Azure-pipelines-agent: TFS On-Premise - Git clone fails with "SSL certificate problem: unable to get local issuer certificate"

[Silthus]

Agent version and platform

Version of your agent? '2.105.7'


Windows Server 2012R2 Standard

VSTS type and version

TFS On-Premise - TFS 2017 RC


TFS 2017 RC

What's not working?

Cloning git repository fails with error message: SSL certificate problem: unable to get local issuer certificate

Agent and Worker's diag log

[2016-11-17 09:30:08Z INFO Program] Version: 2.105.7
[2016-11-17 09:30:08Z INFO Program] Commit: 5f286b1f01c51b7cace8c1649edd6b00893a3649
[2016-11-17 09:30:08Z INFO Program] Culture: de-DE
[2016-11-17 09:30:08Z INFO Program] UI Culture: en-US
[2016-11-17 09:30:09Z INFO ProxyConfiguration] No proxy setting found.
[2016-11-17 09:30:09Z INFO Worker] Waiting to receive the job message from the channel.
[2016-11-17 09:30:09Z INFO Worker] Message received.
[2016-11-17 09:30:12Z INFO Worker] Job message:
 {
  "tasks": [
    {
      "instanceId": "00a491f8-e62e-41cd-9f97-b3c5917513b8",
      "displayName": "GitVersion",
      "enabled": true,
      "continueOnError": false,
      "alwaysRun": false,
      "timeoutInMinutes": 0,
      "id": "e5983830-3f75-11e5-82ed-81492570a08e",
      "name": "GitVersion",
      "version": "3.4.1",
      "inputs": {
        "updateAssemblyInfo": "true",
        "updateAssemblyInfoFilename": "",
        "additionalArguments": "",
        "gitVersionPath": ""
      }
    },
    {
      "instanceId": "73ae9c65-1014-477d-bfc9-f30d884c6d7d",
      "displayName": "NuGet restore **\\*.sln",
      "enabled": true,
      "continueOnError": false,
      "alwaysRun": false,
      "timeoutInMinutes": 0,
      "id": "333b11bd-d341-40d9-afcf-b32d5ce6f23b",
      "name": "NuGetInstaller",
      "version": "0.2.21",
      "inputs": {
        "solution": "**\\*.sln",
        "nugetConfigPath": "",
        "restoreMode": "restore",
        "noCache": "false",
        "nuGetRestoreArgs": "",
        "verbosity": "-",
        "nuGetVersion": "3.3.0",
        "nuGetPath": ""
      }
    },
    {
      "instanceId": "1e852129-bdcc-457e-9bbb-eee5ea63ddd7",
      "displayName": "Build solution **\\*.sln",
      "enabled": true,
      "continueOnError": false,
      "alwaysRun": false,
      "timeoutInMinutes": 0,
      "id": "71a9a2d3-a98a-4caa-96ab-affca411ecda",
      "name": "VSBuild",
      "version": "1.0.45",
      "inputs": {
        "solution": "**\\*.sln",
        "msbuildArgs": "",
        "platform": "$(BuildPlatform)",
        "configuration": "$(BuildConfiguration)",
        "clean": "true",
        "vsVersion": "14.0",
        "maximumCpuCount": "false",
        "restoreNugetPackages": "false",
        "msbuildArchitecture": "x86",
        "logProjectEvents": "true",
        "createLogFile": "false"
      }
    },
    {
      "instanceId": "6ad811c1-ea5c-4054-8c19-bf171343bd37",
      "displayName": "Test Assemblies **\\$(BuildConfiguration)\\*test*.dll;-:**\\obj\\**",
      "enabled": true,
      "continueOnError": true,
      "alwaysRun": false,
      "timeoutInMinutes": 0,
      "id": "ef087383-ee5e-42c7-9a53-ab56c98420f9",
      "name": "VSTest",
      "version": "1.0.60",
      "inputs": {
        "testAssembly": "**\\$(BuildConfiguration)\\*test*.dll;-:**\\obj\\**",
        "testFiltercriteria": "",
        "runSettingsFile": "",
        "overrideTestrunParameters": "",
        "codeCoverageEnabled": "true",
        "runInParallel": "false",
        "vstestLocationMethod": "version",
        "vsTestVersion": "14.0",
        "vstestLocation": "",
        "pathtoCustomTestAdapters": "",
        "otherConsoleOptions": "",
        "testRunTitle": "",
        "platform": "$(BuildPlatform)",
        "configuration": "$(BuildConfiguration)",
