Azure DevOps Git Repo 错误 - RPC 失败；卷曲 56 失败

Question

我有一个 Azure DevOps 项目，其中包含几个 Git 存储库。当我在“坏”存储库上从命令提示符执行 a 时，git clone我收到以下错误消息：

Cloning into 'myBadRepo'...
remote: Azure Repos
remote: Found 176 objects to send. (0 ms)
error: RPC failed; curl 56 Failure when receiving data from the peer
Receiving objects: 100% (176/176), 10.22 MiB | 25.46 MiB/s, done.
Resolving deltas: 100% (48/48), done.

谷歌搜索curl 56 Failure大多说这是防火墙或代理的问题。我在公司网络上，使用 Cisco AnyConnect 作为 VPN，但关闭它没有什么区别。我的机器还使用 zScaler 来实现“互联网安全”，我知道这会弄乱证书​​，但我无法禁用它。但我怀疑防火墙、代理或证书是主要问题，因为我可以从同一 Azure DevOps 组织和项目成功克隆不同的 Git 存储库：

Cloning into 'myWorkingRepo'...
remote: Azure Repos
remote: Found 107 objects to send. (3 ms)
Receiving objects: 100% (107/107), 859.57 KiB | 29.64 MiB/s, done.
Resolving deltas: 100% (35/35), done.

我尝试按照/sf/answers/4634547221/的建议进行“浅克隆”，并按照/sf/answers/4766827061/ 的建议增加 http.postBuffer ，但都没有使任何差异。

我打开了详细模式和跟踪，按照https://confluence.atlassian.com/stashkb/git-clone-fails-error-rpc-failed-result-56-http-code-200-693897332.html的建议

set GIT_TRACE_PACKET=1
set GIT_TRACE=1
set GIT_CURL_VERBOSE=1

我可以看到两个日志都有重复的警告Info: schannel: failed to decrypt data, need more data，但“工作”存储库已成功克隆，而“坏”存储库有更多此类警告，并且在最后一组 647（！）failed to decrypt消息之后显示关闭的连接，然后是curl 56 Failure：

Info: schannel: server closed abruptly (missing close_notify)
Info: Closing connection 0
channel: shutting down SSL/TLS connection with dev.azure.com port 443
error: RPC failed; curl 56 Failure when receiving data from the peer

下面是“坏”日志的摘录（完整日志太长，无法发布）。两个日志都包含相同的与授权相关的警告和错误，但这并不会阻止“好”存储库的克隆。URL 编码尤其是一个错误

The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource

这个用户aaaaaaa来自哪里？我怀疑，如果我可以配置 Git 和/或 Azure DevOps 存储库，以消除这些与授权相关的警告和错误，那么我的“坏”存储库问题就会得到解决。希望有人能看一下并给我一些建议或指导，谢谢！

“坏”回购日志摘录：

git clone https://myOrganization@dev.azure.com/myOrganization/myDevOpsProject/_git/myBadRepo

