[JENKINS-73504] Unable to use a remote git repository which uses SHA256 hashing - fatal: mismatched algorithms: client sha1; server sha256

[jenkins-infra-bot]

Hi,

I'm trying to set up a new build job which need to do a checkout from a forgejo/gitea repository.
This repository was created with a SHA256 hash algorithm.

When the jenkins buildjob runs for the first time it creates a local repositiory using the following command:

git init /buildsystem/.jenkins/....

This command creates the local repository with the default hash algorithm, SHA1.
Because of this, it is incompatible with the remote repo, resulting in the following error when fetching the repo.

fatal: mismatched algorithms: client sha1; server sha256

The complete build output: JENKINS-73504">jenkins_git_sha256.txt

Is SHA256 hashing supported, and if not, can it be added?
The local repo creation should be done with the following command:

git init --object-format=sha256 /buildsystem/.jenkins/....

Regards,

Tom

---

Originally reported by toms, imported from: Unable to use a remote git repository which uses SHA256 hashing - fatal: mismatched algorithms: client sha1; server sha256

• status: Open
• priority: Minor
• component(s): git-client-plugin
• resolution: Unresolved
• votes: 2
• watchers: 4
• imported: 20251211-071809

Raw content of original issue

Hi,

I'm trying to set up a new build job which need to do a checkout from a forgejo/gitea repository.
This repository was created with a SHA256 hash algorithm.

When the jenkins buildjob runs for the first time it creates a local repositiory using the following command:

git init /buildsystem/.jenkins/....


This command creates the local repository with the default hash algorithm, SHA1.
Because of this, it is incompatible with the remote repo, resulting in the following error when fetching the repo.

fatal: mismatched algorithms: client sha1; server sha256


The complete build output: jenkins_git_sha256.txt
Is SHA256 hashing supported, and if not, can it be added?
The local repo creation should be done with the following command:

git init --object-format=sha256 /buildsystem/.jenkins/....


Regards,
Tom

1 attachment

• jenkins_git_sha256.txt

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  SHA256 object format is not yet supported by the git plugin.  I don't have any immediate plans to add support for SHA256 object format.  The last time I read information about SHA256 object format, it seemed like the git community was still trying to find the path that they want to follow for wider adoption of SHA256 object format.
  
  You're welcome to start a pull request to add an option to use SHA256 object format.  I suspect there will be many places that need to change in many plugins.
  
  Short term, you could replace the use of the git plugin in your Pipeline with shell commands wrapped in a withCredentials block.  That gives you complete control of command line git and its arguments.
  

SHA256 object format is not yet supported by the git plugin. I don't have any immediate plans to add support for SHA256 object format. The last time I read information about SHA256 object format, it seemed like the git community was still trying to find the path that they want to follow for wider adoption of SHA256 object format.

You're welcome to start a pull request to add an option to use SHA256 object format. I suspect there will be many places that need to change in many plugins.

Short term, you could replace the use of the git plugin in your Pipeline with shell commands wrapped in a withCredentials block. That gives you complete control of command line git and its arguments.

[jenkins-infra-bot]

derdeagle:

• Original comment link
• Raw content of original comment:

  I, too, stumbled this error message.
  
  SHA256 in Git was introduced several years ago. Do you see any chance of getting this implemented? Since Git 2.42 (from somewhere around August 2023) this is not an experimental feature anymore and no breaking changes are expected to be implemented (see https://github.com/git/git/blob/master/Documentation/RelNotes/2.42.0.txt).
  
   
  
  May I please ask you to take another look at it?
  

I, too, stumbled this error message.

SHA256 in Git was introduced several years ago. Do you see any chance of getting this implemented? Since Git 2.42 (from somewhere around August 2023) this is not an experimental feature anymore and no breaking changes are expected to be implemented (see https://github.com/git/git/blob/master/Documentation/RelNotes/2.42.0.txt).

 

May I please ask you to take another look at it?

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  @derdeagle
  
  May I please ask you to take another look at it?
  
  I don't plan to look at it.  The major git hosting providers do not support SHA-256 checksums.  Local repositories and self-hosted repositories can use SHA-256 if they are running sufficiently new enough versions of command line git, but most Jenkins users are accessing repositories from a git hosting provider like GitHub, GitLab, Bitbucket, Gitea, or Assembla and won't have any chance to use SHA-256 until the hosting providers have implemented support for it.
  
