net-ssh 7.3.5 → 7.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d7e10bf0a8b8fd5369085ec9d379b11f88e980fa57586fa6af75f82c04f44e9
-  data.tar.gz: a1e5198b60b4209e00a7599f800aa993e588ddf0c501a3ebbfa8c75888909524
+  metadata.gz: 20d1aa171eb7f2135e994d7d7c495400ad619159a0d67a287336466512f43dec
+  data.tar.gz: acaf01c452aab18fc52d7994295d6ca4c843065d0d1044d1fa86e0f9ba542db5
 SHA512:
-  metadata.gz: ff0336b092a4597e1676a82184efed7fdb1b0f1719d7615097ae430b502471e82e542db0fa0d75db0126bd7fe9c164981e4101dbb67bd19c5578c2d140b39c72
-  data.tar.gz: caad46ec0db79f1d9d273b1b2026d9811e53ed9bdcfac50a315749d48c73d5cfb9421f15e7f569b1d045cea6a67112f950ffb21ce16ed01d4154c52396cc35c9
+  metadata.gz: 570ef6dcb8286b230c8e97b41bd6efa2d0358effee0b55e23de2d6392785d71dd220f0d39bd90e232a7a84ebfe97ddbcb0a9bfa6263e3c180a5a3fed894ceac8
+  data.tar.gz: f7c2f6c2eec63eab80e632d459b8f4c424cefea276077ad484fa1b0eb94489a86fc6b620e682100e4f5d9dba89df39e3f50384019d136ef6cbf0bf52f6fbb800

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3.0, 3.4]
+        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 

data/CHANGES.txt

@@ -1,3 +1,11 @@
+=== 7.3.7
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]
+
+=== 7.3.6
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]
+
 === 7.3.5
 
   * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]

data/Dockerfile

@@ -3,6 +3,9 @@ FROM ruby:${RUBY_VERSION}
 
 ARG BUNDLERV=
 
+# Ruby 2.6 to 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
+RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|; s|security.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
+
 RUN apt update && apt install -y openssh-server sudo netcat-openbsd \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_1' \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_2' \

data/Dockerfile.zlib_ng

@@ -11,7 +11,7 @@ ENV INSTALL_PATH="/netssh"
 # Ruby/OpenSSL initialises — setting it in the Rakefile is too late.
 ENV OPENSSL_CONF="/netssh/test/openssl3.conf"
 
-RUN dnf install -y openssl ruby ruby-devel git make gcc zlib-ng crypto-policies-scripts && \
+RUN dnf install -y openssl ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
     update-crypto-policies --set LEGACY
 
 WORKDIR $INSTALL_PATH

data/Rakefile

@@ -9,7 +9,13 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+# rdoc is no longer a default gem as of Ruby 4.0; keep the rest of the
+# Rakefile usable when it is not installed.
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc tasks are optional
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -27,17 +33,19 @@ require_relative "lib/net/ssh/version"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do

data/lib/net/ssh/transport/session.rb

@@ -216,7 +216,8 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
-              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.initialized?
+              # Algorithms#rekey! clears initialized?, so the session id is what marks the first key exchange as done.
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.session_id
 
               push(packet)
             end

data/lib/net/ssh/verifiers/always.rb

@@ -51,6 +51,9 @@ module Net
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.
         def verify_certificate!(entry, host_keys, arguments)
+          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
+          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
+
           cert = arguments[:key]
 
           if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 5
+      TINY  = 7
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/net-ssh.gemspec

@@ -30,6 +30,8 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency("logger")
+
   unless ENV['NET_SSH_NO_ED25519']
     spec.add_development_dependency("bcrypt_pbkdf", "~> 1.0") unless RUBY_PLATFORM == "java"
     spec.add_development_dependency("ed25519", "~> 1.2")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.5
+  version: 7.3.7
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,8 +32,22 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
   requirement: !ruby/object:Gem::Requirement