net-ssh 7.0.1 → 7.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '001243685ec6a8113bb04e55c5f75b50fb0386636ca40da012e6b0206844e793'
-  data.tar.gz: 6e4da1daaf0d6fc152df30865ec8ace047440b33323fa4a1abf947336876dd17
+  metadata.gz: 69f379018d9756042dedb6948dda7f92b8d866a0fd3beb7745a11ab1da739001
+  data.tar.gz: 8e5b659e405ea5403ce34fec03e05c1abe1d3dcf6b8962610d7b6c62c6df7794
 SHA512:
-  metadata.gz: 448b9447c97a464fa3c6431a15748dbb25bf79b3ac9ade31c0272a5558eec3180276ed0614c531b3f38910ef6af609e8f696fbb65fffc2288085b9268e7d1086
-  data.tar.gz: 8a425c4dc43f5657ae1391cce0aab1aa828fd3c03b6f3659a1dedb78e62ed08bd74696a86d8bf301bf2a093db9fc355f2f74d6e1e05117fa80e59bb136a55f58
+  metadata.gz: 065e5076a1d6ed2af0ca3b51f6dc885cf05d09b93ba8a9f5ad003031b5ab3b652e1289b4c5ff9b2e9865db3c12f58874b1ec504044ee17fe1551396e4081daa9
+  data.tar.gz: c27bb7b11148313012628ada70d22e5e425ef4b36c7645e40bd422ad86a2b9495de1b71fa70ad8ae2b9584d4cbbe8fef3030883f29df0c7551f8e3d8eddc4339

data/.github/workflows/ci-with-docker.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Build docker images
       run: docker-compose build
@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Build docker images
       run: docker build -t netssh_openssl3 -f Dockerfile.openssl3 .

data/.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
       matrix:
         ruby-version: [2.6.6, 2.7.2, 3.0.1, 3.1.1]
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
 
       - name: Set up Ruby ${{ matrix.ruby-version }}
         uses: ruby/setup-ruby@v1

data/.github/workflows/rubocop.yml

@@ -6,8 +6,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - name: Rubocop Linter Action
-      uses: andrewmcodes/rubocop-linter-action@v3.0.0.rc2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v3
+      - name: Set up Ruby 3.1
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.1
+          bundler-cache: true
+      - name: Run RuboCop
+        run: bundle exec rubocop

data/CHANGES.txt

@@ -1,3 +1,27 @@
+
+=== 7.1.0
+
+  * Accept pubkey_algorithms option when starting a new connection [#891]
+
+=== 7.1.0 beta1
+
+  * Don't use the deprecated set_XXX methods on RSA keys. [#875]
+  * Raise error when BCryptPbkdf fails [#876]
+
+=== 7.0.1
+
+  * Drop leftover debug statement [#866]
+
+=== 7.0.0
+
+  * BREAKING: Drop support for Ruby 2.5
+  * Fix decoding of ecdsa-sha2-nistp256 private keys [#657, #854]
+  * Fix missing require [#855]
+  * Support `~` in the path to the SSH agent's unix socket [#850]
+  * Add support for RSA client authentication with SHA-2 [a45f54]
+  * openssl: DSA: don't hardcode expected signature size, see ruby/openssl#483 [23a15c]
+  * Internal housekeeping (rubocop, codecov, remove travis, adding/improving tests)
+
 === 6.3.0 beta1
 
   * Support cert based host key auth, fix asterisk in known_hosts [#833]

data/README.md

@@ -5,7 +5,7 @@
 [![Backers on Open Collective](https://opencollective.com/net-ssh/backers/badge.svg)](#backers])
 [![Sponsors on Open Collective](https://opencollective.com/net-ssh/sponsors/badge.svg)](#sponsors)
 
