net-ssh 7.3.6 → 8.0.2

data/rakelib/changelog.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'open3'
+
+# Builds CHANGES.txt sections from the fragment files in changelog.d/ (see CONTRIBUTING.md).
+class Changelog
+  class Error < StandardError; end
+
+  # Output order of the groups in a release section; `none` fragments are never emitted.
+  TYPES = {
+    'breaking-security' => 'BREAKING: Security: ',
+    'breaking' => 'BREAKING: ',
+    'security' => 'Security: ',
+    'change' => '',
+    'none' => nil
+  }.freeze
+
+  FILENAME = /\A(?<number>[1-9]\d*)\.(?<type>[a-z-]+)(?:\.(?<seq>[1-9]\d*))?\.txt\z/.freeze
+  REF = /#\d+|GHSA(?:-[a-z0-9]{4}){3}|CVE-\d{4}-\d+/i.freeze
+  REF_LIST = /\[(?:#{REF})(?:,\s*(?:#{REF}))*\]\z/.freeze
+  UNRELEASED = '=== Unreleased'
+  PLACEHOLDER = 'TODO: describe the change as it should read in CHANGES.txt'
+
+  Fragment = Struct.new(:path, :number, :type, :seq, :text) do
+    def entry
+      "#{TYPES.fetch(type)}#{text}"
+    end
+
+    def sort_key
+      [-number, seq]
+    end
+  end
+
+  attr_reader :dir, :changes_path
+
+  def initialize(root)
+    @root = root
+    @dir = File.join(root, 'changelog.d')
+    @changes_path = File.join(root, 'CHANGES.txt')
+  end
+
+  # Raises Error listing every invalid fragment; returns all fragments, including `none` ones.
+  def fragments
+    errors = []
+    fragments = []
+    entries_in_dir.each do |name|
+      result = parse_fragment(name)
+      result.is_a?(Fragment) ? fragments << result : errors << "changelog.d/#{name}: #{result}"
+    end
+    raise Error, "Invalid changelog fragments:\n  #{errors.join("\n  ")}" unless errors.empty?
+
+    fragments.sort_by(&:sort_key)
+  end
+
+  # Validates the fragments and the `=== Unreleased` section of CHANGES.txt; returns the fragments.
+  def check
+    all = fragments
+    split_changes(read_changes)
+    all
+  end
+
+  # The text of the section for +heading+, or nil for a pre-release with nothing to release.
+  def section(heading)
+    assemble(heading, fragments, split_changes(read_changes))
+  end
+
+  # Writes the section for +heading+ to the top of CHANGES.txt, folding in any `=== Unreleased`
+  # entries, and removes all fragments; returns the section, or nil when CHANGES.txt was left unchanged.
+  def release(heading)
+    all = fragments
+    content = read_changes
+    raise Error, "CHANGES.txt already has a '=== #{heading}' section" if content.lines.any? { |l| l.chomp == "=== #{heading}" }
+
+    parts = split_changes(content)
+    section = assemble(heading, all, parts)
+    if section
+      rest = parts[:rest].empty? ? '' : "\n#{parts[:rest]}"
+      File.write(changes_path, "#{parts[:preamble]}#{section}#{rest}")
+    end
+    remove(all.map(&:path))
+    section
+  end
+
+  # Creates a fragment for PR +number+ and returns its path; picks the next free `.N` suffix if needed.
+  def new_fragment(number, type, text = nil)
+    path = (1..).lazy.map { |seq| File.join(dir, fragment_name(number, type, seq)) }.find { |p| !File.exist?(p) }
+    error = validate_name(File.basename(path))
+    raise Error, error if error
+
+    FileUtils.mkdir_p(dir)
+    text = PLACEHOLDER if (text.nil? || text.strip.empty?) && type != 'none'
+    File.write(path, "#{text}\n")
+    path
+  end
+
+  def self.heading(major, minor, tiny, pre)
+    ["#{major}.#{minor}.#{tiny}", pre].compact.join(' ')
+  end
+
+  private
+
+  def entries_in_dir
+    return [] unless Dir.exist?(dir)
+
+    Dir.children(dir).sort.reject { |name| name == 'README.md' || name.start_with?('.') }
+  end
+
+  def fragment_name(number, type, seq)
+    seq == 1 ? "#{number}.#{type}.txt" : "#{number}.#{type}.#{seq}.txt"
+  end
+
+  def validate_name(name)
+    match = FILENAME.match(name)
+    return "file name must be <PR number>.<type>[.<n>].txt, types: #{TYPES.keys.join(', ')}" unless match
+    return "unknown type '#{match[:type]}', expected one of: #{TYPES.keys.join(', ')}" unless TYPES.key?(match[:type])
+
+    nil
+  end
+
+  # Returns a Fragment, or an error message.
