I'd recommend to checkout via SSH in this case, as git sslVerify is not secure and configuring OneDev to trust a self-signed certificate is quite verbose.

The simplest is to define a common build user with its own private key, with minimum permission to the system. And configure this private key as secret in some root project so that all child projects can inherit. You may configure authorized branches of the private key secret so that only certain branches can access it. Or you can define different build user for different project tree if a common user is way too permissive.

Sorry for the late reply. Using a common build user does not seem to work. I have done the following:

1.) Create user buildbot using code read permissions on all projects 2.) Added an ecdsa publickey to buildbot and added the corresponding private key as a job secret to a top level project (so all other inherit it) 3.) Defined a job with step checkout and used SSH + the created SSH private key job secret for buildbot user

Now when running the job there the following output:

Error:

16:43:30 Running step "checkout"...
16:43:30 Checking out code...
16:43:31 RSA host key for IP address '10.52.12.101' not in list of known hosts.
16:43:31 Load key "/agent/work/onedev-agent-2/temp/temp8767306572624578319/.ssh/id_rsa": invalid format
16:43:31 root@onedev.example.com: Permission denied (publickey).
16:43:31 fatal: Could not read from remote repository.
16:43:31
16:43:31 Please make sure you have the correct access rights
16:43:31 and the repository exists.
16:43:31 Step "checkout" is failed: Failed to run command: git fetch ssh://onedev.example.com:6611/example/test-project --force --quiet 3a4ca090d30f46e379e2f1388fee467da604e501, return code: 128
RSA host key for IP address '10.10.10.10' not in list of known hosts.
Load key "/agent/work/onedev-agent-2/temp/temp8767306572624578319/.ssh/id_rsa": invalid format
root@onedev.example.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

1.) The job secret used for SSH private key is always treated as RSA key (job tries to load id_rsa). In my first attempt I actually used an ECDSA key, since I did not know the RSA requirement. However after replacing the ECDSA key with a RSA key the "invalid format" error continue to exist. 2.) The step runs as user root and thus git checkout will try to create a ssh connection using user root and not user buildbot. So even when fixing 1.) things probably still won't work as it uses the wrong user. 3.) The ssh connect complains that the target host is not a known host. However I am not able to add it since I don't have any control. Actually I would need to add multiple hosts to the list of known hosts because the DNS name resolves to multiple docker swarm hosts (port 6611 being an ingress port, so the SSH connect will be routed to the running OneDev instance, regardless on which docker host it runs)

Not sure how to continue. I am already thinking about a custom Docker image that does the git checkout into the workspace. However I will probably run into the same issue if using some of the Publish... job steps, right?

Please upgrade to 6.3.23 to see if it solves the issue.

6.3.23 seems to work. Only the known hosts warning is shown.

But am I right, that I have to use RSA key? Or can elliptic curve based keys be used as well for the checkout step?

The ECDSA key will also work. Known host warning is not a problem as it only means that ssh client can not find host key by ip address. OneDev only populates host key by host name which is enough.

Ok verified that ECDSA also works.

However I am still having an issue during the build to access git tags. The build needs to setup some env variables containing information obtained from git so in my OneDev build I need to retrieve git tags. I have defined a second step of type Execute Command and have been using the bitnami:git image for now (later it will be a custom build environment image). The first command I do is git fetch --all --tags, however it fails with a similar error. Then subsequent errors appear because I need to call git describe --tags

13:23:00 running git fetch --all --tags
13:23:00 Fetching origin
13:23:01 RSA host key for IP address '10.10.10.10' not in list of known hosts.
13:23:01 root@onedev.example.com: Permission denied (publickey).
13:23:01 fatal: Could not read from remote repository.
13:23:01
13:23:01 Please make sure you have the correct access rights
13:23:01 and the repository exists.
13:23:01 error: could not fetch origin
13:23:01 fatal: No names found, cannot describe anything.
13:23:01 fatal: No names found, cannot describe anything.

Seems like the credentials are not setup correctly in the second build step?

This is now fixed in build #2428

Just updated OneDev and indeed it works now. Thanks!