  Now that we've dropped support for Red Hat Enterprise Linux 7 and its derivatives, we no longer need to worry about compatibility with command line git 1.8.  However, the Jenkins project still supports Ubuntu 20 and it provides git 2.25 with no support for SHA-256.
  
  We still support many other operating systems with git versions that treat SHA-256 support as experimental, including:
  
  
  	
  Debian 11 - git 2.30
  	
  Debian 12 - git 2.39
  	
  openSUSE 15 - git 2.35
  	
  Ubuntu 22 - git 2.34
  
  
  
  If someone wants to submit a pull request to the git client plugin to add support for SHA-256, I'm willing to consider the pull request, so long as the pull request does not break existing users, includes automated tests, and has been well tested with the command line git versions that are common on the operating systems that Jenkins supports.
  

@derdeagle

May I please ask you to take another look at it?

I don't plan to look at it. The major git hosting providers do not support SHA-256 checksums. Local repositories and self-hosted repositories can use SHA-256 if they are running sufficiently new enough versions of command line git, but most Jenkins users are accessing repositories from a git hosting provider like GitHub, GitLab, Bitbucket, Gitea, or Assembla and won't have any chance to use SHA-256 until the hosting providers have implemented support for it.

Now that we've dropped support for Red Hat Enterprise Linux 7 and its derivatives, we no longer need to worry about compatibility with command line git 1.8. However, the Jenkins project still supports Ubuntu 20 and it provides git 2.25 with no support for SHA-256.

We still support many other operating systems with git versions that treat SHA-256 support as experimental, including:

• Debian 11 - git 2.30
• Debian 12 - git 2.39
• openSUSE 15 - git 2.35
• Ubuntu 22 - git 2.34

If someone wants to submit a pull request to the git client plugin to add support for SHA-256, I'm willing to consider the pull request, so long as the pull request does not break existing users, includes automated tests, and has been well tested with the command line git versions that are common on the operating systems that Jenkins supports.

[jenkins-infra-bot]

hades:

• Original comment link
• Raw content of original comment:

  I faced this issue too, and found this expaination after 2 days...
  Is ist possible to add a note  to the plugin that only SHA1  is supported yet?
  
  Hades
  

I faced this issue too, and found this expaination after 2 days...
Is ist possible to add a note  to the plugin that only SHA1  is supported yet?

Hades

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  hades thanks for your interest.  Yes, you're welcome to submit a pull request to the plugin documentation to note that the Jenkins git plugin currently does not support SHA-256.
  

hades thanks for your interest. Yes, you're welcome to submit a pull request to the plugin documentation to note that the Jenkins git plugin currently does not support SHA-256.

[jenkins-infra-bot]

hades:

• Original comment link
• Raw content of original comment:

  Will it be possible to use the git binary by the plagin (as a wrapper above)?
  Sorry, i'm not a developer 
  

Will it be possible to use the git binary by the plagin (as a wrapper above)?
Sorry, i'm not a developer

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  The git plugin uses the API provided by the git client plugin to perform its git operations.  The git client plugin includes the reference implementation that uses command line git and an additional implementation that uses JGit.  Users are allowed to choose their implementation at runtime.  Most users choose the command line git implementation because it is the reference implementation and has the most features.
  
  The git client plugin calls command line git, but it does not include any logic to support commits that are SHA-256 hashed.  There may be errors reported when calculating changelogs or creating HTTP links to commits because some of the functions probably assume SHA-1 hashes.  There may be other errors reported because no work has been done to add SHA-256 support to the Jenkins git client plugin or any of its consumers.
  

The git plugin uses the API provided by the git client plugin to perform its git operations. The git client plugin includes the reference implementation that uses command line git and an additional implementation that uses JGit. Users are allowed to choose their implementation at runtime. Most users choose the command line git implementation because it is the reference implementation and has the most features.

The git client plugin calls command line git, but it does not include any logic to support commits that are SHA-256 hashed. There may be errors reported when calculating changelogs or creating HTTP links to commits because some of the functions probably assume SHA-1 hashes. There may be other errors reported because no work has been done to add SHA-256 support to the Jenkins git client plugin or any of its consumers.