+  def parse_fragment(name)
+    path = File.join(dir, name)
+    return 'is not a file' unless File.file?(path)
+
+    error = validate_name(name)
+    return error if error
+
+    match = FILENAME.match(name)
+    fragment = Fragment.new(path, match[:number].to_i, match[:type], (match[:seq] || 1).to_i, nil)
+    return fragment if fragment.type == 'none'
+
+    text = parse_text(read_utf8(path))
+    return text[:error] if text[:error]
+
+    fragment.text = text[:text]
+    fragment.text = "#{fragment.text} [##{fragment.number}]" unless fragment.text.match?(REF_LIST)
+    fragment
+  end
+
+  def parse_text(raw)
+    return { error: 'is not valid UTF-8' } unless raw.valid_encoding?
+
+    lines = raw.strip.lines.map(&:strip)
+    return { error: 'is empty' } if lines.empty?
+    return { error: 'must be a single paragraph (no blank lines)' } if lines.include?('')
+
+    text = lines.join(' ')
+    return { error: 'still contains the placeholder text' } if text == PLACEHOLDER
+    return { error: "should not start with a bullet, it's added when assembling" } if text.match?(/\A[*-] /)
+    return { error: 'should not start with BREAKING:/Security:, the type adds the prefix' } if text.match?(/\A(BREAKING|Security):/i)
+
+    { text: text }
+  end
+
+  def read_changes
+    File.exist?(changes_path) ? read_utf8(changes_path).gsub("\r\n", "\n") : ''
+  end
+
+  # Explicit so a non-UTF-8 locale (e.g. LANG=C) doesn't break on non-ASCII text.
+  def read_utf8(path)
+    File.read(path, mode: 'r:bom|utf-8')
+  end
+
+  # A final release (a heading without a pre-release suffix) always gets a section, so every published version has a heading.
+  def assemble(heading, fragments, parts)
+    entries = grouped_entries(fragments, parts[:unreleased])
+    if entries.empty?
+      return nil unless heading.match?(/\A\d+\.\d+\.\d+\z/)
+
+      previous = parts[:rest][/\A=== (.+)$/, 1]
+      entries = ["  * #{previous ? "No changes since #{previous}." : 'No changes.'}\n"]
+    end
+    "=== #{heading}\n\n#{entries.join}"
+  end
+
+  # Splits CHANGES.txt into the text before the first heading, the entries of a leading
+  # `=== Unreleased` section (as lists of raw lines) and everything from the first released heading on.
+  def split_changes(content)
+    lines = content.lines
+    first = lines.index { |l| l.start_with?('=== ') } || lines.size
+    preamble = lines[0...first].join
+    return { preamble: preamble, unreleased: [], rest: lines[first..].join } unless lines[first]&.chomp == UNRELEASED
+
+    body_end = lines.index.with_index { |l, i| i > first && l.start_with?('=== ') } || lines.size
+    { preamble: preamble, unreleased: unreleased_entries(lines[(first + 1)...body_end]), rest: lines[body_end..].join }
+  end
+
+  def unreleased_entries(lines)
+    lines.each_with_object([]) do |line, entries|
+      next if line.strip.empty?
+
+      if line.match?(/\A\s*\* /)
+        entries << [line]
+      elsif entries.empty?
+        raise Error, "Cannot parse the Unreleased section of CHANGES.txt near: #{line.strip}"
+      else
+        entries.last << line
+      end
+    end
+  end
+
+  # Fragments come before the hand-written Unreleased entries of the same group.
+  def grouped_entries(fragments, unreleased)
+    TYPES.keys.flat_map do |type|
+      from_fragments = fragments.select { |f| f.type == type && type != 'none' }.map { |f| "  * #{f.entry}\n" }
+      from_unreleased = unreleased.select { |lines| unreleased_type(lines.first) == type }.map do |lines|
+        lines.join.end_with?("\n") ? lines.join : "#{lines.join}\n"
+      end
+      from_fragments + from_unreleased
+    end
+  end
+
+  def unreleased_type(line)
+    text = line.sub(/\A\s*\* /, '')
+    TYPES.find { |_type, prefix| prefix && !prefix.empty? && text.start_with?(prefix) }&.first || 'change'
+  end
+
+  # `git rm` so the deletions are staged with the version bump; plain delete outside a git checkout.
+  def remove(paths)
+    return if paths.empty?
+
+    relative = paths.map { |p| p.delete_prefix("#{@root}/") }
+    _out, status = Open3.capture2e('git', '-C', @root, 'rm', '-q', '--', *relative)
+    FileUtils.rm_f(paths) unless status.success?
