net-ssh 7.3.6 → 8.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1fd91f862a832657da3941f813a7a7d2204b2b08cc0082db740d27e9a23e7cc
-  data.tar.gz: b6f84d4e0ff8391ca7ccaab236c0eda12fdc0d46d7f7751a19d355cbf2b4cd5d
+  metadata.gz: 96690db72c35721670d94d15faf150030ae24a696b2eecc9f9b174eadaa892a2
+  data.tar.gz: b5d55d232f256442dfdc344b6a18384872fdc1f7c2d7ced93f7e6dec1890f02c
 SHA512:
-  metadata.gz: 4b8edaf68052b8b828993179ee6f8a29df1e64ca63e1cad5228d4e58ec50c088b321deaf0ad8a202eb6fe27a9a923be2dbe1dc5569e049634379e64b1d4228d5
-  data.tar.gz: 6b2f300dab731967559d13d6ac18c756c27ff39222dd2370b1e32b4187475cb0103e5e2683dfbe03624d172756232066ee30dc84bed8bfaa7d032c3a9736dd69
+  metadata.gz: e6ebb241e5088fd5b25402bafca4c6152e56da239a3e6bb0124ab84b9944ba7bb91506c6aef17bcb84e021f92335440d8e08f1fce4726189179d65c61150098f
+  data.tar.gz: ff9a4c3de691cce2a5cf9e1bb6a647b98663351ab6f896198ee519c6f040e0b767382ad499b7d3907446e52afbc98f485df2a126612da78aaba2d76fc80e563f

data/.github/pull_request_template.md

@@ -0,0 +1 @@
+<!-- After opening the PR, add a changelog.d/<PR number>.<type>.txt fragment (none, change, security, breaking or breaking-security) instead of editing CHANGES.txt; see CONTRIBUTING.md#changelog. -->

data/.github/workflows/changelog.yml

@@ -0,0 +1,43 @@
+name: Changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # HEAD is the PR merged into the base branch; HEAD^1 is the base it was merged into.
+          fetch-depth: 2
+      - name: Set up Ruby 3.1
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.1
+      - name: Validate fragments
+        run: rake changelog:check
+      - name: Require a fragment
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-changelog') }}
+        env:
+          PR: ${{ github.event.number }}
+        run: |
+          changed=$(git diff --name-only HEAD^1 HEAD)
+          if echo "$changed" | grep -x 'CHANGES\.txt' > /dev/null; then
+            echo "::error::Don't edit CHANGES.txt, add a changelog.d/$PR.<type>.txt fragment instead, see CONTRIBUTING.md#changelog"
+            exit 1
+          fi
+          own=$(git diff --name-only --diff-filter=AMR HEAD^1 HEAD -- changelog.d/ | grep -E "^changelog\.d/$PR\.[a-z-]+(\.[0-9]+)?\.txt$" || true)
+          if [ -n "$own" ]; then
+            echo "Changelog fragments:"; echo "$own"
+          elif ! echo "$changed" | grep -v '^changelog\.d/' > /dev/null; then
+            echo "Only changelog.d/ changed, no fragment needed"
+          else
+            echo "::error::Add a changelog fragment named changelog.d/$PR.<type>.txt (use $PR.none.txt if nothing user-visible changed), see CONTRIBUTING.md#changelog"
+            exit 1
+          fi

data/.github/workflows/ci-with-docker.yml

@@ -17,9 +17,6 @@ jobs:
     - name: Build docker images
       run: docker compose build
 
-    - name: Run ruby 2.6
-      run: docker compose run ruby-2.6
-
     - name: Run ruby 2.7
       run: docker compose run ruby-2.7
 

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4]
+        ruby-version: [2.7.8, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 
@@ -39,11 +39,10 @@ jobs:
             ${{ runner.os }}-pip-v1
       - name: Bundle install
         run: |
-          gem install bundler ${{ (startsWith(matrix.ruby-version, '2.6.') || startsWith(matrix.ruby-version, '2.7.')) && '-v 2.4.22' || '' }}
+          gem install bundler ${{ startsWith(matrix.ruby-version, '2.7.') && '-v 2.4.22' || '' }}
           bundle config set path 'vendor/bundle'
           bundle config set --local path 'vendor/bundle'
           bundle install --jobs 4 --retry 3
-          BUNDLE_GEMFILE=./Gemfile.noed25519 bundle install --jobs 4 --retry 3
         env:
           BUNDLE_PATH: vendor/bundle
 