-# Net::SSH 6.x
+# Net::SSH 7.x
 
 * Docs: http://net-ssh.github.io/net-ssh
 * Issues: https://github.com/net-ssh/net-ssh/issues
@@ -247,6 +247,10 @@ mv gem-public_cert.pem net-ssh-public_cert.pem
 gem cert --add net-ssh-public_cert.pem
 ```
 
+## Security contact information
+
+See [SECURITY.md](SECURITY.md)
+
 ## CREDITS
 
 ### Contributors

data/Rakefile

@@ -55,6 +55,60 @@ namespace :cert do
   end
 end
 
+def change_version(&block)
+  version_file = 'lib/net/ssh/version.rb'
+  require_relative version_file
+  pre = Net::SSH::Version::PRE
+  result = block[pre: pre]
+  raise "Version change logic should always return a pre", ArgumentError unless result.key?(:pre)
+
+  new_pre = result[:pre]
+  found = false
+  File.open("#{version_file}.new", "w") do |f|
+    File.readlines(version_file).each do |line|
+      match = /^(\s+PRE\s+=\s+")#{pre}("\s*)$/.match(line)
+      if match
+        prefix = match[1]
+        postfix = match[2]
+        if new_pre.nil?
+          prefix.delete_suffix!('"')
+          postfix.delete_prefix!('"')
+        end
+        new_line = "#{prefix}#{new_pre.inspect}#{postfix}"
+        puts "Changing:\n  - #{line}  + #{new_line}"
+        line = new_line
+        found = true
+      end
+      f.write(line)
+    end
+    raise ArugmentError, "Cound not find line: PRE = \"#{pre}\" in #{version_file}" unless found
+  end
+
+  FileUtils.mv version_file, "#{version_file}.old"
+  FileUtils.mv "#{version_file}.new", version_file
+end
+
+namespace :vbump do
+  desc "Final release"
+  task :final do
+    change_version do |pre:|
+      raise ArgumentError, "Unexpected pre: #{pre}" if pre.nil?
+
+      { pre: nil }
+    end
+  end
+
+  desc "Increment prerelease"
+  task :pre do
+    change_version do |pre:|
+      match = /^([a-z]+)(\d+)/.match(pre)
+      raise ArgumentError, "Unexpected pre: #{pre}" if match.nil?
+
+      { pre: "#{match[1]}#{match[2].to_i + 1}" }
+    end
+  end
+end
+
 namespace :rdoc do
   desc "Update gh-pages branch"
   task :publish do

data/SECURITY.md

@@ -0,0 +1,4 @@
+## Security contact information
+
+To report a security vulnerability, please use the
+[GitHub private vulnerability reporting feature](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).

data/lib/net/ssh/authentication/certificate.rb

@@ -102,8 +102,8 @@ module Net
         # Checks whether the certificate's signature was signed by signature key.
         def signature_valid?
           buffer = Buffer.new(signature)
-          buffer.read_string # skip signature format
-          signature_key.ssh_do_verify(buffer.read_string, to_blob_without_signature)
+          sig_format = buffer.read_string
+          signature_key.ssh_do_verify(buffer.read_string, to_blob_without_signature, host_key: sig_format)
         end
 
         def self.read_options(buffer)

data/lib/net/ssh/authentication/ed25519.rb

@@ -77,6 +77,7 @@ module Net
               raise "BCryptPbkdf is not implemented for jruby" if RUBY_PLATFORM == "java"
 
               key = BCryptPbkdf::key(password, salt, keylen + ivlen, rounds)
+              raise DecryptError.new("BCyryptPbkdf failed", encrypted_key: true) unless key
             else
               key = '\x00' * (keylen + ivlen)
             end

data/lib/net/ssh/buffer.rb

@@ -251,7 +251,6 @@ module Net
       def read_private_keyblob(type)
         case type
         when /^ssh-rsa$/
-          key = OpenSSL::PKey::RSA.new
           n = read_bignum
           e = read_bignum
           d = read_bignum
@@ -262,27 +261,28 @@ module Net
           _unkown2 = read_bignum
           dmp1 = d % (p - 1)
           dmq1 = d % (q - 1)
-          if key.respond_to?(:set_key)
-            key.set_key(n, e, d)
-          else
-            key.e = e
-            key.n = n
-            key.d = d
-          end
-          if key.respond_to?(:set_factors)
-            key.set_factors(p, q)
