net-scp 4.1.1.rc3 → 4.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 140aba7e5a90f61684d2a1acf0dedd19834b903c6e0a1d09f8e396cea0fd002c
-  data.tar.gz: 10ba5b3c7cc0172b435b44efbfc115be88caf60d804bfb11cb08b7e60bfbe00a
+  metadata.gz: b1413e9916cf7c4d82160a87e9da29044528f7c32dc746d12a873ea4d902a940
+  data.tar.gz: b0e33d71c6a78b8d263fd95408e23188c3c7e0bb274d52c1df6745bbc6793cc6
 SHA512:
-  metadata.gz: eca631adb3b5cc64bca4fcf5ca05ae62e5043631f004dac7edc2341c86165da3546f3aeb249b7618c454046c1d8897ed98a1a453f927815c2c10395bc11bcbd5
-  data.tar.gz: ee708ab42fa3b6d92cb79d695fe5a1f4b408cc4b4095cb74a8985c98f15af0002428d8f2c56c5f328a1fe0f7d709e33c49d0a60e8fb1db1d456ff9a016db17e7
+  metadata.gz: 46648015028eb41a2d7f269f4fe6baa430289da17f82c2945c5ef49ff4fa43085a966734d7e361a98b08cd91f7abf99f219eeebd954607bc74969f398e861ceb
+  data.tar.gz: e307dc9bb8e181c76acb226ffc8b35f5c2002adbef0f027f8954b9e695cc8436b780a7f4316dba7b685a48048184676c20dacceb2db81d235dcf51a83045ddf5

data/.github/pull_request_template.md

@@ -0,0 +1 @@
+<!-- After opening the PR, add a changelog.d/<PR number>.<type>.txt fragment (none, change, security, breaking or breaking-security) instead of editing CHANGES.txt; see CONTRIBUTING.md#changelog. -->

data/.github/workflows/changelog.yml

@@ -0,0 +1,18 @@
+name: Changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # HEAD is the PR merged into the base branch; HEAD^1 is the base it was merged into.
+          fetch-depth: 2
+      - uses: net-ssh/changelogd@v1

data/.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby-version: ['2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4', 'ruby-head']
+        ruby-version: ['2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0', 'ruby-head']
     continue-on-error: ${{ matrix.ruby-version == 'ruby-head' }}
     steps:
       - uses: actions/checkout@v3

data/CHANGES.txt

@@ -1,5 +1,22 @@
+=== 4.1.2
+
+* Security: Downloads no longer apply setuid, setgid or sticky bits sent by the server, check that a server-chosen local name matches the requested remote basename (as OpenSSH does since CVE-2019-6111), and refuse to follow an existing local symlink at a server-named path instead of writing through it. The local path passed by the caller may still be a symlink. O_NOFOLLOW suggested in net-sftp#162 by srosenhamer [#104]
+* Security: Recursive downloads, and downloads into a directory, reject file names from the server that are not a single path component (such as `../x` or `a/b`) instead of writing outside the target directory. Reported in net-sftp#162 by srosenhamer [#103]
+* Raise `Net::SCP::Error` when the server ends a transfer before the SCP protocol finishes, instead of reporting a truncated transfer as successful [#105, #96]
+* Opening an `scp://` URI through `uri/open-scp` now percent-decodes the user, password and path (once, keeping a literal `+`) and passes an IPv6 address to SSH without its brackets, so `scp://user@[::1]/a%20b` downloads `/a b` from `::1`. Thanks @OskarEichler [#94]
+* Opening an `scp://` URI through `uri/open-scp` now writes the download into the OpenURI buffer as it arrives, so large files spill to a temporary file instead of being held in memory twice. Thanks @OskarEichler [#93]
+* Parsing an `scp://` URI with a valueless query entry (`?flag`) or an empty one (`?a=1&&b=2`) no longer raises `NoMethodError`, and `URI::SCP#options` reflects the current query after `query=`. Thanks @OskarEichler [#92]
+* Opening an `scp://` URI through `uri/open-scp` now calls `:progress_proc` with the number of bytes received, as OpenURI documents, instead of with the SCP progress arguments (which raised `ArgumentError` for a lambda), and calls `:content_length_proc` once with the file size. Thanks @OskarEichler [#91]
+* Opening an `scp://` URI through `uri/open-scp` now uses the port and password given in the URI; they were passed outside the `:ssh` options and ignored. Options given in `:ssh` still take precedence. Thanks @OskarEichler [#90]
+* Close the local file net-scp opened for an upload or download when the transfer fails, so it is not left open (and locked on Windows) [#89, #20]
+* With `preserve: true`, recursive downloads now keep directories' modification times, which were overwritten when their contents were created. Thanks @OskarEichler [#88]
+* `upload`/`upload!` with a zero, negative or non-Integer `:chunk_size` now raises `ArgumentError` before opening a channel; previously `0` hung forever sending empty chunks, a negative value or a String failed only after the channel was open, and a Float was silently truncated. Thanks @OskarEichler [#87]
+* Uploading from an IO that isn't at its start now announces only the remaining bytes, instead of the full size, which made the transfer hang or fail. Thanks @OskarEichler [#86]
+* Accept a `Pathname` as the local path for uploads and downloads; previously uploads looped forever and downloads kept only the last chunk. Thanks @OskarEichler [#85, #29]
+
 === 4.1.1
 
