Download Xcode Github PATCHED
Nichol Sadlon
Check out my post on this topic Setting up a git repository in XCode for a pre-existing project. The above is correct, but it will include UserInterfaceState in your changes as you commit and this could be annoying because this file updates everytime you do anything in xcode, even if it is as simple and navigating through files or folders in your project.
For Xcode 9: Go to Xcode-> Preferences-> Accounts. Under "Source Control Accounts", delete your github account that is saved there and re-create it. If it isn't obvious, use the - or + sign to delete or create a new one.
My /Library/Preferences/com.apple.dt.Xcode.plist (which Xcode apparently uses for storing known hosts?) contains github.com mapped to 1627aca576282d36631b564debdfa648. This also looks correct (except for using MD5 in 2021, but that is another issue).
Interestingly, when I try to resolve these packages using the command xcodebuild -resolvePackageDependencies things work without changing any known hosts. The same is true when I try to clone the repositories just using git. doing ssh-keyscan github.com also returns the RSA public key, which SHA264 hashes and MD5 hashes to the expected values.
A possibility is that when resolving packages from the Xcode GUI, I am really not talking to github.com, but someone/thing else. How can I debug this. Is there some verbose mode where I can get more information? Something like what GIT_SSH_COMMAND="ssh -vvv" git clone example provides on the command line.
One thing that comes into play is that resolving packages in Xcode uses Xcode's built-in SCM support and account system whereas xcodebuild uses SwiftPM's (which is essentially shelling out to git directly) because that has proven to work more reliable in CI contexts which is the typical use case of xcodebuild. You can switch to Xcode's built-in SCM support by passing -scmProvider xcode.
In any case, if I obtain GitHub's ECDSA hostkey by doing ssh-keyscan -t ecdsa github.com and then MD5 hash it (after checking the SHA265 hash matches the published one, and performing necessary base64 to/from hex conversions), I indeed get: 7B99811E4C91A50D5A2E2E80133F24CA.
This is kind of a tough one to search for but I did find this SO Q&A titled: Xcode source control wrong username on github. There's an answer there that shows the use of a CLI tool called xcrun to manipulate your Github credentials that are stored in Xcode, for eg:
dafc88bca6