        "publishRunAttachments": "true"
      }
    }
  ],
  "requestId": 113,
  "lockToken": "00000000-0000-0000-0000-000000000000",
  "lockedUntil": "0001-01-01T00:00:00",
  "messageType": "JobRequest",
  "plan": {
    "scopeIdentifier": "59da5dbe-d549-4cb7-b864-847438e435cc",
    "planType": "Build",
    "version": 6,
    "planId": "2c76e875-d89a-4431-9c9b-d2cf7fbaa4b3",
    "artifactUri": "vstfs:///Build/Build/218",
    "artifactLocation": null
  },
  "timeline": {
    "id": "bd3fd016-46ad-4d50-894a-6317bbb12aca",
    "changeId": 1,
    "location": null
  },
  "jobId": "28163d23-50a8-4aea-88f2-69cbf1461fd4",
  "jobName": "Build",
  "environment": {
    "endpoints": [
      {
        "data": {
          "repositoryId": "073d2f5c-3405-48bd-8a44-ac9404c8ce11",
          "rootFolder": null,
          "clean": "false",
          "checkoutSubmodules": "True",
          "onpremtfsgit": "True"
        },
        "name": "MyProject",
        "type": "TfsGit",
        "url": "https://tfs.contoso.com/tfs/Windows Services/_git/MyProject",
        "authorization": {
          "parameters": {
            "AccessToken": ********
          },
          "scheme": "OAuth"
        },
        "isReady": false
      }
    ],
    "mask": [
      {
        "type": "regex",
        "value": ********
      },
      {
        "type": "regex",
        "value": ********
      },
      {
        "type": "regex",
        "value": ********
      },
      {
        "type": "regex",
        "value": ********
      }
    ],
    "variables": {
      "system": "build",
      "system.collectionId": "5eda1acf-5026-4352-a3f4-24a7d7170d8e",
      "system.teamProject": "MyProject",
      "system.teamProjectId": "59da5dbe-d549-4cb7-b864-847438e435cc",
      "system.definitionId": "5",
      "build.definitionName": "vNext - [develop] (CD)",
      "build.definitionVersion": "7",
      "build.queuedBy": "Reichenbach, Michael",
      "build.queuedById": "a0508667-83b8-468e-80ee-2d4378309b6e",
      "build.requestedFor": "Reichenbach, Michael",
      "build.requestedForId": "a0508667-83b8-468e-80ee-2d4378309b6e",
      "build.requestedForEmail": "[email protected]",
      "build.sourceVersion": "f5f68e010386c418c96282b16098926e6b58880c",
      "build.sourceBranch": "refs/heads/develop",
      "build.sourceBranchName": "develop",
      "system.debug": "false",
      "BuildConfiguration": "release",
      "BuildPlatform": "any cpu",
      "build.buildId": "218",
      "build.buildUri": "vstfs:///Build/Build/218",
      "build.buildNumber": "$(GITVERSION_FullSemVer)",
      "build.containerId": "165",
      "system.isScheduled": "False",
      "system.hosttype": "build",
      "system.culture": "en-US",
      "system.teamFoundationCollectionUri": "https://tfs.contoso.com/tfs/Windows%20Services/",
      "system.taskDefinitionsUri": "https://tfs.contoso.com/tfs/Windows%20Services/",
      "AZURE_HTTP_USER_AGENT": "TFS_5eda1acf-5026-4352-a3f4-24a7d7170d8e_build_5_218",
      "system.planId": "2c76e875-d89a-4431-9c9b-d2cf7fbaa4b3",
      "system.jobId": "28163d23-50a8-4aea-88f2-69cbf1461fd4",
      "system.timelineId": "bd3fd016-46ad-4d50-894a-6317bbb12aca",
      "build.repository.uri": "https://tfs.contoso.com/tfs/Windows%20Services/_git/MyProject",
      "build.sourceVersionAuthor": "Reichenbach, Michael",
      "build.sourceVersionMessage": "fixed applocker again? :/"
    },
    "systemConnection": {
      "data": {
        "ServerId": "5eda1acf-5026-4352-a3f4-24a7d7170d8e",
        "ServerName": "Windows Services"
      },
      "name": "SystemVssConnection",
      "url": "https://tfs.contoso.com/tfs/Windows Services/",
      "authorization": {
        "parameters": {
          "AccessToken": ********
        },