+* Allow net-ssh 8
 * Fix frozen string literal compatibility [npezza93, mfazekas]
   - Use mutable string for scp command construction
   - Use mutable string for error_string initialization

data/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing to net-scp
+
+Run the tests with `bundle exec rake test`.
+
+## Changelog
+
+Don't edit `CHANGES.txt`. Instead, add a fragment file to `changelog.d/` in your PR; the release's version bump (`rake vbump:*`) moves all fragments into a new `=== <version>` section at the top of `CHANGES.txt` and deletes them.
+
+A fragment is named `<number>.<type>.txt`, where `<number>` is the PR number (so open the PR first, then add the fragment), and contains a single UTF-8 paragraph: the entry as it should read in `CHANGES.txt`, without the bullet or prefix. Lines are joined, so it can be wrapped. If it doesn't end with a reference list such as `[#95, #101]` or `[GHSA-xxxx-xxxx-xxxx]`, ` [#<number>]` is appended.
+
+| Type                | Written as                     | Use for                                                      |
+| ------------------- | ------------------------------ | ------------------------------------------------------------ |
+| `breaking-security` | `* BREAKING: Security: <text>` | an incompatible change made for security                     |
+| `breaking`          | `* BREAKING: <text>`           | an incompatible change                                       |
+| `security`          | `* Security: <text>`           | a security fix or hardening                                  |
+| `change`            | `* <text>`                     | any other user-visible fix or feature                        |
+| `none`              | nothing                        | PRs with no user-visible change (tests, CI, docs, refactors) |
+
+Examples:
+
+```sh
+rake "changelog:new[102,change,Fixed uploading files with spaces in their names]"
+# changelog.d/102.change.txt -> * Fixed uploading files with spaces in their names [#102]
+
+echo 'Refuse downloads that write outside the target directory [GHSA-xxxx-xxxx-xxxx]' > changelog.d/103.security.txt
+touch changelog.d/104.none.txt
+```
+
+For several entries from one PR add a suffix: `102.change.txt`, `102.change.2.txt` (`changelog:new` picks the next free one).
+
+`rake changelog:check` validates the fragments and `rake changelog:preview` prints the section the next release would add. CI fails a PR that edits `CHANGES.txt` or doesn't add or modify a `changelog.d/<PR number>.<type>.txt` fragment, unless it only touches `changelog.d/` or a maintainer adds the `skip-changelog` label; Dependabot PRs are skipped.
+
+The full rules, including how a release orders the entries, are in the [changelogd README](https://github.com/net-ssh/changelogd#readme).

data/Gemfile

@@ -11,6 +11,9 @@ gem "bundler", ">= 1.11"
 gem "rake", ">= 12.0"
 gem "rdoc"
 