05:13:49.157466 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
05:13:49.158466 git.c:459               trace: built-in: git clone https://myOrganization@dev.azure.com/myOrganization/myDevOpsProject/_git/myBadRepo
Cloning into 'myBadRepo'...
05:13:49.180609 run-command.c:654       trace: run_command: git remote-https origin https://myOrganization@dev.azure.com/myOrganization/myDevOpsProject/_git/myBadRepo
05:13:49.194684 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
05:13:49.195683 git.c:748               trace: exec: git-remote-https origin https://myOrganization@dev.azure.com/myOrganization/myDevOpsProject/_git/myBadRepo
05:13:49.196685 run-command.c:654       trace: run_command: git-remote-https origin https://myOrganization@dev.azure.com/myOrganization/myDevOpsProject/_git/myBadRepo
05:13:49.212111 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
05:13:49.220376 http.c:689              == Info: Couldn't find host dev.azure.com in the (nil) file; using defaults
05:13:49.225816 http.c:689              == Info:   Trying 13.107.42.20:443...
05:13:49.244824 http.c:689              == Info: Connected to dev.azure.com (13.107.42.20) port 443 (#0)
05:13:49.245003 http.c:689              == Info: schannel: disabled automatic use of client certificate
05:13:49.313976 http.c:636              => Send header, 0000000240 bytes (0x000000f0)
05:13:49.313976 http.c:648              => Send header: GET /myOrganization/myDevOpsProject/_git/myBadRepo/info/refs?service=git-upload-pack HTTP/1.1
05:13:49.313976 http.c:648              => Send header: Host: dev.azure.com
05:13:49.313976 http.c:648              => Send header: User-Agent: git/2.36.0.windows.1
05:13:49.313976 http.c:648              => Send header: Accept: */*
05:13:49.313976 http.c:648              => Send header: Accept-Encoding: deflate, gzip, br, zstd
05:13:49.313976 http.c:648              => Send header: Pragma: no-cache
05:13:49.313976 http.c:648              => Send header: Git-Protocol: version=2
05:13:49.313976 http.c:648              => Send header:
05:13:49.571301 http.c:689              == Info: schannel: failed to decrypt data, need more data
... 8 lines removed ...
05:13:49.672466 http.c:689              == Info: schannel: failed to decrypt data, need more data
05:13:49.672466 http.c:689              == Info: Mark bundle as not supporting multiuse
05:13:49.672466 http.c:636              <= Recv header, 0000000027 bytes (0x0000001b)
05:13:49.672466 http.c:648              <= Recv header: HTTP/1.1 401 Unauthorized
[....]
05:13:49.672466 http.c:648              <= Recv header: WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/cc808ba9-3e5f-4f13-a70b-5b65bf454995
05:13:49.672466 http.c:636              <= Recv header, 0000000071 bytes (0x00000047)
05:13:49.672466 http.c:648              <= Recv header: WWW-Authenticate: Basic realm="https://tfsprodcus6.visualstudio.com/"
05:13:49.672466 http.c:636              <= Recv header, 0000000033 bytes (0x00000021)
[...]
05:13:49.672466 http.c:648              <= Recv header: X-FRAME-OPTIONS: SAMEORIGIN
05:13:49.672466 http.c:636              <= Recv header, 0000000059 bytes (0x0000003b)
05:13:49.672466 http.c:648              <= Recv header: X-TFS-FedAuthRealm: https://tfsprodcus6.visualstudio.com/
05:13:49.672466 http.c:636              <= Recv header, 0000000059 bytes (0x0000003b)
05:13:49.672466 http.c:648              <= Recv header: X-TFS-FedAuthIssuer: https://dev.azure.com/myOrganization/
05:13:49.672466 http.c:636              <= Recv header, 0000000073 bytes (0x00000049)
05:13:49.672466 http.c:648              <= Recv header: X-VSS-AuthorizationEndpoint: https://vssps.dev.azure.com/myOrganization/
05:13:49.672466 http.c:636              <= Recv header, 0000000060 bytes (0x0000003c)
05:13:49.672466 http.c:648              <= Recv header: X-VSS-ResourceTenant: cc808ba9-3e5f-4f13-a70b-5b65bf454995
05:13:49.672466 http.c:636              <= Recv header, 0000000710 bytes (0x000002c6)
05:13:49.672466 http.c:648              <= Recv header: X-TFS-SoapException: %3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%3Csoap%3AEnvelope%20xmlns%3Asoap%3D%22http%3A%2F%2Fwww.w3.org%2F2003%2F05%2Fsoap-envelope%22%3E%3Csoap%3ABody%3E%3Csoap%3AFault%3E%3Csoap%3ACode%3E%3Csoap%3AValue%3Esoap%3AReceiver%3C%2Fsoap%3AValue%3E%3Csoap%3ASubcode%3E%3Csoap%3AValue%3EUnauthorizedRequestException%3C%2Fsoap%3AValue%3E%3C%2Fsoap%3ASubcode%3E%3C%2Fsoap%3ACode%3E%3Csoap%3AReason%3E%3Csoap%3AText%20xml%3Alang%3D%22en%22%3ETF400813%3A%20The%20user%20%27aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa%27%20is%20not%20authorized%20to%20access%20this%20resource.%3C%2Fsoap%3AText%3E%3C%2Fsoap%3AReason%3E%3C%2Fsoap%3AFault%3E%3C%2Fsoap%3ABody%3E%3C%2Fsoap%3AEnvelope%3E
05:13:49.673499 http.c:636              <= Recv header, 0000000148 bytes (0x00000094)
05:13:49.673499 http.c:648              <= Recv header: X-TFS-ServiceError: TF400813%3A%20The%20user%20%27aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa%27%20is%20not%20authorized%20to%20access%20this%20resource.
05:13:49.673499 http.c:636              <= Recv header, 0000000079 bytes (0x0000004f)
05:13:49.673499 http.c:648              <= Recv header: X-VSS-S2STargetService: 00000002-0000-8888-8000-000000000000/visualstudio.com
05:13:49.673499 http.c:636              <= Recv header, 0000000540 bytes (0x0000021c)
05:13:49.673499 http.c:648              <= Recv header: X-TFS-FedAuthRedirect: https://spsprodcus4.vssps.visualstudio.com/_signin?realm=dev.azure.com&reply_to=https%3A%2F%2Fdev.azure.com%2FmyOrganization%2FmyDevOpsProject%2F_git%2FmyBadRepo%2Finfo%2Frefs%3Fservice%3Dgit-upload-pack&redirect=1&hid=73b36635-d080-433b-9d64-87b14cd2b062&context=eyJodCI6MiwiaGlkIjoiOWE0OWZlYjMtY2FkYS00YWRmLWFkMjItZWZiZWViYWY0NDdhIiwicXMiOnt9LCJyciI6IiIsInZoIjoiIiwiY3YiOiIiLCJjcyI6IiJ90#ctx=eyJTaWduSW5Db29raWVEb21haW5zIjpbImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImh0dHBzOi8vbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSJdfQ2