        "scheme": "OAuth"
      },
      "isReady": false
    }
  }
}
[2016-11-17 09:30:12Z INFO JobRunner] Job ID 28163d23-50a8-4aea-88f2-69cbf1461fd4
[2016-11-17 09:30:12Z INFO ConfigurationStore] currentAssemblyLocation: C:\TFS_Build_Agents\BuildAgent\bin\Agent.Worker.dll
[2016-11-17 09:30:12Z INFO ConfigurationStore] binPath: C:\TFS_Build_Agents\BuildAgent\bin
[2016-11-17 09:30:12Z INFO ConfigurationStore] RootFolder: C:\TFS_Build_Agents\BuildAgent
[2016-11-17 09:30:12Z INFO ConfigurationStore] ConfigFilePath: C:\TFS_Build_Agents\BuildAgent\.agent
[2016-11-17 09:30:12Z INFO ConfigurationStore] CredFilePath: C:\TFS_Build_Agents\BuildAgent\.credentials
[2016-11-17 09:30:12Z INFO ConfigurationStore] ServiceConfigFilePath: C:\TFS_Build_Agents\BuildAgent\.service
[2016-11-17 09:30:13Z INFO JobRunner] Ensure endpoint url match config url base. https://tfs.contoso.com/tfs/Windows Services/_git/MyProject
[2016-11-17 09:30:13Z INFO JobRunner] Ensure System.TaskDefinitionsUrl match config url base. https://tfs.contoso.com/tfs/Windows%20Services/
[2016-11-17 09:30:13Z INFO JobRunner] Ensure System.TFCollectionUrl match config url base. https://tfs.contoso.com/tfs/Windows%20Services/
[2016-11-17 09:30:13Z INFO JobRunner] Ensure SystemConnection url match config url base. https://tfs.contoso.com/tfs/Windows Services/
[2016-11-17 09:30:13Z INFO JobRunner] Ensure System.TFServerUrl match config url base. https://tfs.contoso.com/tfs/Windows%20Services/
[2016-11-17 09:30:13Z INFO JobRunner] Creating job server with URL: https://tfs.contoso.com/tfs/Windows Services/
[2016-11-17 09:30:14Z INFO Worker] Listening for cancel message from the channel.
[2016-11-17 09:30:14Z INFO Worker] Waiting for the job to complete or for a cancel message from the channel.
[2016-11-17 09:30:15Z INFO JobServerQueue] Start process web console line queue.
[2016-11-17 09:30:15Z INFO JobServerQueue] Start process file upload queue.
[2016-11-17 09:30:15Z INFO JobServerQueue] Start process timeline update queue.
[2016-11-17 09:30:15Z INFO JobRunner] Starting the job execution context.
[2016-11-17 09:30:15Z INFO HostContext] Well known directory 'Bin': 'C:\TFS_Build_Agents\BuildAgent\bin'
[2016-11-17 09:30:15Z INFO HostContext] Well known directory 'Root': 'C:\TFS_Build_Agents\BuildAgent'
[2016-11-17 09:30:15Z INFO HostContext] Well known directory 'Work': 'C:\TFS_Build_Agents\BuildAgent\_work'
[2016-11-17 09:30:15Z INFO JobRunner] Validating directory permissions for: 'C:\TFS_Build_Agents\BuildAgent\_work'
[2016-11-17 09:30:15Z INFO JobRunner] Creating task server with https://tfs.contoso.com/tfs/Windows Services/
[2016-11-17 09:30:16Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:16Z INFO JobRunner] Getting job extensions.
[2016-11-17 09:30:16Z INFO ExtensionManager] Getting extensions for interface: 'Microsoft.VisualStudio.Services.Agent.Worker.IJobExtension'
[2016-11-17 09:30:16Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.BuildJobExtension, Agent.Worker
[2016-11-17 09:30:16Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Release.ReleaseJobExtension, Agent.Worker
[2016-11-17 09:30:16Z INFO JobRunner] Adding job prepare extensions.
[2016-11-17 09:30:16Z INFO JobRunner] Adding tasks.
[2016-11-17 09:30:16Z INFO JobRunner] Adding job finally extensions.
[2016-11-17 09:30:16Z INFO JobRunner] Downloading task definitions.
[2016-11-17 09:30:16Z INFO TaskManager] Ensuring task exists: ID 'e5983830-3f75-11e5-82ed-81492570a08e', version '3.4.1', name 'GitVersion', directory 'C:\TFS_Build_Agents\BuildAgent\_work\_tasks\GitVersion_e5983830-3f75-11e5-82ed-81492570a08e\3.4.1'.
[2016-11-17 09:30:16Z INFO TaskManager] Task already downloaded.