@@ -79,20 +78,6 @@ jobs:
           NET_SSH_RUN_INTEGRATION_TESTS: 1
           CI: 1
           RUBYOPT: '--enable=frozen-string-literal'
-      - name: Run tests (without rbnacl)
-        run: bundle exec rake test
-        env:
-          BUNDLE_GEMFILE: ./Gemfile.norbnacl
-          NET_SSH_RUN_INTEGRATION_TESTS: 1
-          CI: 1
-          RUBYOPT: '--enable=frozen-string-literal'
-      - name: Run Tests (without ed25519)
-        run: bundle exec rake test
-        env:
-          BUNDLE_GEMFILE: ./Gemfile.noed25519
-          NET_SSH_RUN_INTEGRATION_TESTS: 1
-          CI: 1
-          RUBYOPT: '--enable=frozen-string-literal'
       - name: Run test helper test
         run: bundle exec rake test_test
         env:

data/.github/workflows/rubocop.yml

@@ -1,6 +1,8 @@
 name: Rubocop
 
-on: [push]
+on:
+  pull_request:
+  push: { branches: master }
 
 jobs:
   build:

data/.rubocop.yml

@@ -4,7 +4,7 @@ AllCops:
     - "vendor/**/.*"
     - "vendor/**/*"
   NewCops: enable
-  TargetRubyVersion: 2.6
+  TargetRubyVersion: 2.7
 
 inherit_from: .rubocop_todo.yml
 
@@ -20,3 +20,7 @@ Layout/LineLength:
 
 Style/EmptyLiteral:
   Enabled: false
+
+# CI runs the suite with RUBYOPT=--enable=frozen-string-literal instead of a magic comment in every file.
+Style/FrozenStringLiteralComment:
+  Enabled: false

data/.rubocop_todo.yml

@@ -335,6 +335,7 @@ Naming/MemoizedInstanceVariableName:
 Naming/MethodName:
   Exclude:
     - 'lib/net/ssh/authentication/ed25519_loader.rb'
+    - 'lib/net/ssh/transport/chacha20_poly1305_cipher_loader.rb'
     - 'lib/net/ssh/transport/kex/curve25519_sha256_loader.rb'
     - 'test/authentication/test_agent.rb'
     - 'test/authentication/test_session.rb'
@@ -586,13 +587,6 @@ Style/FormatString:
     - 'lib/net/ssh/authentication/pageant.rb'
     - 'lib/net/ssh/loggable.rb'
 
-# Offense count: 174
-# This cop supports safe auto-correction (--auto-correct).
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: always, always_true, never
-Style/FrozenStringLiteralComment:
-  Enabled: false
-
 # Offense count: 1
 # This cop supports safe auto-correction (--auto-correct).
 Style/GlobalStdStream:

data/CHANGES.txt

@@ -1,8 +1,65 @@
-=== 7.3.6
-
-  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]
-
-=== 7.3.5
+=== 8.0.2
+
+  * Fixed `Session#close` raising `EOFError: cannot send data if channel has declared eof` when a forwarded connection still had unread data from its local client; data net-ssh had already read is still sent before the EOF and, as in OpenSSH, the rest is dropped; a regression in 8.0.0 [#1066, #1067]
+
+=== 8.0.1
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 and 8.0.0 [#1063]
+  * `control_master: :auto` now ignores `forward_agent` (logged at info level) instead of raising ArgumentError, and logs the ignored connection options at info instead of warn level, so it works with sshkit (Kamal, Capistrano), which always passes `forward_agent: true`, `keys`, `known_hosts` and `keepalive` [#1062]
+
+=== 8.0.0
+
+  * No changes since 8.0.0 rc5.
+
+=== 8.0.0 rc5
+
+  * BREAKING: Security: a custom `verify_host_key` verifier must now implement `verify_signature` (deprecated since 5.1.0) or ArgumentError is raised; such verifiers were previously wrapped so the server's host key signature was never checked [#1050]
+  * BREAKING: Unsupported key types now raise `Net::SSH::UnsupportedKeyType` (a `Net::SSH::Exception`) instead of `NotImplementedError`; code that rescued `NotImplementedError` around key loading or connecting should rescue the new class [#945, #1060]
+  * BREAKING: `Net::SSH.start` raises ArgumentError for option values that are `nil` or arrays containing `nil` (deprecated since 4.0.0); omit the option to use the default or ssh_config value, the error names a value that turns it off where one exists (e.g. `proxy: false`, `keys: []`, `config: false`). `password: nil` and `passphrase: nil` are still accepted [#458, #1053]
+  * BREAKING: removed the `:paranoid` option (deprecated since 4.2.0); use `:verify_host_key` with the same values. Passing `:paranoid` raises ArgumentError [#1050]
+  * BREAKING: removed the `verify_host_key` values `false`, `true`, `:very` and `:secure` (deprecated since 5.0.0); use `:never`, `:accept_new_or_local_tunnel`, `:accept_new` and `:always` respectively. The old values raise ArgumentError naming the replacement [#1050]
+  * BREAKING: `Net::SSH::HostKeyEntries::PubKey` (the known_hosts entries returned by `KnownHosts.search_for`) no longer forwards methods to the wrapped key (deprecated since 7.0.0); use `ssh_type`, `to_blob` or `matches_key?`, or the new `key` reader for the wrapped public key [#1050]
+  * Security: `append_all_supported_algorithms: true` no longer enables the `none` cipher and MAC; name them explicitly (`encryption: '+none'`, `hmac: '+none'`) to use them [#1051]
+  * Security: `diffie-hellman-group-exchange-sha1/sha256` now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass `minimum_dh_bits: 1024` to connect to legacy servers that only offer 1024-bit groups. `minimum_dh_bits` values other than 1024 no longer fail key exchange with "could not verify server signature" [#1049]
+  * Security: `diffie-hellman-group14-sha1` is no longer offered by default for key exchange, as in OpenSSH since 8.2; add `KexAlgorithms +diffie-hellman-group14-sha1` in ssh_config (or `kex: '+diffie-hellman-group14-sha1'`) or pass `append_all_supported_algorithms: true` to re-enable [#705, #1042]
+  * Changelog entries are now added as `changelog.d/<PR number>.<type>.txt` fragment files instead of editing CHANGES.txt, and CI requires one per PR; see CONTRIBUTING.md [#1058]
+  * `Net::SSH.start(host, user, control_master: :auto)` reuses an already running OpenSSH ControlMaster found via `:control_path` or ssh_config `ControlPath`, falling back to a normal connection when there is none [#443, #1057]
+  * Default `max_win_size` is now 2 MB as in OpenSSH (was 128 KB), which avoids truncated output from some devices (e.g. Mikrotik); pass `max_win_size: 0x20000` for the old behaviour [#726, #1055]
+  * Added `hmac-sha1-etm@openssh.com`, offered by default after the SHA2 etm MACs as in OpenSSH [#985, #1056]
+  * `Net::SSH::Proxy::Jump` `options:` values may be an Array for ssh_config options that can be given more than once (`IdentityFile`, `CertificateFile`, `SendEnv`); each element is passed as its own `-o Key=value`, an empty Array passes nothing, and a `nil` value (alone or in an Array) raises ArgumentError as in `Net::SSH.start` [#1052]
+  * `ssh-rsa-cert-v00@openssh.com` host keys are deprecated and warn when named in `host_key`/`HostKeyAlgorithms` or negotiated; net-ssh cannot parse v00 certificates, use `ssh-rsa-cert-v01@openssh.com` or a modern key type [#1051]
+  * README: weak algorithms (CBC/3DES/Blowfish ciphers, `ssh-dss`, `diffie-hellman-group1-sha1`, old MACs, ...) stay available as opt-ins for legacy servers rather than being removed in 8.0 [#1051]