+  rescue SystemCallError
+    FileUtils.rm_f(paths)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.6
+  version: 8.0.2
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,64 +32,50 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: bcrypt_pbkdf
+  name: logger
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
-- !ruby/object:Gem::Dependency
-  name: ed25519
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :development
+        version: '0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: x25519
+  name: openssl
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
+        version: 3.2.0
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.2.0
 - !ruby/object:Gem::Dependency
-  name: rbnacl
+  name: bcrypt_pbkdf
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -136,16 +122,22 @@ dependencies:
   name: mocha
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.1'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: ostruct
   requirement: !ruby/object:Gem::Requirement
@@ -202,6 +194,8 @@ files:
 - ".dockerignore"
 - ".github/FUNDING.yml"
 - ".github/config/rubocop_linter_action.yml"
+- ".github/pull_request_template.md"
+- ".github/workflows/changelog.yml"
 - ".github/workflows/ci-with-docker.yml"
 - ".github/workflows/ci.yml"
 - ".github/workflows/rubocop.yml"
@@ -209,13 +203,12 @@ files:
 - ".rubocop.yml"
 - ".rubocop_todo.yml"
 - CHANGES.txt
+- CONTRIBUTING.md
 - DEVELOPMENT.md
 - Dockerfile
 - Dockerfile.openssl3
 - Dockerfile.zlib_ng
 - Gemfile
-- Gemfile.noed25519
-- Gemfile.norbnacl
 - ISSUE_TEMPLATE.md
 - LICENSE.txt
 - Manifest
@@ -224,6 +217,7 @@ files:
 - SECURITY.md
 - THANKS.txt
 - appveyor.yml
+- changelog.d/README.md
 - docker-compose.yml
 - lib/net/ssh.rb
 - lib/net/ssh/authentication/agent.rb
@@ -240,6 +234,7 @@ files:
 - lib/net/ssh/authentication/methods/publickey.rb
 - lib/net/ssh/authentication/pageant.rb
 - lib/net/ssh/authentication/pub_key_fingerprint.rb
+- lib/net/ssh/authentication/security_key.rb
 - lib/net/ssh/authentication/session.rb
 - lib/net/ssh/buffer.rb
 - lib/net/ssh/buffered_io.rb
@@ -254,6 +249,10 @@ files:
 - lib/net/ssh/key_factory.rb
 - lib/net/ssh/known_hosts.rb
 - lib/net/ssh/loggable.rb
+- lib/net/ssh/multiplex.rb
+- lib/net/ssh/multiplex/client.rb
+- lib/net/ssh/multiplex/control_path.rb
+- lib/net/ssh/multiplex/proxy_transport.rb
 - lib/net/ssh/packet.rb
 - lib/net/ssh/prompt.rb
 - lib/net/ssh/proxy/command.rb
@@ -290,6 +289,7 @@ files:
 - lib/net/ssh/transport/hmac/ripemd160.rb
 - lib/net/ssh/transport/hmac/sha1.rb
 - lib/net/ssh/transport/hmac/sha1_96.rb
+- lib/net/ssh/transport/hmac/sha1_etm.rb
 - lib/net/ssh/transport/hmac/sha2_256.rb
 - lib/net/ssh/transport/hmac/sha2_256_96.rb
 - lib/net/ssh/transport/hmac/sha2_256_etm.rb
@@ -324,6 +324,7 @@ files:
 - lib/net/ssh/version.rb
 - net-ssh-public_cert.pem
 - net-ssh.gemspec
+- rakelib/changelog.rb
 - support/ssh_tunnel_bug.rb
 homepage: https://github.com/net-ssh/net-ssh
 licenses:
@@ -338,7 +339,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.6'
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/Gemfile.noed25519

@@ -1,12 +0,0 @@
-source 'https://rubygems.org'
-
-ENV['NET_SSH_NO_ED25519'] = 'true'
-# Specify your gem's dependencies in mygem.gemspec
-gemspec
-
-if ENV["CI"] && !Gem.win_platform?
-  gem 'simplecov', require: false, group: :test
-  gem 'codecov', require: false, group: :test
-end
-
-gem 'webrick', group: %i[development test] if RUBY_VERSION.split(".")[0].to_i >= 3

data/Gemfile.norbnacl

@@ -1,12 +0,0 @@
-source 'https://rubygems.org'
-
-ENV['NET_SSH_NO_RBNACL'] = 'true'
-# Specify your gem's dependencies in mygem.gemspec
-gemspec
-
-if ENV["CI"] && !Gem.win_platform?
-  gem 'simplecov', require: false, group: :test
-  gem 'codecov', require: false, group: :test
-end
-
-gem 'webrick', group: %i[development test] if RUBY_VERSION.split(".")[0].to_i >= 3