[2016-11-17 09:30:16Z INFO TaskManager] Ensuring task exists: ID '333b11bd-d341-40d9-afcf-b32d5ce6f23b', version '0.2.21', name 'NuGetInstaller', directory 'C:\TFS_Build_Agents\BuildAgent\_work\_tasks\NuGetInstaller_333b11bd-d341-40d9-afcf-b32d5ce6f23b\0.2.21'.
[2016-11-17 09:30:16Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:21Z INFO TaskManager] Finished getting task.
[2016-11-17 09:30:22Z INFO TaskManager] Ensuring task exists: ID '71a9a2d3-a98a-4caa-96ab-affca411ecda', version '1.0.45', name 'VSBuild', directory 'C:\TFS_Build_Agents\BuildAgent\_work\_tasks\VSBuild_71a9a2d3-a98a-4caa-96ab-affca411ecda\1.0.45'.
[2016-11-17 09:30:22Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:22Z INFO TaskManager] Finished getting task.
[2016-11-17 09:30:22Z INFO TaskManager] Ensuring task exists: ID 'ef087383-ee5e-42c7-9a53-ab56c98420f9', version '1.0.60', name 'VSTest', directory 'C:\TFS_Build_Agents\BuildAgent\_work\_tasks\VSTest_ef087383-ee5e-42c7-9a53-ab56c98420f9\1.0.60'.
[2016-11-17 09:30:22Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:36Z INFO TaskManager] Finished getting task.
[2016-11-17 09:30:36Z INFO StepsRunner] Processing step: DisplayName='Get Sources', AlwaysRun=False, ContinueOnError=False, Critical=True, Enabled=True, Finally=False
[2016-11-17 09:30:36Z INFO StepsRunner] Starting the step.
[2016-11-17 09:30:36Z INFO ExtensionManager] Getting extensions for interface: 'Microsoft.VisualStudio.Services.Agent.Worker.Build.ISourceProvider'
[2016-11-17 09:30:36Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.ExternalGitSourceProvider, Agent.Worker
[2016-11-17 09:30:36Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.GitHubSourceProvider, Agent.Worker
[2016-11-17 09:30:36Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.SvnSourceProvider, Agent.Worker
[2016-11-17 09:30:36Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.TfsGitSourceProvider, Agent.Worker
[2016-11-17 09:30:36Z INFO ExtensionManager] Creating instance: Microsoft.VisualStudio.Services.Agent.Worker.Build.TfsVCSourceProvider, Agent.Worker
[2016-11-17 09:30:36Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:37Z INFO BuildDirectoryManager] Checking if artifacts directory exists: 'C:\TFS_Build_Agents\BuildAgent\_work\1\a'
[2016-11-17 09:30:37Z INFO BuildDirectoryManager] Creating artifacts directory.
[2016-11-17 09:30:37Z INFO BuildDirectoryManager] Checking if test results directory exists: 'C:\TFS_Build_Agents\BuildAgent\_work\1\TestResults'
[2016-11-17 09:30:37Z INFO BuildDirectoryManager] Creating test results directory.
[2016-11-17 09:30:37Z INFO SourceProvider] Get 'SourcesDirectory': 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:37Z INFO SourceProvider] Get 'SourceBranch': 'refs/heads/develop'
[2016-11-17 09:30:37Z INFO SourceProvider] Get 'SourceVersion': 'f5f68e010386c418c96282b16098926e6b58880c'
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] Repository url=https://tfs.contoso.com/tfs/Windows Services/_git/MyProject
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] targetPath=C:\TFS_Build_Agents\BuildAgent\_work\1\s
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] sourceBranch=refs/heads/develop
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] sourceVersion=f5f68e010386c418c96282b16098926e6b58880c
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] clean=False
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] checkoutSubmodules=True
[2016-11-17 09:30:37Z INFO TfsGitSourceProvider] exposeCred=False
[2016-11-17 09:30:37Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:38Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:38Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:38Z INFO ProcessInvoker]   Arguments: 'version'
[2016-11-17 09:30:38Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work'
