# Xcodebuild and SPM dependency SSH fingerprint failed to verify
**URL:** https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877
**Category:** Question & Answer
**Created:** [November 17, 2020, 5:37am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877 "2020-11-17T05:37:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@steveroy](https://discuss.bitrise.io/u/steveroy)
#### Post date: [November 17, 2020, 5:37am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877/1 "2020-11-17T05:37:46Z")
Hello everyone. I added a dependency to my Xcode project using Swift Package Manager. The dependency is a private repo on Bitbucket. No problem building locally, but on Bitrise I get:
```
Could not resolve package dependencies:
The server SSH fingerprint failed to verify.
```
I found [this discussion from last year](http://discuss.bitrise.io/t/xcode-11-resolving-packages-fails-with-ssh-fingerprint/10388/2). It suggests to add an activate SSH key step (I already had one) and add a script step to add Bitbucket to the `known_hosts` file (based on [Xcode 11 release notes](https://developer.apple.com/documentation/xcode-release-notes/xcode-11-release-notes) even though I’m using Xcode 12.2).
I did that but my build still fails with the same error message so I’m wondering if that workaround no longer applies. Has anybody else run into this?
---
### Author:  [@johnmorrell](https://discuss.bitrise.io/u/johnmorrell)
#### Post date: [November 17, 2020, 9:47am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877/2 "2020-11-17T09:47:11Z")
The solution you refer to still works. The SSH key step you likely have is a deployment key Bitrise adds to clone the project repository, This will not have access to any private dependencies in other repositories. You can use this key to clone the project then add the ‘known\_hosts’ and ‘ssh’. If you have a single private dependency you can use a deployment key from that repository, if there are multiple ones you will likely need a key from a user who has access to each of these.
YAML (put between clone and build steps with SSH key as a secret):
```
- script@1.1:
title: Add 'github' to known_hosts
inputs:
- content: |-
#!/usr/bin/env bash
for ip in $(dig @8.8.8.8 github.com +short); do ssh-keyscan github.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts
- activate-ssh-key@4.0:
inputs:
title: Activate SSH key
- ssh_rsa_private_key: "$GITHUB_SSH_KEY"
```
---
### Author:  [@steveroy](https://discuss.bitrise.io/u/steveroy)
#### Post date: [November 18, 2020, 5:47am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877/3 "2020-11-18T05:47:51Z")
Thanks John but still no luck. Following your advice I created another SSH key pair, added the public one to the private dependency repo in Bitbucket, then added the private one to a secret in Bitrise. But I’m still getting the `fingerprint failed to verify`. I also tried other options in case that made any difference.
```
- script@1:
inputs:
- content: |
for ip in $(dig @8.8.8.8 bitbucket.com +short); do ssh-keyscan bitbucket.com,$ip; ssh-keyscan $ip; done 2>/dev/null >> ~/.ssh/known_hosts
title: Add Bitbucket to known hosts
- activate-ssh-key@4:
inputs:
- ssh_rsa_private_key: "$PRIVATE_DEP_SSH_KEY"
- ssh_key_save_path: "$HOME/.ssh/bitrise_step_activate_ssh_key_private_dep"
- is_remove_other_identities: 'false'
```
---
### Author:  [@steveroy](https://discuss.bitrise.io/u/steveroy)
#### Post date: [November 20, 2020, 3:30am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877/4 "2020-11-20T03:30:08Z")
Got it.
The problem was that I had [bitbucket.COM](http://bitbucket.COM) in the add to known\_hosts step, but it really should have been [bitbucket.ORG](http://bitbucket.ORG).
Well, it’s the little things right. 🙄
---
### Author:  [@system](https://discuss.bitrise.io/u/system)
#### Post date: [December 20, 2020, 3:30am UTC](https://discuss.bitrise.io/t/xcodebuild-and-spm-dependency-ssh-fingerprint-failed-to-verify/14877/5 "2020-12-20T03:30:09Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.