+  * An ssh-agent that fails while listing keys (e.g. closes the connection) is now skipped and key files are still tried, as in OpenSSH, instead of aborting authentication [#867, #1048]
+  * `%r` in a ProxyCommand now defaults to the connection's user, as in OpenSSH, instead of raising unless `:remote_user` is set [#881, #787, #1047]
+  * `Net::SSH.start` no longer modifies the options hash passed to it [#989, #1046]
+  * `Session#exec!` with a block now returns an empty string with `exitstatus` (like the non-block form) instead of `nil` [#848, #1045]
+  * ssh_config `KexAlgorithms` is now honoured and maps to `:kex`, including `+`, `-` and `^`; it was previously ignored [#1042]
+  * `Net::SSH::Proxy::Jump.new` accepts `options:`, a Hash of ssh_config options passed to the jump host's ssh command as escaped `-o Key=value` arguments, e.g. `options: { 'StrictHostKeyChecking' => 'no' }` [#915, #1041]
+  * `Net::SSH::Proxy::Jump` no longer fails with "unknown key" or substitutes the target host when the `config:` path contains `%` [#1041]
+
+=== 8.0.0 rc4
+
+  * Security: RSA signatures using SHA-1 (`ssh-rsa`, `ssh-rsa-cert-v01@openssh.com`) are no longer offered by default for host keys or public key authentication, as in OpenSSH since 8.8; RSA keys keep working via rsa-sha2-256/512. For servers that only support SHA-1 add `HostKeyAlgorithms +ssh-rsa` / `PubkeyAcceptedAlgorithms +ssh-rsa` in ssh_config (or `host_key: '+ssh-rsa'` / `pubkey_algorithms: %w[+ssh-rsa]`), or pass `append_all_supported_algorithms: true` [#1039]
+  * Security: ssh_config `PubkeyAcceptedAlgorithms` (and its old name `PubkeyAcceptedKeyTypes`) is now honoured, including `+`, `-` and `^`, and `pubkey_algorithms` now applies to all key types instead of only RSA, adding `rsa-sha2-512`; DSA (`ssh-dss`) keys are no longer offered by default, as in OpenSSH since 7.0 — add `+ssh-dss` or pass `append_all_supported_algorithms: true` to re-enable [#923]
+  * Security: ssh_config `Ciphers`, `MACs`, `KexAlgorithms` and `HostKeyAlgorithms` lists starting with `+`, `-` or `^` now append to, remove from or prepend to the default list, as in OpenSSH, instead of silently enabling every supported algorithm including weak ones that are off by default; every listed item is honoured and `-` accepts wildcards. Pass `append_all_supported_algorithms: true` to also get the full supported list [#925]
+  * Support agent-backed FIDO/U2F security keys (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) for publickey auth [#1007]
+  * Port forwarding no longer buffers a whole stream in memory when one side reads slowly: like OpenSSH, window is granted only as data is written to the local socket, and the local socket is read only while the remote window has room. An application that writes everything to a forwarded port before reading anything now blocks once the window fills, as it would with `ssh -L` or a direct TCP connection; the old unbounded buffering hid this [#1037, #1003]
+  * Data forwarded to a local socket just before the remote end sends EOF or closes the channel is no longer truncated or dropped: it is written out before the socket is shut down or closed, without blocking the event loop until the local application reads [#1037]
+  * Multi-factor authentication works when the server's AuthenticationMethods order differs from net-ssh's: after each partial success the allowed methods are tried again, as OpenSSH does [#873, #872]
+  * `HostKeyError#host`, `#port` and `#ip` now return the connected host, port and IP (`ip` is nil through a ProxyCommand) instead of always nil [#963]
+  * OpenSSH-format private keys with Windows (CRLF) line endings now load [#922, #921]
+  * Send CHANNEL_EOF before CHANNEL_CLOSE when closing a session's remaining channels, as OpenSSH does; fixes hangs at close with servers that wait for EOF, such as some SFTP servers [#672]
+  * ssh_config: trailing `# comments` are now ignored, as in OpenSSH; a `#` inside quotes or in the middle of a word is kept [#990]
+
+=== 8.0.0 rc3
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]
+  * `ProxyJump none` now means no proxy instead of jumping through a host named "none", and `ProxyCommand none` is matched case-insensitively, as in OpenSSH [#893, #972, #1030]
+  * Send SIGHUP to the ProxyCommand process on close, as OpenSSH does, so tunnels such as EC2 Instance Connect Endpoint no longer hang at exit [#947]
+  * Reconnect when the ssh-agent closes the connection on the legacy version request (e.g. older Proton Pass) instead of raising FrozenError [#1008]
+  * ssh_config: parse `Key = value` lines like OpenSSH (the value no longer keeps the leading space, and the keyword ends at the first `=`), and honor ProxyJump/ProxyCommand before the first Host [#1034]
+
+=== 8.0.0 rc2
 
   * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
   * Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
@@ -11,9 +68,27 @@
   * Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
   * Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]
 
-=== 7.3.4
+=== 8.0.0 rc1
+
+  * BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass `no_delay: false` to keep Nagle's algorithm on [#1017]
+  * Ruby 4.0 support: add `logger` as a runtime dependency; Windows Pageant users on Ruby 4.0 need `fiddle` in their Gemfile [#984, #1012]
+  * Close the socket when connection setup fails, e.g. on a server version timeout [#1013]
+  * Ignore SSH_MSG_EXT_INFO from servers that send it unrequested [#1020]
+  * Fix `undefined method 'to_pem'` for ECDSA key_data when an agent is running [#982]
+  * Agent forwarding connects to the agent set by `identity_agent`/IdentityAgent [#974]
+  * Keyboard-interactive prompts show input when the server asks for it to be echoed [#1014]
+  * Raise Net::SSH::Exception on a truncated KEXINIT [#1016]
+  * Remote forwarding no longer prints diagnostics to stdout [#953]
+
+=== 8.0.0 beta3
+
+  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1009]
+
+=== 8.0.0 beta1
 
-  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1010]
+  * BREAKING: require Ruby 2.7 and the openssl gem >= 3.2 [#1001]
+  * Use OpenSSL for Ed25519, X25519 and ChaCha20-Poly1305; the ed25519, x25519 and rbnacl gems are no longer needed [#1001]
+  * Support AEAD-encrypted OpenSSH private keys [#1001]
 
 === 7.3.3
 

data/CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing to net-ssh
+
+Run the unit tests with `bundle exec rake test` and the linter with `bundle exec rubocop`; see [README.md](README.md) and [DEVELOPMENT.md](DEVELOPMENT.md) for integration tests and debugging tips.
+
+## Changelog
+
+Don't edit `CHANGES.txt`. Instead, add a fragment file to `changelog.d/` in your PR; the release's version bump (`rake vbump:*`) moves all fragments into a new `=== <version>` section at the top of `CHANGES.txt` and deletes them.
+
+A fragment is named `<number>.<type>.txt`, where `<number>` is the PR number (so open the PR first, then add the fragment), and contains a single UTF-8 paragraph: the entry as it should read in `CHANGES.txt`, without the bullet or prefix. Lines are joined, so it can be wrapped. If it doesn't end with a reference list such as `[#985, #1056]`, `[GHSA-xxxx-xxxx-xxxx]` or `[CVE-2024-12345, #1060]`, ` [#<number>]` is appended; write the list yourself to reference issues or advisories too.
+
+| Type                | Written as                     | Use for                                                      |
+| ------------------- | ------------------------------ | ------------------------------------------------------------ |
+| `breaking-security` | `* BREAKING: Security: <text>` | an incompatible change made for security                     |
+| `breaking`          | `* BREAKING: <text>`           | an incompatible change                                       |
+| `security`          | `* Security: <text>`           | a security fix or hardening                                  |
+| `change`            | `* <text>`                     | any other user-visible fix or feature                        |
+| `none`              | nothing                        | PRs with no user-visible change (tests, CI, docs, refactors) |
+
+Examples:
+
+```sh
+rake "changelog:new[1058,change,Session#exec! now returns the exit status]"
+# changelog.d/1058.change.txt -> * Session#exec! now returns the exit status [#1058]
+
+echo 'Removed the `:paranoid` option; use `:verify_host_key` [#1050]' > changelog.d/1050.breaking.txt
+echo 'Reject packet lengths above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]' > changelog.d/1060.security.txt
+echo 'Custom verifiers must implement `verify_signature` [#1050]' > changelog.d/1050.breaking-security.txt
+touch changelog.d/1061.none.txt
+```
+
+For several entries from one PR add a suffix: `1050.breaking.txt`, `1050.breaking.2.txt` (`changelog:new` picks the next free one).
+
+In a release section, entries are grouped as `BREAKING: Security:`, `BREAKING:`, `Security:`, then the rest; within a group fragments are ordered by number, newest first, followed by any hand-written entries from an `=== Unreleased` section in their written order. A final release with nothing to report still gets a `=== <version>` section saying `No changes since <previous version>.`
+
+`rake changelog:check` validates the fragments and the `=== Unreleased` section, and `rake changelog:preview` prints the section the next release would add. CI fails a PR that edits `CHANGES.txt` or doesn't add or modify a `changelog.d/<PR number>.<type>.txt` fragment, unless it only touches `changelog.d/` or a maintainer adds the `skip-changelog` label; Dependabot PRs are skipped.