[2016-11-17 09:30:38Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:38Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:38Z INFO ProcessInvoker] Process started with process id 6860, waiting for process exit.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Finished process with exit code 0, and elapsed time 00:00:03.2380308.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:41Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Arguments: 'config --get remote.origin.url'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:41Z INFO ProcessInvoker] Process started with process id 4288, waiting for process exit.
[2016-11-17 09:30:41Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Finished process with exit code 0, and elapsed time 00:00:00.3894080.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:41Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Arguments: 'config gc.auto 0'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:41Z INFO ProcessInvoker] Process started with process id 3692, waiting for process exit.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Finished process with exit code 0, and elapsed time 00:00:00.0560164.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:41Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Arguments: 'config --get-all http.https://tfs.contoso.com/tfs/Windows%20Services/_git/MyProject.extraheader'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:41Z INFO ProcessInvoker] Process started with process id 5052, waiting for process exit.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Finished process with exit code 1, and elapsed time 00:00:00.0586334.
[2016-11-17 09:30:41Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:41Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Arguments: 'config --get-all http.proxy'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:41Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:41Z INFO ProcessInvoker] Process started with process id 4336, waiting for process exit.
[2016-11-17 09:30:42Z INFO ProcessInvoker] Finished process with exit code 1, and elapsed time 00:00:00.0529102.
[2016-11-17 09:30:42Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:42Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:42Z INFO ProcessInvoker]   Arguments: '-c http.extraheader="AUTHORIZATION: bearer ********" fetch --tags --prune --progress origin'
[2016-11-17 09:30:42Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:42Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:42Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:42Z INFO ProcessInvoker] Process started with process id 460, waiting for process exit.
[2016-11-17 09:30:42Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:46Z INFO ProcessInvoker] Finished process with exit code 128, and elapsed time 00:00:04.3307264.
[2016-11-17 09:30:46Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:47Z ERR  StepsRunner] Caught exception from step: System.InvalidOperationException: Git fetch failed with exit code: 128
   at Microsoft.VisualStudio.Services.Agent.Worker.Build.GitSourceProvider.<GetSourceAsync>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Worker.Build.BuildJobExtension.<PrepareAsync>d__23.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Worker.JobExtensionRunner.<RunAsync>d__30.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Agent.Worker.StepsRunner.<RunAsync>d__0.MoveNext()
[2016-11-17 09:30:47Z INFO StepsRunner] Step result: Failed
[2016-11-17 09:30:47Z INFO StepsRunner] Current state: job state = 'Failed', step failed = True, critical step failed = True
[2016-11-17 09:30:47Z INFO StepsRunner] Processing step: DisplayName='GitVersion', AlwaysRun=False, ContinueOnError=False, Critical=False, Enabled=True, Finally=False
