Re: sign_and_send_pubkey: signing failed: agent refused operation

[Jonathan Wakely <jwakely.gcc@gmail.com>]

On Mon, 1 Jun 2020 at 20:16, Martin Sebor via Gcc <gcc@gcc.gnu.org> wrote:
>
> On 6/1/20 12:10 PM, Frank Ch. Eigler wrote:
> > Hi -
> >
> >> git pull from the GCC and Glibc repos is failing for me with the error
> >> below.  It worked fine last week and I haven't made any changes to my
> >> ssh keys.
> >
> > And are you logging in from the same workstation with access to the same
> > set of ssh private keys?
>
> Yes.
>
> >
> >> Is this a transient glitch or has something changed recently that I
> >> need to make some adjustments for?
> >
> > I know of nothing relevant that has changed on the sourceware side.
> >
> >> sign_and_send_pubkey: signing failed: agent refused operation
> >> msebor@gcc.gnu.org: Permission denied (publickey).
> >> fatal: Could not read from remote repository.
> >
> > The usual advice is to run       % ssh -vv gcc.gnu.org alive
> > and report the ssh level error.
> >
> > "agent refused operation" sounds like a problem on the client end.
>
> Until last week, when I ran git pull from the GCC or Glibc repo
> I'd get prompted for my password.  I'd either type it in or hit
> ctrl-C, enter ssh-add, and start over.
>
> After deleting ~/.ssh/known_hosts to resolve the problem I asked
> about last week (Re: ssh key conflicts), I'm no longer prompted
> for my password.  Instead, I get the error above.

Is ~/.ssh/known_hosts no longer present? Is ~/.ssh writable by your
user? The ssh client (or the agent) will try to create
~/.ssh/known_hosts if it doesn't exist, to add the host key. If ~/.ssh
is not writable that will fail.

> Both of this is new (I think since the recent server changes).  Now

The host key did change after the server upgrade, that's expected. The
other problem is not caused by the server.

> that I've seen it and know what to expect I can adjust to it but it
> seems like things have gotten worse.  Certainly the errors I got
> in both instances (i.e., last week as well as today) are not helpful.

SSH errors usually aren't.

> I captured the ssh -vv gcc.gnu.org output below for a successful
> invocation and a failed one if that sheds more light on why it's
> failing in (to me) a mysterious way.

The failed attempt shows that your public key is offered to the
server, and the server says it will accept it (meaning it matches a
~/.ssh/authorized_keys entry on the server) but then your client
refuses to use that key.

Check your ~/.ssh and ~/.ssh/id_rsa* permissions.