{"record":{"id":"0b51706aa63d7255","repo":"docker/compose","slug":"failed-to-access-repository-at-s-s","errorCode":null,"errorMessage":"failed to access repository at %s:\n %s","messagePattern":"failed to access repository at (.+?):\n (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/remote/git.go","lineNumber":181,"sourceCode":"\t}\n\n\tif relPath == \"..\" || strings.HasPrefix(relPath, \"../\") || strings.HasPrefix(relPath, \"..\\\\\") {\n\t\treturn fmt.Errorf(\"git subdirectory escapes base directory: %s\", subDir)\n\t}\n\n\treturn nil\n}\n\nfunc (g gitRemoteLoader) resolveGitRef(ctx context.Context, path string, ref *gitutil.GitRef) error {\n\tif !commitSHA.MatchString(ref.Ref) {\n\t\tcmd := exec.CommandContext(ctx, \"git\", \"ls-remote\", \"--exit-code\", ref.Remote, ref.Ref)\n\t\tcmd.Env = g.gitCommandEnv()\n\t\tout, err := cmd.CombinedOutput()\n\t\tif err != nil {\n\t\t\tif cmd.ProcessState.ExitCode() == 2 {\n\t\t\t\treturn fmt.Errorf(\"repository does not contain ref %s, output: %q: %w\", path, string(out), err)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"failed to access repository at %s:\\n %s\", ref.Remote, out)\n\t\t}\n\t\tif len(out) < 40 {\n\t\t\treturn fmt.Errorf(\"unexpected git command output: %q\", string(out))\n\t\t}\n\t\tsha := string(out[:40])\n\t\tif !commitSHA.MatchString(sha) {\n\t\t\treturn fmt.Errorf(\"invalid commit sha %q\", sha)\n\t\t}\n\t\tref.Ref = sha\n\t}\n\treturn nil\n}\n\nfunc (g gitRemoteLoader) checkout(ctx context.Context, path string, ref *gitutil.GitRef) error {\n\terr := os.MkdirAll(path, 0o700)\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/remote/git.go#L163-L199","documentation":"`git ls-remote` failed with an exit code other than 2 — the command itself could not complete against the remote. The message embeds the remote URL and the raw git output (stderr included, since CombinedOutput is used), which typically names the real cause: auth failure, DNS/network error, or repository not found.","triggerScenarios":"No network connectivity, `SSL certificate problem`, `Repository not found`, `could not read Username` (missing credentials for private repos), or a malformed remote URL — all returned when resolving a git include ref.","commonSituations":"CI runners without git credentials for private includes; corporate proxies intercepting TLS; typos in the remote URL; running with `--offline` incorrectly set; SSH remotes without keys.","solutions":["Read the embedded git output — it states the underlying failure (auth, TLS, DNS)","Verify access manually: `git ls-remote <remote>` from the same machine/user","For private repos over HTTPS, configure a credential helper or use an SSH remote with a loaded key","Fix network/proxy issues (HTTPS_PROXY, CA certs) if TLS or DNS is the cause"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# preflight connectivity and auth to the git remote\ngit ls-remote https://github.com/org/repo.git HEAD >/dev/null \\\n  || { echo \"cannot reach/authenticate git remote\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"# transient network/TLS failures when loading git includes may be retried with backoff\nfor i in 1 2 3; do\n  if docker compose config >/dev/null 2>err.txt; then break; fi\n  grep -qE 'failed to access repository' err.txt || { cat err.txt >&2; exit 1; }\n  sleep $((i * 2))\ndone","preventionTips":["Configure git credentials (credential helper / SSH key) in every environment using private includes","Trust corporate CA certs (git config http.sslCAInfo) behind TLS-intercepting proxies","Run compose with --offline in network-isolated builds only when the cache is pre-warmed"],"tags":["compose","git-remote","network","authentication"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}