[2016-11-17 09:30:47Z INFO StepsRunner] Skipping step.
[2016-11-17 09:30:47Z INFO StepsRunner] Processing step: DisplayName='NuGet restore **\*.sln', AlwaysRun=False, ContinueOnError=False, Critical=False, Enabled=True, Finally=False
[2016-11-17 09:30:47Z INFO StepsRunner] Skipping step.
[2016-11-17 09:30:47Z INFO StepsRunner] Processing step: DisplayName='Build solution **\*.sln', AlwaysRun=False, ContinueOnError=False, Critical=False, Enabled=True, Finally=False
[2016-11-17 09:30:47Z INFO StepsRunner] Skipping step.
[2016-11-17 09:30:47Z INFO StepsRunner] Processing step: DisplayName='Test Assemblies **\$(BuildConfiguration)\*test*.dll;-:**\obj\**', AlwaysRun=False, ContinueOnError=True, Critical=False, Enabled=True, Finally=False
[2016-11-17 09:30:47Z INFO StepsRunner] Skipping step.
[2016-11-17 09:30:47Z INFO StepsRunner] Processing step: DisplayName='Post Job Cleanup', AlwaysRun=False, ContinueOnError=False, Critical=False, Enabled=True, Finally=True
[2016-11-17 09:30:47Z INFO StepsRunner] Starting the step.
[2016-11-17 09:30:47Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:47Z INFO SourceProvider] Get 'SourcesDirectory': 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:47Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:47Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Arguments: 'remote set-url origin https://tfs.contoso.com/tfs/Windows%20Services/_git/MyProject'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:47Z INFO ProcessInvoker] Process started with process id 6716, waiting for process exit.
[2016-11-17 09:30:47Z INFO ProcessInvoker] Finished process with exit code 0, and elapsed time 00:00:00.0792628.
[2016-11-17 09:30:47Z INFO ProcessInvoker] Starting process:
[2016-11-17 09:30:47Z INFO ProcessInvoker]   File name: 'C:\TFS_Build_Agents\BuildAgent\externals\git\cmd\git.exe'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Arguments: 'remote set-url --push origin https://tfs.contoso.com/tfs/Windows%20Services/_git/MyProject'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Working directory: 'C:\TFS_Build_Agents\BuildAgent\_work\1\s'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Require exit code zero: 'False'
[2016-11-17 09:30:47Z INFO ProcessInvoker]   Encoding web name: utf-8 ; code page: '65001'
[2016-11-17 09:30:47Z INFO ProcessInvoker] Process started with process id 5748, waiting for process exit.
[2016-11-17 09:30:47Z INFO ProcessInvoker] Finished process with exit code 0, and elapsed time 00:00:00.0582813.
[2016-11-17 09:30:47Z INFO StepsRunner] Step result: 
[2016-11-17 09:30:47Z INFO StepsRunner] Current state: job state = 'Failed', step failed = True, critical step failed = True
[2016-11-17 09:30:47Z INFO JobRunner] Job result: Failed
[2016-11-17 09:30:47Z INFO JobRunner] Completing the job execution context.
[2016-11-17 09:30:47Z INFO JobRunner] Shutting down the job server queue.
[2016-11-17 09:30:47Z INFO JobServerQueue] Fire signal to shutdown all queues.
[2016-11-17 09:30:47Z INFO JobServerQueue] Try to upload 1 log files or attachments, success rate: 1/1.
[2016-11-17 09:30:48Z INFO JobServerQueue] All queue process task stopped.
[2016-11-17 09:30:48Z INFO JobServerQueue] Try to append 1 batches web console lines, success rate: 1/1.
[2016-11-17 09:30:48Z INFO JobServerQueue] Web console line queue drained.
[2016-11-17 09:30:49Z INFO JobServerQueue] Try to upload 2 log files or attachments, success rate: 2/2.
[2016-11-17 09:30:49Z INFO JobServerQueue] File upload queue drained.
[2016-11-17 09:30:49Z INFO JobServerQueue] Timeline update queue drained.
[2016-11-17 09:30:49Z INFO JobServerQueue] All queue process tasks have been stopped, and all queues are drained.
[2016-11-17 09:30:49Z INFO Worker] Job completed.

