1/repos/cleveragents/cleveragents-core/issues/1732/blocks" \
  -H "Authorization: token <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"dependency_id": <EPIC_NUMBER>}'

Note: Priority/Highest label does not exist in this repository. The closest available label, Priority/Critical, has been applied instead.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** This issue could not be automatically linked to a parent Epic. An exhaustive search of all open issues in `cleveragents/cleveragents-core` found **no `Type/Epic` issues** that cover the `TEST-INFRA [ci-pipeline-design]` category. Per CONTRIBUTING.md, orphan issues are not permitted. A project owner must either: 1. **Create a new `Type/Epic`** for TEST-INFRA CI pipeline design work and link this issue as a child (this issue should **block** the parent Epic), or 2. **Link this issue to an existing Epic** if one exists in a closed state or was missed. To create the dependency link once a parent Epic is identified, use: ```bash # This issue (#1732) blocks the parent Epic (<EPIC_NUMBER>) curl -X POST "https://git.cleveragents.com/api/v1/repos/cleveragents/cleveragents-core/issues/1732/blocks" \ -H "Authorization: token <TOKEN>" \ -H "Content-Type: application/json" \ -d '{"dependency_id": <EPIC_NUMBER>}' ``` **Note:** `Priority/Highest` label does not exist in this repository. The closest available label, `Priority/Critical`, has been applied instead. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo commented

2026-04-02 23:41:24 +00:00

Author

Owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have).

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have). --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:41:25 +00:00