data/Dockerfile

@@ -3,8 +3,8 @@ FROM ruby:${RUBY_VERSION}
 
 ARG BUNDLERV=
 
-# Ruby 2.6 to 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
-RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|; s|security.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
+# Ruby 2.7 and 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
+RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
 
 RUN apt update && apt install -y openssh-server sudo netcat-openbsd \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_1' \
@@ -29,4 +29,4 @@ RUN gem install bundler ${BUNDLERV}  && bundle install
 
 COPY . $INSTALL_PATH/
 
-CMD service ssh start && rake test && NET_SSH_NO_ED25519=1 rake test
+CMD service ssh start && rake test

data/Dockerfile.openssl3

@@ -2,7 +2,7 @@ FROM ubuntu:22.04
 
 ENV INSTALL_PATH="/netssh"
 
-RUN apt update && apt install -y openssl ruby ruby-dev git build-essential
+RUN apt update && apt install -y openssl libssl-dev ruby ruby-dev git build-essential
 
 WORKDIR $INSTALL_PATH
 

data/Dockerfile.zlib_ng

@@ -11,7 +11,7 @@ ENV INSTALL_PATH="/netssh"
 # Ruby/OpenSSL initialises — setting it in the Rakefile is too late.
 ENV OPENSSL_CONF="/netssh/test/openssl3.conf"
 
-RUN dnf install -y openssl ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
+RUN dnf install -y openssl openssl-devel ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
     update-crypto-policies --set LEGACY
 
 WORKDIR $INSTALL_PATH

data/README.md

@@ -28,67 +28,75 @@ It allows you to write programs that invoke and interact with processes on remot
 
 ## Supported Algorithms
 
-Net::SSH 6.0 disables by default the usage of weak algorithms.
-We strongly recommend that you install a servers's version that supports the latest algorithms.
+Net::SSH only offers secure algorithms by default.
+We strongly recommend that you install a server version that supports the latest algorithms.
 
-It is possible to return to the previous behavior by adding the option : `append_all_supported_algorithms: true`
-
-Unsecure algoritms will definitely be removed in Net::SSH 8.*.
+Weak algorithms are still supported as opt-ins, so legacy servers such as embedded routers and old network gear stay reachable. To enable one, prefix it with `+` in the matching option, e.g. `encryption: '+aes256-cbc'`, `hmac: '+hmac-sha1-96'`, `kex: '+diffie-hellman-group1-sha1'`, `host_key: '+ssh-dss'`, or in ssh_config with `Ciphers`, `MACs`, `KexAlgorithms`, `HostKeyAlgorithms` and `PubkeyAcceptedAlgorithms` (e.g. `Ciphers +aes256-cbc`). Passing `append_all_supported_algorithms: true` appends every supported algorithm except the `none` cipher and MAC, which are only used when named explicitly (e.g. `encryption: '+none'`, `hmac: '+none'`).
 