[TingluoHuang]

@Silthus are you able to run git fetch from normal cmdline prompt on that build machine? have you install the cert on the build machine, since you tfs server configured to use SSL (https)?

[Silthus]

The cert is signed by our trusted root CA and valid. The root cert and the ica certs are both installed in the certificate store of the machine.

I am able to run git fetch in the local command prompt without errors. Is there a way to set the SSL_VERIFY=false flag for the git build agent?

[TingluoHuang]

@Silthus I wouldn't recommend to disable SSL Verify. Is you build agent running as windows service? if so, is your cert installed for that service account as well? when you install the cert, do you install for the "person" or "machine"? You can set system/global git config to ignore SSL_Verify.

[zivillian]

I had the same error and followed the following tutorial, which fixed the error:
https://blogs.msdn.microsoft.com/phkelley/2014/01/20/adding-a-corporate-or-self-signed-certificate-authority-to-git-exes-store/

[ericsciple]

@TingluoHuang should we add to the troubleshooting doc?

[teruyam]

I experienced exact same issue after upgrading VS 2015 / TFS 2015 Update 3 to VS 2017 / TFS 2015 Update 1.
Resolved by adding Enterprise CA certificate to git config –global http.sslCAInfo.

[TingluoHuang]

We published a doc about this.
https://www.visualstudio.com/en-us/docs/build/troubleshooting#git

[MarkIannucci]

@TingluoHuang , we ran into this problem with our domain's root certificate. Our fix was slightly different than the one you suggest in the documentation. We modified the ca-bundle.crt file to include our domain's root cert which we found in the <agent install directory>\externals\git\mingw64\ssl\certs folder.

[TingluoHuang]

@MarkIannucci I won't recommend that approach. the agent will self-update to pull down new externals folder every time, once your agent update you will loss your fix.

[MarkIannucci]

@TingluoHuang , Thanks for the response. It sounds like the approach that you're recommending in the documentation would be safe version to version. Is that true?

[TingluoHuang]

@MarkIannucci yes, since you set the global/system level git config, not matter which version/copy of the git been used, those setting should take affect.

[JohannBlais]

@TingluoHuang I used the commands you mentioned in the documentation. The --system updated the .gitconfig in the externals\git\mingw64\etc folder. I am concerned that this config file will be overwritten if the agent updates. And the --global updated the .gitconfig in my user profile, so I fear I also have to run the command for the service account the agent is using.
In the end, there would be no reliable way to set this parameter once and for all users, even if the agent updates. Am I right?

[TingluoHuang]

@JohannBlais I think you are right, i forget the system level config also in the git we packaged. i think --global might still be an reasonable way, since there are different ways to create user level .gitconfig, you can even just create the file yourself in notepad and put in the right user folder. :)

[JohannBlais]

@TingluoHuang thank you for your reply. I think I will add a step to the build agent provisioning procedure to create the .gitconfig and deploy it to the service account home folder (along with the root CA certificate). I could even put that in the config.cmd and create a customized agent package.

[mackayj]

I tried running the --global a dozen times, it looks like it updates it in c:\windows\system32\ folder. Did not work at all. I did a --system and I think that one finally worked.

I ended up just turning off sslVerify with: git config --system http."https://our.internal:port/".sslVerify false

[TingluoHuang]

@mackayj --global should update .gitconfg under C:users\foo. who is the running as user?

[mackayj]

@TingluoHuang I was doing run-as command prompt using our service account credentials so it would effect that account

Using git config --global --show-origin --list was showing the c:\windows\system32 path

[TingluoHuang]

This is the tricky one. When using the Windows command shell, batch scripts or Windows programs, the file will be read from

%USERPROFILE%\.gitconfig
However, when you're using msys (bash) this will be read from

$HOME/.gitconfig
Yet another different location can be found from within Emacs (for instance by using magit) when Emacs is started from a Windows command shell. Emacs sets the HOME variable as %APPDATA%, which means that .gitconfig will reside in

%APPDATA%\.gitconfig
This configuration file can be read using

Can you check your environment variable?
%USERPROFILE% and %APPDATA% for the service account?
is your service account NetworkService/LocalSystem?

[kosmossync]

Please reopen this bug.

The git version used is so old that it didn't support
[http] sslBackend = schannel
This feature is introduced in this git commit:
https://github.com/git-for-windows/git/commit/d81216ee4dd46ae59a388044d1266d6fa9030c19

If Microsoft SChannel is used as a backend all certificates from windows certificate store are used.