+# git: rather than github:, which Bundler 1.x (the publish workflow uses 1.17.3) expands to an unsupported git:// URL.
+gem "changelogd", git: "https://github.com/net-ssh/changelogd.git", tag: "v1", group: :development
+
 gem 'byebug', group: %i[development test] if !Gem.win_platform? && RUBY_ENGINE == "ruby"
 
 if ENV["CI"]

data/Rakefile

@@ -22,6 +22,16 @@ name = "net-scp"
 require_relative "lib/net/scp/version"
 version = Net::SCP::Version::CURRENT
 
+begin
+  require "changelogd/rake"
+rescue LoadError
+  # A git gem isn't on the load path under plain `rake`, as the release workflow runs it; bundler/setup could clash with the running rake.
+  require "bundler"
+  $LOAD_PATH.unshift(*Bundler.definition.specs["changelogd"].flat_map(&:full_require_paths))
+  require "changelogd/rake"
+end
+Changelogd::RakeTasks.new(version_file: "lib/net/scp/version.rb")
+
 namespace :cert do
   desc "Update public cert from private - only run if public is expired"
   task :update_public_when_expired do
@@ -86,6 +96,7 @@ if defined?(RDoc::Task)
 end
 
 def change_version(&block)
+  Rake::Task["changelog:check"].invoke
   version_file = 'lib/net/scp/version.rb'
   require_relative version_file
   pre = Net::SCP::Version::PRE
@@ -135,6 +146,7 @@ def change_version(&block)
 
   FileUtils.mv version_file, "#{version_file}.old"
   FileUtils.mv "#{version_file}.new", version_file
+  Rake::Task["changelog:release"].invoke
 end
 
 namespace :vbump do

data/changelog.d/README.md

@@ -0,0 +1 @@
+Changelog fragments: one `<PR number>.<type>.txt` file per user-visible change, assembled into `CHANGES.txt` when the version is bumped. See [CONTRIBUTING.md](../CONTRIBUTING.md#changelog).

data/lib/net/scp/download.rb

@@ -50,8 +50,11 @@ module Net; class SCP
       when :file
         read_file(channel, directive)
       when :end
+        directory = channel[:stack].pop
+        if channel[:options][:preserve] && directory && directory[:times]
+          File.utime(directory[:times][:atime], directory[:times][:mtime], channel[:local])
+        end
         channel[:local] = File.dirname(channel[:local])
-        channel[:stack].pop
         channel[:state] = :finish if channel[:stack].empty?
       end
 
@@ -73,7 +76,7 @@ module Net; class SCP
     # Finishes off the read, sets the times for the file (if any), and then
     # jumps to either #finish_state (for single-file downloads) or
     # #read_directive_state (for recursive downloads). A 0-byte is sent to the
-    # server to indicate that the file was recieved successfully.
+    # server to indicate that the file was received successfully.
     def finish_read_state(channel)
       channel[:io].close unless channel[:io] == channel[:local]
 
@@ -126,19 +129,17 @@ module Net; class SCP
         raise Net::SCP::Error, ":recursive not specified for directory download"
       end
 
-      channel[:local] = File.join(channel[:local], directive[:name])
+      channel[:local] = local_path_for(channel, directive[:name])
 
-      if File.exist?(channel[:local]) && !File.directory?(channel[:local])
+      if File.symlink?(channel[:local])
+        raise Net::SCP::Error, "#{channel[:local]} is a symlink, refusing to follow it"
+      elsif File.exist?(channel[:local]) && !File.directory?(channel[:local])
         raise Net::SCP::Error, "#{channel[:local]} already exists and is not a directory"
       elsif !File.exist?(channel[:local])
-        Dir.mkdir(channel[:local], directive[:mode] | 0700)
+        Dir.mkdir(channel[:local], (directive[:mode] & 0777) | 0700)
       end
 
-      if channel[:options][:preserve] && channel[:times]
-        File.utime(channel[:times][:atime], channel[:times][:mtime], channel[:local])
-      end
-
-      channel[:stack] << directive
+      channel[:stack] << directive.merge(:times => channel[:times])
       channel[:times] = nil
     end
 
