"authentication required but no callback set" when https to ssh redirect is configured in git

[pbek]

Describe the bug

When you have this in your ~/.config/git/config:

[url "ssh://git@github.com/"]
    insteadOf = "https://github.com/"

...then you currently get this error message when creating the devenv.lock file:

✓ Validating lock                                                                                                                                                                                        640ms
  × Failed to lock inputs: 
           … while updating the flake input 'devenv'
   
           … while fetching the input 'github:cachix/devenv'
   
   
           error: connecting to remote 'https://github.com/cachix/devenv.git': authentication required but no callback set

Although doing a git clone https://github.com/cachix/devenv.git works.

To reproduce

• set up the https to ssh redirect in ~/.config/git/config as mentioned above
• mkdir devenv-test && cd devenv-test
• devenv init
• devenv shell
• See error message authentication required but no callback set

Version

devenv 2.1.2 (x86_64-linux)

[sandydoo]

This error is produced by Nix client code that devenv calls via FFI.

Is this something you can reproduce with Nix directly?
If yes/no, which nix --version?

[pbek]

I tried nix flake metadata --refresh github:cachix/devenv and that worked.
My systems are at nix (Nix) 2.34.7.

[muni-corn]

can confirm i'm also getting this issue with this devenv --version:

devenv 2.1.3+1691ad5 (x86_64-linux)

[evantravers]

I'm also getting this:

❯ devenv --version
devenv 2.1.2 (aarch64-darwin)

❯ nix --version
nix (Determinate Nix 3.7.0) 2.29.1

[Ol1BoT]

Also a problem for me

❯ devenv --version
devenv 2.1.2 (aarch64-darwin)
❯ nix --version
nix (Determinate Nix 3.11.2) 2.31.1

Edit

I downgraded to 2.1.1 and I was able to run devenv update and devenv shell

[SebastianCallh]

Same issue

➜ devenv --version
devenv 2.1.2 (x86_64-linux)

➜ nix --version
nix (Nix) 2.34.7

[gaggle]

I have:

$ cat ~/.ssh/config
...
Host github.com
  AddKeysToAgent yes
  IdentityFile ...
  PreferredAuthentications publickey
  UseKeychain yes
  User ...
...

And I get this error:

$ ls
devenv.nix  devenv.yaml
$ devenv shell
✓ Validating lock                                                                                                                                        596ms
  × Failed to lock inputs: 
           … while updating the flake input 'devenv'
   
           … while fetching the input 'github:cachix/devenv'
   
   
           error: connecting to remote 'https://github.com/cachix/devenv.git': authentication required but no callback set

$ devenv --version
devenv 2.1.2 (aarch64-darwin)
$ nix --version
nix (Nix) 2.34.6

(I don't know enough to know the ssh config is related, but I'm including that since the OP has traced the issue to that origin)

I can confirm workaround:

$ nix profile remove devenv
removing 'flake:nixpkgs#legacyPackages.aarch64-darwin.devenv'
$ nix profile install github:cachix/devenv/v2.1.1
warning: 'install' is a deprecated alias for 'add'
$ devenv shell
✓ Validating lock                                                                                                                                          0ms
✓ Configuring shell                                                                                                                                       1.9s
  └ ✓ Configuring cachix                                                                                                                                   0ms
  └ ✓ Evaluating shell 2136 files                                                                                                                         1.9s
    └ ✓ Building  devenv-shell 1 lines                                                                                                                   150ms
    └ ✓ Querying  devenv-shell-env from cache.nixos.org                                                                                                  138ms
    └ ✓ Querying  devenv-shell-env from devenv.cachix.org                                                                                                161ms
    └ ✓ Querying  devenv-shell-env from cache-europe.nrg.maersk.io                                                                                        34ms
    └ ✓ Building  devenv-shell-env                                                                                                                       234ms
✓ Loading tasks                                                                                                                                            2ms
  └ ✓ Evaluating devenv.config.task.config                                                                                                                 0ms
✓ Running tasks                                                                                                                                          167ms
  └ ✓ devenv:enterShell                                                                                                                                   99ms
    └ ✓ devenv:files:cleanup                                                                                                                              68ms
  └ ✓ devenv:enterTest skipped                                                                                                                             0ms
✨ devenv 2.1.1 is out of date. Please update to 2.1.2: https://devenv.sh/getting-started/#installation
hello from devenv
git version 2.53.0
(devenv) % 

LLM has this to say, but take it with usual grains of salt:

Root cause

Your global Git config rewrites GitHub HTTPS URLs to SSH

That’s a common setup. devenv 2.1.2 uses an embedded Nix client (via FFI) to lock flake inputs. That path still tries https://github.com/cachix/devenv.git but doesn’t set up Git/credential callbacks the way the normal nix CLI does, so you get:

authentication required but no callback set

Plain Nix on your machine is fine — I ran nix flake metadata github:cachix/devenv successfully. The failure is specific to devenv 2.1.2’s input locking, triggered by the HTTPS→SSH redirect.

I reproduced it in your project:

devenv update → fails with that auth error
With a clean HOME (no git config), devenv 2.1.2 works. With devenv 2.1.1, devenv update works with your normal environment.

[sandydoo]

We didn't change anything that would break this between v2.1.1 and v2.1.2. There are several layers of caches tarball and git caches that need to be disabled to be able to compare versions like this.

Looking into it.

[pbek]

You also get the same error with other inputs when trying to do a devenv update, like:

✗ devenv update shared
✓ Validating lock 1 files                                                                                                                         17ms
✓ Updating devenv.lock with input shared                                                                                                         600ms
  × Failed to lock inputs:
           … while updating the flake input 'shared'

           … while fetching the input 'github:digital-blueprint/shared'


           error: connecting to remote 'https://github.com/digital-blueprint/shared.git': authentication required but no callback set

[pbek]

devenv 2.1.1 (x86_64-linux) doesn't work either...

# devenv 2.1.1 (x86_64-linux)
nix run github:NixOS/nixpkgs/a2b3c5643a84750efa9362c7d9643dc2d4104237#devenv -- update shared ✓ Validating lock                                                                                                                                 17ms
✓ Updating devenv.lock with input shared                                                                                                         619ms
  × Failed to lock inputs:
           … while updating the flake input 'shared'

           … while fetching the input 'github:digital-blueprint/shared'


           error: connecting to remote 'https://github.com/digital-blueprint/shared.git': authentication required but no callback set
``

[pbek]

devenv 2.1.0 (x86_64-linux) does work!

nix run github:NixOS/nixpkgs/f962f9d446110b36d617402641005542df1a011a#devenv -- update shared
✓ Validating lock                                                                                                                                 15ms
✓ Updating devenv.lock with input shared                                                                                                          1.7s
✓ Downloading  https://github.com/digital-blueprint/shared/archive/2b5a42812f329735218fde4928b72bb256c48976.tar.gz from github.com               563ms
✓ Evaluating devenv.config.changelog.json 1452 files

So the current workaround for updating inputs is using nix run github:NixOS/nixpkgs/f962f9d446110b36d617402641005542df1a011a#devenv

[sandydoo]

I can't replicate this issue on my end and could use some help from you all.

We need a trace from Nix to understand what's going on during the locking process.
Release versions don't currently have a way to enable this type of logging, so I've pushed a branch with an extra debug flag.

If you can replicate this, please run the following and replace <command> with whichever devenv command fails for you:

nix run github:cachix/devenv/feat-debug --accept-flake-config -- --debug --trace-to json:file:trace.json <command>

Compress the trace.json and send it in (attach here, discord DM, etc).