In my opinion the agent on windows should use SChannel as default.

PS: The Visualstudio installed git should change this setting, too.

[TingluoHuang]

@kosmossync we don't get legal approval for shipping latest version git with the agent yet. We can switch once we get approval.

[kosmossync]

@TingluoHuang
Any chances that the new Version will be used in TFS 2018 RTM with change to Schannel as default?

[bryanmacfarlane]

reopening for consideration

[Miles-Davies-HORIBA]

I have the issue still and am unable to get the suggested solutions working unless sslBackend is set to schannel. I think this then uses the certificate store rather than the certs file.

[creampie]

Same here, it is really annoying. Any plans to fix it?
BTW - shouldn't this be labeled as a bug?

[thecontrarycat]

Why has this taken nearly a year to get fixed? Every time the TFS agent updates we have to go through this rigmarole on every single build agent. Tedious, and extremely annoying when we all know there's a solution but it's just not been integrated yet.

[TingluoHuang]

@thecontrarycat why you need to touch every single build agent on updates? you should be able to set user level git config once, then you should be good.

[TingluoHuang]

i will try to switch git to use schannel for ssl backend in next agent release after testing, i checked we already has the version of git that support this feature.

[TingluoHuang]

@thecontrarycat i did some testing, looks like Schannel has requirements on your certificate, ex, you cert needs to have CRL distribution point set properly.
do you have that in your cert today?

[creampie]

@TingluoHuang I change ssl backend to schannel manually on each build agent. So if you set this as default, the problem is solved for me. I use an AD domain certificate generated on my own CA and pushed to all clients via schannel. I believe this is what most people do.

[thecontrarycat]

@TingluoHuang We've had problems with the system and global configs being lost every time a new Agent version is released. We didn't use a user level config because the agents are running as Network Service.

[VeryCrazyDog]

@thecontrarycat My agents are running as Network Service too but that wasn't really a problem to use user level config. Here is what I did:

1. Save all the necessary certificates in folder %systemroot%\ServiceProfiles\NetworkService\.gitcerts\.
2. Create a file at %systemroot%\ServiceProfiles\NetworkService\.gitconfig with the following content:

[http "https://tfs.com/"]
    sslCAInfo = ~/.gitcerts/certificate.pem

[TingluoHuang]

1377

[jeckerbom]

How do the Git agent use client certificate and where are that located?
Should the certificate.pem file even contain clientcert or only the CA cert chains?

Does anyone knows when MS ships the new VS version with an updated Git agent (2.14 or newer..) with schannel possibilities.

[TingluoHuang]

@jeckerbom check the following doc see whether that is what you needed https://github.com/Microsoft/vsts-agent/blob/master/docs/design/clientcert.md

the latest version of VS should contains the latest version git.

[TingluoHuang]

Hi all, I release 2.129.0 agent on github which contains git SChannel support.
https://github.com/Microsoft/vsts-agent/releases/tag/v2.129.0

To enable git to use SChannel, you need to pass --gituseschannel during agent config.
ex:

 ./config.cmd --gituseschannel

Please try out if you are interested in the feature.

[creampie]

@TingluoHuang Works like a charm. Thanks man!

[jeckerbom]

But I'm little confused about this... VS has a built in Git agent and that agent can not be upgraded...? Reference from Microsoft.

[bryanmacfarlane]

@jeckerbom - yes, the agent can be upgraded. You can download 2.129.0 from GH releases. We also support in place updates via the admin web UI but since this is config option, you will need to configure a new agent or stop existing one after updating and reconfigure. Agent supports SxS on a machine.

@creampie - thanks for validating!

[aricbernard]

Please update --help to reflect the parameter --gituseschannel

[cawoodm]

I'm getting the same error although I have schannel enabled globally in git http.sslbackend=schannel.
The pipeline log however says schannelSslBackend=False.

[FlorisDevreese]

I fixed the issue by setting the NODE_EXTRA_CA_CERTS environment variable to the path of the certificate used by Azure DevOps