@@ -146,20 +147,54 @@ module Net; class SCP
     # actual read.
     def read_file(channel, directive)
       if !channel[:local].respond_to?(:write)
-        directive[:name] = (channel[:options][:recursive] || File.directory?(channel[:local])) ?
-          File.join(channel[:local], directive[:name]) :
-          channel[:local]
+        server_named = channel[:options][:recursive] || File.directory?(channel[:local])
+        directive[:name] = server_named ? local_path_for(channel, directive[:name]) : channel[:local]
       end
 
       channel[:file] = directive.merge(:times => channel[:times])
+      # Setuid/setgid/sticky bits are never taken from the server, even with :preserve.
       channel[:io] = channel[:local].respond_to?(:write) ? channel[:local] :
-        File.new(directive[:name], "wb", directive[:mode] | 0600)
+        open_local_file(directive[:name], (directive[:mode] & 0777) | 0600, server_named)
       channel[:times] = nil
       channel[:remaining] = channel[:file][:size]
       channel[:state] = :read_data
 
       progress_callback(channel, channel[:file][:name], 0, channel[:file][:size])
     end
+
+    # The name comes from the server, so anything but a single path component
+    # would let a malicious server write outside the target (CVE-2019-6111).
+    def local_path_for(channel, name)
+      if name.empty? || name == "." || name == ".." || name.include?("/") || name.include?("\0") ||
+         (File::ALT_SEPARATOR && name.include?(File::ALT_SEPARATOR))
+        raise Net::SCP::Error, "invalid file name from server: #{name.inspect}"
+      end
+
+      if channel[:stack].empty? && !requested_name?(channel[:remote], name)
+        raise Net::SCP::Error, "file name from server does not match request: #{name.inspect}"
+      end
+
+      File.join(channel[:local], name)
+    end
+
+    # OpenSSH's CVE-2019-6111 check: the flags mirror its brace expansion plus fnmatch(3) with flags 0.
+    def requested_name?(remote, name)
+      pattern = File.basename(remote.to_s)
+      name == pattern || File.fnmatch(pattern, name, File::FNM_DOTMATCH | File::FNM_EXTGLOB)
+    end
+
+    # A symlink planted at a server-named path must not redirect the write;
+    # the caller's own target may be a symlink on purpose (net-sftp#162).
+    def open_local_file(path, perm, nofollow)
+      return File.new(path, "wb", perm) unless nofollow && defined?(File::NOFOLLOW)
+
+      begin
+        File.new(path, "wb", perm, :flags => File::NOFOLLOW)
+      rescue SystemCallError
+        raise unless File.symlink?(path)
+        raise Net::SCP::Error, "#{path} is a symlink, refusing to follow it"
+      end
+    end
   end
 
 end; end

data/lib/net/scp/upload.rb

@@ -91,6 +91,7 @@ module Net; class SCP
     # upload and moves to #upload_current_state.
     def next_item_state(channel)
       if channel[:stack].empty?
+        channel[:state] = :finish
         finish_state(channel)
       else
         next_item = channel[:stack].last.shift
@@ -118,6 +119,9 @@ module Net; class SCP
       end
 
       channel[:size] = channel[:stat] ? channel[:stat].size : channel[:current].size
+      if channel[:current].respond_to?(:read) && channel[:current].respond_to?(:pos)
+        channel[:size] = [channel[:size] - channel[:current].pos, 0].max
+      end
     end
 
     # If the :preserve option is set, send a 'T' directive and wait for the

data/lib/net/scp/version.rb

@@ -52,11 +52,11 @@ module Net
       MINOR = 1
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 1
+      TINY  = 2
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed
-      PRE   = "rc3"
+      PRE   = nil
 
       # The current version of the Net::SSH library as a Version instance
       CURRENT = new(*[MAJOR, MINOR, TINY, PRE].compact)

data/lib/net/scp.rb

@@ -1,3 +1,4 @@
+require 'pathname'
 require 'stringio'
 require 'shellwords'
 
