semaphoreui/semaphore · error

Unknown SSH strict host key check option

Error message

Unknown SSH strict host key check option

What it means

Produced by gitHostKeyCheckingOpts in pkg/ssh/agent.go when the configured config.ssh.strict_host_key_checking value matches none of the recognised options (yes/accept-new/no style values). It is a generic config-validation guard: the switch falls through to a default branch, and the offending input is the string set in the Semaphore configuration for SSH host-key checking.

Solutions

1. Correct the strict_host_key_checking value in the Semaphore config file (or SEMAPHORE_SSH_STRICT_HOST_KEY_CHECKING env var) to one of the supported enum values
2. Remove the misspelled option entirely so the documented default (accept-new with a TOFU known_hosts file) applies
3. Check the util.SshStrictHostKeyChecking* constants for the exact accepted strings and use one of them verbatim

When it happens

Trigger: Thrown at pkg/ssh/agent.go:181 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/54603d14bc7bbb75. Report an issue: GitHub.

Appendix: source

Thrown at pkg/ssh/agent.go:181

	return env
}

// gitHostKeyCheckingOpts returns the ssh host-key verification options used for
// git operations. Host-key checking is enabled so a network attacker cannot
// impersonate the git server. When an explicit known_hosts file is configured
// it is used with strict checking; otherwise a persistent trust-on-first-use
// file under TmpPath is used (accept-new): the first host key seen is pinned and
// any subsequent change is rejected.
func gitHostKeyCheckingOpts() string {
	switch util.Config.Ssh.StrictHostKeyChecking {
	case util.SshStrictHostKeyCheckingYes:
		return fmt.Sprintf("-o StrictHostKeyChecking=yes -o UserKnownHostsFile=%s", util.Config.Ssh.KnownHostsFile)
	case util.SshStrictHostKeyCheckingNo:
		return "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
	case util.SshStrictHostKeyCheckingAcceptNew:
		return fmt.Sprintf("-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=%s", util.Config.Ssh.KnownHostsFile)
	default:
		panic("Unknown SSH strict host key check option")
	}
}

func (key *AccessKeyInstallation) Destroy() error {
	if key.SSHAgent != nil {
		return key.SSHAgent.Close()
	}
	return nil
}

type KeyInstaller struct{}

func (KeyInstaller) Install(key db.AccessKey, usage db.AccessKeyRole, logger task_logger.Logger) (installation AccessKeyInstallation, err error) {

	switch usage {
	case db.AccessKeyRoleGit:
		switch key.Type {
		case db.AccessKeySSH:

View on GitHub (pinned to 1774ccb71a)