[BUG] Android 17: cannot clone repository from server in the local network

[fawick]

Describe the bug

I receive a Git operation error while cloning new repository from ssh://git@192.168.42.42:2222/foo/pass.git. The fine-printed error message is

failed to connect from /192.168.42.42 (port 2222) from /:: (port 40704): connect failed: ECONNABORTED (Software caused connection abort)

My pass repository remote is in a Forgejo instance which runs its SSH server on port 2222. I can clone the password store repository to my phone in Termux just fine (I run git clone ssh://git@192.168.42.42:2222/foo/pass.git on the Termux command line on the phone), so it is really not a network issue or reachability problem.

Steps to reproduce

Steps to reproduce the behavior:

1. Install app and start by cloning repository
2. Enter my Git repo URL
3. Click on "Clone!"
4. See error

Expected behavior

The repository is cloned.

Screenshots

No response

Device information

• Device: Google Pixel 6
• OS: Android 17
• App version: 2.0.0

Additional context

No response

[agrahn]

Did you try connecting with the same ssh private key file that you use when connecting from termux?

[fawick]

No, I have not. But in both cases the ED25119 key pairs were generated explictely beforehand and the pubkeys were registered with the Forgejo user account.

But the SSH key I used for trying to clone in APS was generated in APS before the clone attempt (key name is nn@aps), and I registered the pubkey with Forgejo.

In Termux, I created another SSH key pair with ssh-keygen in Termux and registered that pubkey as well before attempting the command line clone.

I can see in forgejo, that it thinks that the nn@aps has no activity, so - whatever the problem is - it seems to occur before SSH authentication.

[fawick]

(Sorry, I hit the wrong button and marked this as completed. The issue is not resolved for me, so I reopened.)

[fawick]

For the sake of completeness: I imported the SSH private key that I generated in Termux and tried to clone with that one. It does not make any difference, I get the same error messages.

[agrahn]

Hard to say what happens without running forgejo myself. Which steps are needed to set up a forgejo instance running an sshd?

[fawick]

The easiest and least-instrusive way is probably using the docker-compose.yml from https://forgejo.org/docs/latest/admin/installation/docker/.

In my case, I migrated from a Gitea instance to Forgejo (which is a Gitea fork, which itself started as a Gogs fork) and continued to my existing config (ArchLinux, pacman -S forgejo, also see https://wiki.archlinux.org/title/Forgejo). Which is why I am still using port 2222 instead of the nowadays standard port 222 for SSH.

AFAIK, the default installation of forgejo starts its integrated SSH server without further changes to the default configuration. YMMV.

[fawick]

Can this be a case of missing permissions? I just saw https://developer.android.com/privacy-and-security/local-network-permission and saw which describes a new permission that gets enforced with Android 17 (which I have on my phone). According to what I can grasp from the docs this permission is required for making outgoing TCP connections (such as to an SSH server on port 2222 in my case)

I'm not sure whether APS 2.0 is affected by this, as it's target SDK is Android 14 according to the release notes.

[agrahn]

Could be. The newest device that I can run tests on is a tablet with Android 16. As APS targets still api-level 36 (which is Android 16) it should actually not be affected, as far as I can tell after reading the linked page.

Did you try to clone from another ssh server in the local network, a PC for example?

[fawick]

Did you try to clone from another ssh server in the local network, a PC for example?

Thanks for the suggestion, I just tried that. Cloning e.g. ssh://user@192.168.42.42/home/user/pass did not work, either. Same error message.

To test whether this is really due to accessing the "local network", I then explicitely copied the checked out repo to an Host under my control in an external data center and tried to clone with the FQDN: ssh://testuser@example.com/home/testuser/pass and ... that worked.

EDIT: So at least on my phone with Android 17 it seems APS is indeed limited to repository remotes that are available over the Internet and explictely not in my LAN. I am unsure how I should feel about this.

[fawick]

(I really hate that the default action on an CTRL-ENTER in an Github editor is "Close with comment" instead of comment)

[agrahn]

Oh my, thanks a lot for figuring this out! I'll be seeing what I can do, perhaps raising target sdk to 37 and request the ACCESS_LOCAL_NETWORK permission in the app's manifest file. I hope my (relatively new) tablet gets an update soon to v17 allowing me to run more tests.