@@ -64,7 +65,7 @@ module Net
   #     puts "#{name}: #{sent}/#{total}"
   #   end
   #
-  # Whenever a new chunk of data is recieved for or sent to a file, the callback
+  # Whenever a new chunk of data is received for or sent to a file, the callback
   # will be invoked, indicating the name of the file (local for downloads,
   # remote for uploads), the number of bytes that have been sent or received
   # so far for the file, and the size of the file.
@@ -274,6 +275,10 @@ module Net
     #   channel = scp.upload("/local/path", "/remote/path")
     #   channel.wait
     def upload(local, remote, options={}, &progress)
+      chunk_size = options[:chunk_size] || Upload::DEFAULT_CHUNK_SIZE
+      unless chunk_size.is_a?(Integer) && chunk_size > 0
+        raise ArgumentError, ":chunk_size must be a positive Integer"
+      end
       start_command(:upload, local, remote, options, &progress)
     end
 
@@ -342,6 +347,7 @@ module Net
       # sets up a state machine to use to process the upload or download.
       # (See Net::SCP::Upload and Net::SCP::Download).
       def start_command(mode, local, remote, options={}, &callback)
+        local = local.to_path if local.is_a?(Pathname)
         session.open_channel do |channel|
 
           if options[:shell]
@@ -363,19 +369,22 @@ module Net
               channel[:error_string] = +''
 
               channel.on_close do
+                # The close can be dispatched before on_process has consumed data that arrived with it.
+                send("#{channel[:state]}_state", channel)
                 # If we got an exit-status and it is not 0, something went wrong
                 if !channel[:exit].nil? && channel[:exit] != 0
                   raise Net::SCP::Error, 'SCP did not finish successfully ' \
                                          "(#{channel[:exit]}): #{channel[:error_string]}"
                 end
-                # We may get no exit-status at all as returning a status is only RECOMENDED
-                # in RFC4254. But if our state is not :finish, something went wrong
-                if channel[:exit].nil? && channel[:state] != :finish
-                  raise Net::SCP::Error, 'SCP did not finish successfully ' \
-                                         '(channel closed before end of transmission)'
+                # A zero or missing exit-status does not prove the transfer completed.
+                if channel[:state] != :finish
+                  message = +'SCP did not finish successfully (channel closed before end of transmission)'
+                  message << ": #{channel[:error_string]}" unless channel[:error_string].empty?
+                  raise Net::SCP::Error, message
                 end
-                # At this point, :state can be :finish or :next_item
-                send("#{channel[:state]}_state", channel)
+              ensure
+                io = channel[:io]
+                io.close if io && io != channel[:local] && !io.closed?
               end
               channel.on_data                   { |ch2, data| channel[:buffer].append(data) }
               channel.on_extended_data          { |ch2, type, data| debug { data.chomp } }

data/lib/uri/open-scp.rb

@@ -8,9 +8,21 @@ module URI
 
   class SCP
     def buffer_open(buf, proxy, open_options)
-      options = open_options.merge(:port => port, :password => password)
+      options = open_options.dup
+      options[:ssh] = { :port => port }
+      options[:ssh][:password] = URI::DEFAULT_PARSER.unescape(password) if password
+      options[:ssh].merge!(open_options[:ssh] || {})
       progress = options.delete(:progress_proc)
-      buf << Net::SCP.download!(host, user, path, nil, options, &progress)
+      content_length = options.delete(:content_length_proc)
+      output = Object.new
+      output.define_singleton_method(:write) { |data| buf << data }
+      Net::SCP.download!(hostname, user && URI::DEFAULT_PARSER.unescape(user), URI::DEFAULT_PARSER.unescape(path), output, options) do |_channel, _name, received, total|
+        if content_length
+          content_length.call(total)
+          content_length = nil
+        end
+        progress.call(received) if progress
+      end
       buf.io.rewind
     end
 

data/lib/uri/scp.rb

@@ -11,8 +11,6 @@ module URI
       :query
     ].freeze
 
-    attr_reader :options
-
     def self.new2(user, password, host, port, path, query)
       new('scp', [user, password], host, port, nil, path, nil, query)
     end
@@ -20,14 +18,23 @@ module URI
     def initialize(*args)
       super(*args)
 
