# ERROR: Command errored out with exit status 128: git clone --filter=blob:none 'git@github.com:user/private-repo.git' /tmp/pip-install-xxx/package. Check the logs for full command output. stderr: git@github.com: Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.

- **ID:** `pip/vcs-git-clone-permission-denied-public-key`
- **Domain:** pip
- **Category:** auth_error
- **Error Code:** `ERROR`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

Pip tries to clone a private Git repository via SSH, but the SSH key is not configured or not accepted by the remote server, causing a public key authentication failure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| pip 23.0 | active | — | — |
| pip 23.2 | active | — | — |
| pip 24.0 | active | — | — |
| git 2.40 | active | — | — |

## Workarounds

1. **Generate an SSH key pair and add the public key to your GitHub account: ssh-keygen -t ed25519 -C 'your_email@example.com'; cat ~/.ssh/id_ed25519.pub (copy output); go to GitHub Settings > SSH and GPG keys > New SSH key; paste and save. Then retry pip install.** (90% success)
   ```
   Generate an SSH key pair and add the public key to your GitHub account: ssh-keygen -t ed25519 -C 'your_email@example.com'; cat ~/.ssh/id_ed25519.pub (copy output); go to GitHub Settings > SSH and GPG keys > New SSH key; paste and save. Then retry pip install.
   ```
2. **Use HTTPS instead of SSH for the Git URL in the requirements file: replace git+ssh://git@github.com/user/private-repo.git with git+https://github.com/user/private-repo.git and use a personal access token (PAT) for authentication: pip install git+https://<PAT>@github.com/user/private-repo.git** (85% success)
   ```
   Use HTTPS instead of SSH for the Git URL in the requirements file: replace git+ssh://git@github.com/user/private-repo.git with git+https://github.com/user/private-repo.git and use a personal access token (PAT) for authentication: pip install git+https://<PAT>@github.com/user/private-repo.git
   ```
3. **If the repository is public, change the URL to use the public HTTPS clone URL without authentication: git+https://github.com/user/public-repo.git** (100% success)
   ```
   If the repository is public, change the URL to use the public HTTPS clone URL without authentication: git+https://github.com/user/public-repo.git
   ```

## Dead Ends

- **Using pip install with --no-deps to skip VCS dependencies** — This only avoids the error for the current install but leaves the missing dependency unresolved, causing import errors later. (95% fail)
- **Adding the SSH key to the ssh-agent with ssh-add without checking the key is correct for the repository** — If the key is not added to the GitHub account or is the wrong key type, authentication still fails. (60% fail)
- **Setting GIT_SSH_COMMAND='ssh -v' to debug but not fixing the underlying key issue** — Debugging alone does not resolve the authentication failure. (90% fail)