[gmatiukhin]

Read known_hosts when StrictHostKeyChecking enabled to discover server host keys that are known to the runner and set the corresponding algorithms on the helper.

Context

My git server machine has 3 host keys: RSA, ECDSA and Ed25519. One of my runners knows all 3 and has them in known_hosts, a different runner knows only Ed25519. When using this backend from that machine it was failing with ssh: handshake failed: knownhosts: key mismatch while plain ssh worked fine.

go-git selects host key types from known_hosts in connect() only when the ssh.ClientConfig has no HostKeyCallback. But the built-in auth methods (PublicKeys, PublicKeysCallback) always fill one in: SetHostKeyCallbackAndAlgorithms falls back to the known_hosts callback when the helper has none. In that case x/crypto/ssh uses its default order, in which ECDSA is before Ed25519, which made the git server machine to send ECDSA key. Because the failing runner had an entry for the git server machine in known_hosts with a different key, it was failing with key mismatch and not key unknown. OpenSSH prefers the key types it already knows, which is why plain ssh works.

Change

In strict mode the helper keeps a nil HostKeyCallback, so go-git still uses its known_hosts callback and verification is unchanged. Only HostKeyAlgorithms is set, from known_hosts for host:port of the repository (port 22 when the URL has none). StrictHostKeyChecking=no behaves as before.