+      options
+    end
+
+    def options
+      return @options if defined?(@options_query) && @options_query == query
+
+      @options_query = query && query.dup
       @options = Hash.new
       (query || "").split(/&/).each do |pair|
+        next if pair.empty?
         name, value = pair.split(/=/, 2)
         opt_name = name.to_sym
-        values = value.split(/,/).map { |v| v.to_i.to_s == v ? v.to_i : v }
+        values = value.to_s.split(/,/).map { |v| v.to_i.to_s == v ? v.to_i : v }
         values = values.first if values.length == 1
-        options[opt_name] = values
+        @options[opt_name] = values
       end
+      @options
     end
   end
 

data/net-scp.gemspec

@@ -33,16 +33,16 @@ Gem::Specification.new do |spec|
     spec.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
-      spec.add_runtime_dependency(%q<net-ssh>, [">= 2.6.5", "< 8.0.0"])
+      spec.add_runtime_dependency(%q<net-ssh>, [">= 2.6.5", "< 9.0.0"])
       spec.add_development_dependency(%q<test-unit>, [">= 0"])
       spec.add_development_dependency(%q<mocha>, [">= 0"])
     else
-      spec.add_dependency(%q<net-ssh>, [">= 2.6.5", "< 8.0.0"])
+      spec.add_dependency(%q<net-ssh>, [">= 2.6.5", "< 9.0.0"])
       spec.add_dependency(%q<test-unit>, [">= 0"])
       spec.add_dependency(%q<mocha>, [">= 0"])
     end
   else
-    spec.add_dependency(%q<net-ssh>, [">= 2.6.5", "< 8.0.0"])
+    spec.add_dependency(%q<net-ssh>, [">= 2.6.5", "< 9.0.0"])
     spec.add_dependency(%q<test-unit>, [">= 0"])
     spec.add_dependency(%q<mocha>, [">= 0"])
   end

data/setup.rb

@@ -120,7 +120,7 @@ class ConfigTable
                ((major == 1) and
                 ((minor >= 5) or
                  ((minor == 4) and (teeny >= 4)))))
-  
+
   subprefix = lambda {|path|
     path.sub(/\A#{Regexp.quote(c['prefix'])}/o, '$prefix')
   }
@@ -172,7 +172,7 @@ class ConfigTable
                      'the directory for ruby scripts' ] ],
     [ 'so-dir',    [ sodir,
                      'path',
-                     'the directory for ruby extentions' ] ],
+                     'the directory for ruby extensions' ] ],
     [ 'data-dir',  [ '$prefix/share',
                      'path',
                      'the directory for shared data' ] ],
@@ -184,10 +184,10 @@ class ConfigTable
                      'the ruby program using for installation' ] ],
     [ 'make-prog', [ makeprog,
                      'name',
-                     'the make program to compile ruby extentions' ] ],
+                     'the make program to compile ruby extensions' ] ],
     [ 'without-ext', [ 'no',
                        'yes/no',
-                       'does not compile/install ruby extentions' ] ]
+                       'does not compile/install ruby extensions' ] ]
   ]
   multipackage_descripters = [
     [ 'with',      [ '',
@@ -303,7 +303,7 @@ class ConfigTable
         unless ConfigTable.config_key?(k)
     @table[k] = v
   end
-    
+
   def [](key)
     return nil unless @table[key]
     @table[key].gsub(%r<\$([^/]+)>) { self[$1] }
@@ -479,7 +479,7 @@ module FileOperations
   def ruby(str)
     command config('ruby-prog') + ' ' + str
   end
-  
+
   def make(task = '')
     command config('make-prog') + ' ' + task
   end
@@ -572,7 +572,7 @@ module HookScriptAPI
   def srcdirectory?(path)
     File.dir?(srcfile(path))
   end
-  
+
   def srcfile?(path)
     File.file? srcfile(path)
   end
@@ -606,10 +606,10 @@ class ToplevelInstaller
   TASKS = [
     [ 'config',   'saves your configurations' ],
     [ 'show',     'shows current configuration' ],
-    [ 'setup',    'compiles ruby extentions and others' ],
+    [ 'setup',    'compiles ruby extensions and others' ],
     [ 'install',  'installs files' ],
-    [ 'clean',    "does `make clean' for each extention" ],
-    [ 'distclean',"does `make distclean' for each extention" ]
+    [ 'clean',    "does `make clean' for each extension" ],
+    [ 'distclean',"does `make distclean' for each extension" ]
   ]
 
