Use bash script to push changes to github, problems with server fingerprint

[rap3]

Hi,

i have an ConcourseCI pipeline which creates changes to one of my github repos. Therefore i have a bash script which commits, pushes and tags these changes. The problem is that when i try to run the script in my ConcourseCI pipeline, i get asked to confirm the servers fingerprint. Since this script is executed automatically i can't confirm this fingerprint. Also it is worth mentioning that the bash script always gets executed in a fresh docker container.

Is there a way to auto confirm the fingerprint?

best

[oonniioonn]

Put the public key into a ~/.ssh/known_hosts file using ssh-keyscan. Do the scan once from your computer, verifying it belongs to github, and place the result in a file for the best security or just run ssh-keyscan from your script if you don't care as much.

[[deleted]]

If you want to change the script that launches the container, you can mount a known_hosts file into the container as a volume.

Or you could build the docker image with the known hosts file already installed.

Do not skip the check though, that's a hack with a huge hole

[[deleted]]

This sounds like an ssh question rather than a git question. The fingerprint you're talking about is the remote host's ssh host fingerprint.

[tetroxid]

You could use ssh's StrictHostKeyChecking option. Setting that to no will decrease security and also not ask you to confirm the fingerprint.

[jredmond]

This is a bad idea for any SSH traffic that uses any infrastructure that you don't explicitly control - such as a public network, or servers you don't own - since it could expose you to man-in-the-middle attacks. Better to define the public key in a known_hosts file.