 ### Host Keys
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| ssh-rsa              | OK                    |          |
-| ssh-ed25519          | OK                    | Require the gem `ed25519` |
-| ecdsa-sha2-nistp521  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp384  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp256  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ssh-dss              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                     | Support                | Details  |
+|------------------------------------------|------------------------|----------|
+| ssh-ed25519                              | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ssh-ed25519-cert-v01@openssh.com         | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ecdsa-sha2-nistp521/384/256              | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp521/384/256-cert-v01@openssh.com | OK             | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| rsa-sha2-512                             | OK                     |          |
+| rsa-sha2-256                             | OK                     |          |
+| ssh-rsa                                  | Not offered by default | SHA-1 signatures, off by default as in OpenSSH 8.8; opt-in for legacy servers with `HostKeyAlgorithms +ssh-rsa` or `host_key: '+ssh-rsa'` |
+| ssh-rsa-cert-v01@openssh.com             | Not offered by default | SHA-1 signatures; opt-in for legacy servers |
+| ssh-rsa-cert-v00@openssh.com             | Deprecated             | not offered by default, warns when used and will be removed; net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern key type |
+| ssh-dss                                  | Not offered by default | unsecure, off by default as in OpenSSH 7.0; opt-in for legacy servers |
+
+RSA public key authentication likewise uses rsa-sha2-512 or rsa-sha2-256 by default; ssh-rsa and ssh-dss keys are only offered when enabled, e.g. with `PubkeyAcceptedAlgorithms +ssh-rsa` or `pubkey_algorithms: %w[+ssh-rsa]`.
 
 ### Key Exchange
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| curve25519-sha256                    | OK                    | Require the gem `x25519` |
-| ecdh-sha2-nistp521                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp384                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp256                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| diffie-hellman-group1-sha1           | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group14-sha1          | OK                    |          |
-| diffie-hellman-group-exchange-sha1   | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group-exchange-sha256 | OK                    |          |
+| Name                                 | Support                | Details  |
+|--------------------------------------|------------------------|----------|
+| curve25519-sha256                    | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| curve25519-sha256@libssh.org         | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| ecdh-sha2-nistp521                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp384                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp256                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| diffie-hellman-group-exchange-sha256 | OK                     |          |
+| diffie-hellman-group14-sha256        | OK                     |          |
+| diffie-hellman-group14-sha1          | Not offered by default | SHA-1, off by default as in OpenSSH 8.2; opt-in for legacy servers with `KexAlgorithms +diffie-hellman-group14-sha1` or `kex: '+diffie-hellman-group14-sha1'` |
+| diffie-hellman-group-exchange-sha1   | Not offered by default | unsecure; opt-in for legacy servers |
+| diffie-hellman-group1-sha1           | Not offered by default | unsecure; opt-in for legacy servers |
 
