Most git operations over SSH fail with a Socket closed error

[Jassob]

First off, thanks for a great and useful app that has let me use pass on my phone, it has been great!

I recently switched phone to a newer android version (Google Pixel 8, Android 14) and the old app no longer worked so I've tried my luck on the snapshots builds on GitHub releases.
However when I cloned my repository (tried both gitea hosted and github hosted repos) it failed to clone the repository and showed a popup saying "Socket closed" (see attached screenshots).

I've set up the repository settings correctly and also tried with different key algorithms (RSA and ECDSA).

When cloning from my own server I could see the following logs on the server:

Oct 06 21:21:23 nuc sshd[993502]: debug1: userauth_pubkey: publickey test pkalg ecdsa-sha2-nistp256 pkblob ECDSA SHA256:TJ9VfmSOS9B80+RInPFtiooBnC3Db7P0yyazblVfvVg [preauth]
<snip>
Oct 06 21:21:23 nuc sshd[993502]: Accepted key ECDSA SHA256:TJ9VfmSOS9B80+RInPFtiooBnC3Db7P0yyazblVfvVg found at /var/gitea/.ssh/authorized_keys:12
Oct 06 21:21:23 nuc sshd[993502]: Postponed publickey for git from 98.128.173.215 port 49456 ssh2 [preauth]
Oct 06 21:21:23 nuc sshd[993502]: Connection closed by authenticating user git 98.128.173.215 port 49456 [preauth]

And this is what logcat prints when that happens:

2024-10-06 20:08:29.966  8371-8420  net.schmiz...nt.Promise app.passwordstore.debug              D  Awaiting <<authenticated>>
2024-10-06 20:08:29.982  8371-9997  net.schmiz...erAuthImpl app.passwordstore.debug              D  Asking `publickey` method to handle USERAUTH_60 packet
2024-10-06 20:08:29.982  8371-9997  net.schmiz...hPublickey app.passwordstore.debug              D  Key acceptable, sending signed request
2024-10-06 20:08:29.982  8371-9997  net.schmiz...hPublickey app.passwordstore.debug              D  Attempting authentication using app.passwordstore.util.git.sshj.SshKey$KeystoreNativeKeyProvider@acfbb3
2024-10-06 20:08:29.993  8371-9997  net.schmiz...nsportImpl app.passwordstore.debug              E  Dying because - User not authenticated
2024-10-06 20:08:29.993  8371-9997  net.schmiz...nsportImpl app.passwordstore.debug              I  Disconnected - UNKNOWN
2024-10-06 20:08:29.993  8371-9997  net.schmiz...yExchanger app.passwordstore.debug              D  Got notified of net.schmizz.sshj.common.SSHException: User not authenticated
2024-10-06 20:08:29.994  8371-9997  net.schmiz...erAuthImpl app.passwordstore.debug              D  Notified of net.schmizz.sshj.common.SSHException: User not authenticated
2024-10-06 20:08:29.994  8371-9997  net.schmiz...nsportImpl app.passwordstore.debug              D  Setting active service to null-service
2024-10-06 20:08:29.995  8371-8420  net.schmiz...nt.Promise app.passwordstore.debug              E  <<authenticated>> woke to: net.schmizz.sshj.userauth.UserAuthException: User not authenticated
2024-10-06 20:08:29.996  8371-9997  net.schmiz...nt.Promise app.passwordstore.debug              D  Setting <<transport close>> to `SOME`
2024-10-06 20:08:29.996  8371-9997  net.schmiz...ort.Reader app.passwordstore.debug              D  Stopping
2024-10-06 20:08:29.996  8371-8420  net.schmiz...nt.Promise app.passwordstore.debug              D  Clearing <<service accept>>
2024-10-06 20:08:29.997  8371-8420  net.schmiz...nsportImpl app.passwordstore.debug              D  Sending SSH_MSG_SERVICE_REQUEST for ssh-userauth

It seems that something goes wrong after the initial SSH_MSG_USERAUTH_REQUEST (which successfully reports that my key exists), but during the signing it fails.

I've also not been able to put a breakpoint in the code where the socket actually gets closed, I think it is too deep in the stack for my debugging foo to get there yet.

Funnily enough, one clone (out of many) actually succeeded, so I do have a (already outdated) password store on my phone, so it is much more of a nuisance than a real problem for me.

Thanks again for a great app that I've used for many years!

[Jassob]

After some further investigation it seems that the issue stems from when accessing the private key and trying to sign the authentication request. The exception User not authenticated is actually a android.security.keystore.UserNotAuthenticatedException.

Maybe we need to cache the authentication results from the biometric auth some way?

[Jassob]

I tried to recreate the SSH key and skipped protecting it with a screen lock and then the issue went away👌

So it is the integration with the keystore that doesn't really work.

I'll mark this as an answer to help other users that experience this issue and will then add a issue to fix the integration 👌