-          else
-            key.p = p
-            key.q = q
+          # Public key
+          data_sequence = OpenSSL::ASN1::Sequence([
+                                                    OpenSSL::ASN1::Integer(n),
+                                                    OpenSSL::ASN1::Integer(e)
+                                                  ])
+
+          if d && p && q && dmp1 && dmq1 && iqmp
+            data_sequence = OpenSSL::ASN1::Sequence([
+                                                      OpenSSL::ASN1::Integer(0),
+                                                      OpenSSL::ASN1::Integer(n),
+                                                      OpenSSL::ASN1::Integer(e),
+                                                      OpenSSL::ASN1::Integer(d),
+                                                      OpenSSL::ASN1::Integer(p),
+                                                      OpenSSL::ASN1::Integer(q),
+                                                      OpenSSL::ASN1::Integer(dmp1),
+                                                      OpenSSL::ASN1::Integer(dmq1),
+                                                      OpenSSL::ASN1::Integer(iqmp)
+                                                    ])
           end
-          if key.respond_to?(:set_crt_params)
-            key.set_crt_params(dmp1, dmq1, iqmp)
-          else
-            key.dmp1 = dmp1
-            key.dmq1 = dmq1
-            key.iqmp = iqmp
-          end
-          key
+
+          asn1 = OpenSSL::ASN1::Sequence(data_sequence)
+          OpenSSL::PKey::RSA.new(asn1.to_der)
         when /^ecdsa\-sha2\-(\w*)$/
           OpenSSL::PKey::EC.read_keyblob($1, self)
         else

data/lib/net/ssh/connection/session.rb

@@ -416,7 +416,7 @@ module Net
         #
         #   matches = ssh.exec!("grep something /some/files")
         #
-        # the returned string has an exitstatus method to query it's exit satus
+        # the returned string has an exitstatus method to query its exit status
         def exec!(command, status: nil, &block)
           block_or_concat = block || Proc.new do |ch, type, data|
             ch[:result] ||= String.new

data/lib/net/ssh/version.rb

@@ -49,10 +49,10 @@ module Net
       MAJOR = 7
 
       # The minor component of this version of the Net::SSH library
-      MINOR = 0
+      MINOR = 1
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 1
+      TINY  = 0
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/lib/net/ssh.rb

@@ -73,7 +73,7 @@ module Net
       max_win_size send_env set_env use_agent number_of_password_prompts
       append_all_supported_algorithms non_interactive password_prompt
       agent_socket_factory minimum_dh_bits verify_host_key
-      fingerprint_hash check_host_ip
+      fingerprint_hash check_host_ip pubkey_algorithms
     ]
 
     # The standard means of starting a new SSH connection. When used with a
@@ -170,6 +170,11 @@ module Net
     # * :properties => a hash of key/value pairs to add to the new connection's
     #   properties (see Net::SSH::Connection::Session#properties)
     # * :proxy => a proxy instance (see Proxy) to use when connecting
+    # * :pubkey_algorithms => the public key authentication algorithms to use for
+    #   this connection. Valid values are 'rsa-sha2-256-cert-v01@openssh.com',
+    #   'ssh-rsa-cert-v01@openssh.com', 'rsa-sha2-256', 'ssh-rsa'. Currently, this
+    #   option is only used for RSA public key authentication and ignored for other
+    #   types.
     # * :rekey_blocks_limit => the max number of blocks to process before rekeying
     # * :rekey_limit => the max number of bytes to process before rekeying
     # * :rekey_packet_limit => the max number of packets to process before rekeying

data/net-ssh-public_cert.pem

