{"record":{"id":"54603d14bc7bbb75","repo":"semaphoreui/semaphore","slug":"unknown-ssh-strict-host-key-check-option","errorCode":null,"errorMessage":"Unknown SSH strict host key check option","messagePattern":"Unknown SSH strict host key check option","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ssh/agent.go","lineNumber":181,"sourceCode":"\treturn env\n}\n\n// gitHostKeyCheckingOpts returns the ssh host-key verification options used for\n// git operations. Host-key checking is enabled so a network attacker cannot\n// impersonate the git server. When an explicit known_hosts file is configured\n// it is used with strict checking; otherwise a persistent trust-on-first-use\n// file under TmpPath is used (accept-new): the first host key seen is pinned and\n// any subsequent change is rejected.\nfunc gitHostKeyCheckingOpts() string {\n\tswitch util.Config.Ssh.StrictHostKeyChecking {\n\tcase util.SshStrictHostKeyCheckingYes:\n\t\treturn fmt.Sprintf(\"-o StrictHostKeyChecking=yes -o UserKnownHostsFile=%s\", util.Config.Ssh.KnownHostsFile)\n\tcase util.SshStrictHostKeyCheckingNo:\n\t\treturn \"ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null\"\n\tcase util.SshStrictHostKeyCheckingAcceptNew:\n\t\treturn fmt.Sprintf(\"-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=%s\", util.Config.Ssh.KnownHostsFile)\n\tdefault:\n\t\tpanic(\"Unknown SSH strict host key check option\")\n\t}\n}\n\nfunc (key *AccessKeyInstallation) Destroy() error {\n\tif key.SSHAgent != nil {\n\t\treturn key.SSHAgent.Close()\n\t}\n\treturn nil\n}\n\ntype KeyInstaller struct{}\n\nfunc (KeyInstaller) Install(key db.AccessKey, usage db.AccessKeyRole, logger task_logger.Logger) (installation AccessKeyInstallation, err error) {\n\n\tswitch usage {\n\tcase db.AccessKeyRoleGit:\n\t\tswitch key.Type {\n\t\tcase db.AccessKeySSH:","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/pkg/ssh/agent.go#L163-L199","documentation":"Produced by gitHostKeyCheckingOpts in pkg/ssh/agent.go when the configured config.ssh.strict_host_key_checking value matches none of the recognised options (yes/accept-new/no style values). It is a generic config-validation guard: the switch falls through to a default branch, and the offending input is the string set in the Semaphore configuration for SSH host-key checking.","triggerScenarios":"Thrown at pkg/ssh/agent.go:181 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct the strict_host_key_checking value in the Semaphore config file (or SEMAPHORE_SSH_STRICT_HOST_KEY_CHECKING env var) to one of the supported enum values","Remove the misspelled option entirely so the documented default (accept-new with a TOFU known_hosts file) applies","Check the util.SshStrictHostKeyChecking* constants for the exact accepted strings and use one of them verbatim"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}