Answer 1

按照@Philippe 的建议和链接，将 zScaler 证书添加到我的 Git 配置中解决了我的问题。阅读完这些帖子后，我采取的具体步骤是：

\n

\n
• 从 Windows 状态菜单中，运行 \xe2\x80\x9cManage Computer Certifications\xe2\x80\x9d 控制面板应用程序
\n
• 转到“受信任的根证书颁发机构”->“证书”->“Zscaler 根 CA”，右键单击证书将其打开
\n
• 在“详细信息”选项卡上，单击 \xe2\x80\x9c复制到文件\xe2\x80\x9d
\n
• 将打开证书导出向导，单击下一步
\n
• 选择 \xe2\x80\x9cBase-64 编码的 X.509 (.cer)\xe2\x80\x9d 并单击下一步
\n
• 将文件另存为 \xe2\x80\x9cC:\\Users<用户名>\\AppData\\Roaming\\ZscalerRootCA.cer\xe2\x80\x9d，单击完成，然后退出控制面板应用程序
\n
• 通过运行以下命令打开命令提示符并配置 Git 以使用证书：
\n

\n

- git config --global http.sslbackend openssl\n- git config --global http.sslcainfo C:\\Users\\<username>\\AppData\\Roaming\\ZscalerRootCA.cer\n

\n

谢谢！

\n

Answer 2

这绝对是 Zscaler 的问题。我遇到了完全相同的问题（回购协议越大，出现卷曲错误的可能性就越高，但并非总是如此），并在这个答案中找到了解释

唯一的解决方案是使用 Zscaler 证书。

Answer 3

这个用户aaaaaaa来自哪里？

它是（如图所示Azure/azure-devops-cli-extension）_ANONYMOUS_USER_ID。

该错误消息仅意味着匿名用户无法访问此存储库（这是预期的）。

因为即使是浅克隆也不起作用，我会进行测试：

• 执行Azure 管道以查看同步源（即克隆/拉取）步骤是否有效
• 或者在类似的管道中，获取git archive（HEAD 提交内容作为 zip），以便创建新的 Azure Devops 存储库并尝试将该内容推送到其中：这将验证该内容中的某些内容是否有问题。以此为例。