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDQDCCAiigAwIBAgIBATANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpuZXRz
-c2gvREM9c29sdXRpb3VzL0RDPWNvbTAeFw0yMTA4MTAwODMyMzBaFw0yMjA4MTAw
-ODMyMzBaMCUxIzAhBgNVBAMMGm5ldHNzaC9EQz1zb2x1dGlvdXMvREM9Y29tMIIB
+c2gvREM9c29sdXRpb3VzL0RDPWNvbTAeFw0yMzAxMjQwMzE3NTVaFw0yNDAxMjQw
+MzE3NTVaMCUxIzAhBgNVBAMMGm5ldHNzaC9EQz1zb2x1dGlvdXMvREM9Y29tMIIB
 IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxieE22fR/qmdPKUHyYTyUx2g
 wskLwrCkxay+Tvc97ZZUOwf85LDDDPqhQaTWLvRwnIOMgQE2nBPzwalVclK6a+pW
 x/18KDeZY15vm3Qn5p42b0wi9hUxOqPm3J2hdCLCcgtENgdX21nVzejn39WVqFJO
@@ -11,10 +11,10 @@ fBbmDnsMLAtAtauMOxORrbx3EOY7sHku/kSrMg3FXFay7jc6BkbbUij+MjJ/k82l
 AQABo3sweTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUBfKiwO2e
 M4NEiRrVG793qEPLYyMwHwYDVR0RBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20w
 HwYDVR0SBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20wDQYJKoZIhvcNAQELBQAD
-ggEBABRChgo0Jo+iXSnTpODNongzZoU0sWqwx3/FQVo8nyAyr1qFuiqpSPb4bDbU
-DsVnUn3t0X/gGA8qJhutlmfTpEQCjUeyj2x9rWpD3lvttlGWV6btQ0qN4Dfc2gsw
-rCp9Jpful0HGWhiwfjWfsarqAdtLzIG0UC47IN7LGeCMRJIijOsXQhiZ915eNBEw
-g9+WSSGHkMFt/7vi2pFkvXSC0+RF8ovvRWf4Zw2aYXtJ1GElgi4ZS/s6ZU0gmv20
-i4SfC5m5UXIVZvOBYiMuZ/1B2m6R9xU41027zfOVwRFNtlVDiNfQRq6sDmz44At/
-dv8pkxXDgySe41vzlRXFsgIgz5A=
+ggEBAHyOSaOUji+EJFWZ46g+2EZ/kG7EFloFtIQUz8jDJIWGE+3NV5po1M0Z6EqH
+XmG3BtMLfgOV9NwMQRqIdKnZDfKsqM/FOu+9IqrP+OieAde5OrXR2pzQls60Xft7
+3qNVaQS99woQRqiUiDQQ7WagOYrZjuVANqTDNt4myzGSjS5sHcKlz3PRn0LJRMe5
+ouuLwQ7BCXityv5RRXex2ibCOyY7pB5ris6xDnPe1WdlyCfUf1Fb+Yqxpy6a8QmH
+v84waVXQ2i5M7pJaHVBF7DxxeW/q8W3VCnsq8vmmvULSThD18QqYGaFDJeN8sTR4
+6tfjgZ6OvGSScvbCMHkCE9XjonE=
 -----END CERTIFICATE-----

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.0.1
+  version: 7.1.0
 platform: ruby
 authors:
 - Jamis Buck
@@ -13,8 +13,8 @@ cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
   MIIDQDCCAiigAwIBAgIBATANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpuZXRz
-  c2gvREM9c29sdXRpb3VzL0RDPWNvbTAeFw0yMTA4MTAwODMyMzBaFw0yMjA4MTAw
-  ODMyMzBaMCUxIzAhBgNVBAMMGm5ldHNzaC9EQz1zb2x1dGlvdXMvREM9Y29tMIIB
+  c2gvREM9c29sdXRpb3VzL0RDPWNvbTAeFw0yMzAxMjQwMzE3NTVaFw0yNDAxMjQw
+  MzE3NTVaMCUxIzAhBgNVBAMMGm5ldHNzaC9EQz1zb2x1dGlvdXMvREM9Y29tMIIB
   IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxieE22fR/qmdPKUHyYTyUx2g
   wskLwrCkxay+Tvc97ZZUOwf85LDDDPqhQaTWLvRwnIOMgQE2nBPzwalVclK6a+pW
   x/18KDeZY15vm3Qn5p42b0wi9hUxOqPm3J2hdCLCcgtENgdX21nVzejn39WVqFJO
@@ -24,14 +24,14 @@ cert_chain:
   AQABo3sweTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUBfKiwO2e
   M4NEiRrVG793qEPLYyMwHwYDVR0RBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20w
   HwYDVR0SBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20wDQYJKoZIhvcNAQELBQAD
-  ggEBABRChgo0Jo+iXSnTpODNongzZoU0sWqwx3/FQVo8nyAyr1qFuiqpSPb4bDbU
-  DsVnUn3t0X/gGA8qJhutlmfTpEQCjUeyj2x9rWpD3lvttlGWV6btQ0qN4Dfc2gsw
-  rCp9Jpful0HGWhiwfjWfsarqAdtLzIG0UC47IN7LGeCMRJIijOsXQhiZ915eNBEw
-  g9+WSSGHkMFt/7vi2pFkvXSC0+RF8ovvRWf4Zw2aYXtJ1GElgi4ZS/s6ZU0gmv20
-  i4SfC5m5UXIVZvOBYiMuZ/1B2m6R9xU41027zfOVwRFNtlVDiNfQRq6sDmz44At/
-  dv8pkxXDgySe41vzlRXFsgIgz5A=
+  ggEBAHyOSaOUji+EJFWZ46g+2EZ/kG7EFloFtIQUz8jDJIWGE+3NV5po1M0Z6EqH
+  XmG3BtMLfgOV9NwMQRqIdKnZDfKsqM/FOu+9IqrP+OieAde5OrXR2pzQls60Xft7
+  3qNVaQS99woQRqiUiDQQ7WagOYrZjuVANqTDNt4myzGSjS5sHcKlz3PRn0LJRMe5
+  ouuLwQ7BCXityv5RRXex2ibCOyY7pB5ris6xDnPe1WdlyCfUf1Fb+Yqxpy6a8QmH
+  v84waVXQ2i5M7pJaHVBF7DxxeW/q8W3VCnsq8vmmvULSThD18QqYGaFDJeN8sTR4
+  6tfjgZ6OvGSScvbCMHkCE9XjonE=
   -----END CERTIFICATE-----
-date: 2022-06-26 00:00:00.000000000 Z
+date: 2023-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
@@ -174,6 +174,7 @@ files:
 - Manifest
 - README.md
 - Rakefile
+- SECURITY.md
 - THANKS.txt
 - appveyor.yml
 - docker-compose.yml
@@ -291,7 +292,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.3
 signing_key: 
 specification_version: 4
 summary: 'Net::SSH: a pure-Ruby implementation of the SSH2 client protocol.'