#6166·mage-ai

add_host_to_known_hosts returns True even when ssh-keyscan fails

Author: graysoncooperCreated Jul 24, 2026Updated Jul 24, 2026

Describe the bug

add_host_to_known_hosts runs ssh-keyscan and returns True unconditionally, without checking the subprocess exit status or whether anything was written. A failed or empty keyscan leaves known_hosts empty yet reports success.

https://github.com/mage-ai/mage-ai/blob/4c6354918d4db743d8f91fbeae036c275ef42701/mage_ai/data_preparation/git/utils.py#L160-L187

python
subprocess.run(
    ['ssh-keyscan', '-t', 'rsa', hostname],
    stdout=known_hosts,
    ...
    check=False,
)
return True

CompletedProcess.returncode is never inspected and the output is never checked, so a returncode-1 / empty-output scan still returns True. The caller only reacts to a False return, so the invalid state (host not actually added to known_hosts) passes silently.

Impact: low but real. With an empty known_hosts, the subsequent SSH clone fails host-key verification, is swallowed by a broad except Exception, and falls back to initializing an empty local repo, so the user gets a silent empty repo instead of a clear "could not fetch host key" error.

Reproduction

  1. Call the git-sync setup path with a hostname ssh-keyscan cannot resolve/reach (or where keyscan returns a non-zero exit with no output).
  2. Observe add_host_to_known_hosts returns True while known_hosts is empty.
  3. The subsequent clone fails host-key verification and falls back to an empty repo, with no surfaced error.

Suggested fix

Inspect the result before returning success: check returncode == 0 and that the scan produced non-empty output (or that the host now appears in known_hosts), and return False / raise otherwise so the caller can surface a real error.

Environment: current master (HEAD 4c63549 at time of report). Path touched by #6117.


Found while testing Ito, an automated code-review tool, against recently-merged PRs. It's free for open source. Sharing this because it looked like a real bug worth fixing, not to sell anything: https://app.ito.ai/share/9fc39be1-b799-48a0-8e73-588da42a731b?tab=details