   def ToplevelInstaller.invoke
@@ -708,7 +708,7 @@ class ToplevelInstaller
       when '-v', '--version'
         puts "#{File.basename($0)} version #{Version}"
         exit 0
-      
+
       when '--copyright'
         puts Copyright
         exit 0
@@ -911,7 +911,7 @@ class ToplevelInstallerMulti < ToplevelInstaller
 
   def print_usage(f)
     super
-    f.puts 'Inluded packages:'
+    f.puts 'Included packages:'
     f.puts '  ' + @packages.sort.join(' ')
     f.puts
   end
@@ -1146,7 +1146,7 @@ class Installer
 
   def install_dir_ext(rel)
     return unless extdir?(curr_srcdir())
-    install_files ruby_extentions('.'),
+    install_files ruby_extensions('.'),
                   "#{config('so-dir')}/#{File.dirname(rel)}",
                   0555
   end
@@ -1165,9 +1165,9 @@ class Installer
   def ruby_scripts
     collect_filenames_auto().select {|n| /\.rb\z/ =~ n || "module.yml" == n }
   end
-  
+
   # picked up many entries from cvs-1.11.1/src/ignore.c
-  reject_patterns = %w( 
+  reject_patterns = %w(
     core RCSLOG tags TAGS .make.state
     .nse_depinfo #* .#* cvslog.* ,* .del-* *.olb
     *~ *.old *.bak *.BAK *.orig *.rej _$* *$
@@ -1212,14 +1212,14 @@ class Installer
     }
   end
 
-  def ruby_extentions(dir)
-    _ruby_extentions(dir) or
-        raise InstallError, "no ruby extention exists: 'ruby #{$0} setup' first"
+  def ruby_extensions(dir)
+    _ruby_extensions(dir) or
+        raise InstallError, "no ruby extension exists: 'ruby #{$0} setup' first"
   end
 
   DLEXT = /\.#{ ::Config::CONFIG['DLEXT'] }\z/
 
-  def _ruby_extentions(dir)
+  def _ruby_extensions(dir)
     Dir.open(dir) {|d|
       return d.select {|fname| DLEXT =~ fname }
     }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-scp
 version: !ruby/object:Gem::Version
-  version: 4.1.1.rc3
+  version: 4.1.2
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   vNiMFH5yLu/tlav4xh+HlYscWVdFQIvd7f/Uxa+Vip1Pi16wmhnrE15z/vDX921v
   hukBRIoCEAuUgNVBh+L/C8aETzbf/77WU3Si/w==
   -----END CERTIFICATE-----
-date: 2026-05-16 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-ssh
@@ -43,7 +43,7 @@ dependencies:
         version: 2.6.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.0.0
+        version: 9.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -53,7 +53,7 @@ dependencies:
         version: 2.6.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.0.0
+        version: 9.0.0
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
@@ -91,15 +91,19 @@ extra_rdoc_files:
 - LICENSE.txt
 - README.md
 files:
+- ".github/pull_request_template.md"
+- ".github/workflows/changelog.yml"
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - CHANGES.txt
+- CONTRIBUTING.md
 - Gemfile
 - LICENSE.txt
 - Manifest
 - README.md
 - Rakefile
 - SECURITY.md
+- changelog.d/README.md
 - lib/net/scp.rb
 - lib/net/scp/download.rb
 - lib/net/scp/errors.rb