 ### Encryption algorithms (ciphers)
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| aes256-ctr / aes192-ctr / aes128-ctr | OK                    |          |
-| chacha20-poly1305@openssh.com        | OK.                   | Requires the gem `rbnacl` |
-| aes256-cbc / aes192-cbc / aes128-cbc | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| rijndael-cbc@lysator.liu.se          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| blowfish-ctr blowfish-cbc            | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| cast128-ctr cast128-cbc              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| 3des-ctr 3des-cbc                    | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| idea-cbc                             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                    | Support                | Details  |
+|-----------------------------------------|------------------------|----------|
+| chacha20-poly1305@openssh.com           | OK                     | Backed by Ruby OpenSSL ChaCha20 and Poly1305 APIs (`openssl >= 3.2.0`) |
+| aes256-ctr / aes192-ctr / aes128-ctr    | OK                     |          |
+| aes256-gcm@openssh.com / aes128-gcm@openssh.com | OK              |          |
+| aes256-cbc / aes192-cbc / aes128-cbc    | Not offered by default | unsecure; opt-in for legacy servers |
+| rijndael-cbc@lysator.liu.se             | Not offered by default | unsecure; opt-in for legacy servers |
+| blowfish-ctr blowfish-cbc               | Not offered by default | unsecure; opt-in for legacy servers |
+| cast128-ctr cast128-cbc                 | Not offered by default | unsecure; opt-in for legacy servers |
+| 3des-ctr 3des-cbc                       | Not offered by default | unsecure; opt-in for legacy servers |
+| idea-cbc                                | Not offered by default | unsecure; opt-in for legacy servers |
+| none                                    | Not offered by default | no encryption; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ### Message Authentication Code algorithms
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| hmac-sha2-512-etm    | OK                    |          |
-| hmac-sha2-256-etm    | OK                    |          |
-| hmac-sha2-512        | OK                    |          |
-| hmac-sha2-256        | OK                    |          |
-| hmac-sha2-512-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha2-256-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha1            | OK                    | for backward compatibility      |
-| hmac-sha1-96         | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-ripemd160       | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5-96          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                          | Support                | Details  |
+|-------------------------------|------------------------|----------|
+| hmac-sha2-512-etm@openssh.com | OK                     |          |
+| hmac-sha2-256-etm@openssh.com | OK                     |          |
+| hmac-sha1-etm@openssh.com     | OK                     | for backward compatibility |
+| hmac-sha2-512                 | OK                     |          |
+| hmac-sha2-256                 | OK                     |          |
+| hmac-sha1                     | OK                     | for backward compatibility |
+| hmac-sha2-512-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha2-256-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha1-96                  | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-ripemd160 / hmac-ripemd160@openssh.com | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5                      | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5-96                   | Not offered by default | unsecure; opt-in for legacy servers |
+| none                          | Not offered by default | no integrity protection; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ## SYNOPSIS:
 
@@ -148,16 +156,16 @@ See Net::SSH for more documentation, and links to further information.
 
 ## REQUIREMENTS:
 
-The only requirement you might be missing is the OpenSSL bindings for Ruby with a version greather than `1.0.1`.
-These are built by default on most platforms, but you can verify that they're built and installed on your system by running the following command line:
+Net::SSH requires Ruby 2.7 or newer and the Ruby `openssl` gem version `3.2.0` or newer.
+The `openssl` gem uses the OpenSSL library Ruby is built against. You can verify the loaded gem and library with:
 
 ```sh
-ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
+ruby -ropenssl -e 'puts OpenSSL::VERSION; puts OpenSSL::OPENSSL_VERSION'
 ```
 
-If that spits out something like `OpenSSL 1.0.1 14 Mar 2012`, then you're set.
-If you get an error, then you'll need to see about rebuilding ruby with OpenSSL support,
-or (if your platform supports it) installing the OpenSSL bindings separately.
+If `openssl` cannot be required, rebuild Ruby with OpenSSL support or install the Ruby `openssl` gem separately.
+
+Ed25519, curve25519-sha256, and chacha20-poly1305@openssh.com support also require an OpenSSL backend with Ed25519, X25519, ChaCha20, and Poly1305 enabled.
 
 ## INSTALL:
 
@@ -188,14 +196,16 @@ gem install net-ssh -P HighSecurity
 If you don't add the public key, you'll see an error like "Couldn't verify data signature".
 If you're still having trouble let me know and I'll give you a hand.
 
-For ed25519 public key auth support your bundle file should contain `ed25519`, `bcrypt_pbkdf` dependencies.
+Ed25519 public key auth is backed by Ruby OpenSSL. The `bcrypt_pbkdf` gem is only needed when loading bcrypt-encrypted OpenSSH private keys.
 
 ```sh
-gem install ed25519
 gem install bcrypt_pbkdf
 ```
 
-For curve25519-sha256 kex exchange support your bundle file should contain `x25519` dependency.
+### FIDO/U2F security keys
+
+`sk-ecdsa-sha2-nistp256@openssh.com` and `sk-ssh-ed25519@openssh.com` keys work when held in `ssh-agent`.
+Loading `sk-*` private key files from disk is not supported.
 
 ## RUBY SUPPORT
 
@@ -250,6 +260,10 @@ gem cert --add net-ssh-public_cert.pem
 
 or `rake cert:update_public_when_expired`
 
+## CONTRIBUTING
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), including how to add a changelog entry.
+
 ## Security contact information
 
 See [SECURITY.md](SECURITY.md)