net-ssh 8.0.0.beta3 → 8.0.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee72c6673cb55fe69cdb90bc49d0b7266b29cb80f7a14794f873e048075cde2b
-  data.tar.gz: b9416f51d2b80d5d0bbbcac1b33a4272d5b5add59d81421ca8eaa84db2fd0823
+  metadata.gz: aad28c615382be2934f9a43923ede5e5eed71383f3af54a0440ebf94ad40dc1a
+  data.tar.gz: 938c219b1073d44e27de4b5d4c95c01df2903d52f6b737454fb504d878ee6592
 SHA512:
-  metadata.gz: 4f1d529b4af06145b892c6ece94d2fcc6a9d2b65b93db633189b71988b8bc03aa64feffdfce3509ce64809378ff542b04f01381419d5a9e11246c7303d258583
-  data.tar.gz: 2170524d2a24e1ec8d0c07c3237d140ad00c412c59875f6f178b6f4a2c47ce9d16f8418dee56e0425d8ec8a214f50e0cc96e434d1b6e37998125e1cda9ebb41e
+  metadata.gz: a9663038da70081bafeaa5a9bfabc0241f7c249386fc6f475f09611d697c6db00161624777ec92abe0ae8f301f4ba20b2ba3ea869766ebccd6c11648acf5834b
+  data.tar.gz: d8eb01f0e3aad7af012363f211873842c9b80e382d304fb0c3faef045d3eea4ec389ec6aa54be49c600a70bacb566c23b18f0aa0d2d6decf5631169bec01aa59

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.7.8, 3.0.6, 3.1.3, 3.2.1, 3.3.0, 3.4]
+        ruby-version: [2.7.8, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 

data/CHANGES.txt

@@ -1,7 +1,25 @@
+=== 8.0.0 rc1
+
+  * BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass `no_delay: false` to keep Nagle's algorithm on [#1017]
+  * Ruby 4.0 support: add `logger` as a runtime dependency; Windows Pageant users on Ruby 4.0 need `fiddle` in their Gemfile [#984, #1012]
+  * Close the socket when connection setup fails, e.g. on a server version timeout [#1013]
+  * Ignore SSH_MSG_EXT_INFO from servers that send it unrequested [#1020]
+  * Fix `undefined method 'to_pem'` for ECDSA key_data when an agent is running [#982]
+  * Agent forwarding connects to the agent set by `identity_agent`/IdentityAgent [#974]
+  * Keyboard-interactive prompts show input when the server asks for it to be echoed [#1014]
+  * Raise Net::SSH::Exception on a truncated KEXINIT [#1016]
+  * Remote forwarding no longer prints diagnostics to stdout [#953]
+
 === 8.0.0 beta3
 
   * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1009]
 
+=== 8.0.0 beta1
+
+  * BREAKING: require Ruby 2.7 and the openssl gem >= 3.2 [#1001]
+  * Use OpenSSL for Ed25519, X25519 and ChaCha20-Poly1305; the ed25519, x25519 and rbnacl gems are no longer needed [#1001]
+  * Support AEAD-encrypted OpenSSH private keys [#1001]
+
 === 7.3.3
 
   * Support .pub file as IdentityFile to filter/prioritize agent keys (1Password SSH agent use case) [#942]

data/Dockerfile

@@ -3,6 +3,9 @@ FROM ruby:${RUBY_VERSION}
 
 ARG BUNDLERV=
 
+# Ruby 2.7 and 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
+RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
+
 RUN apt update && apt install -y openssh-server sudo netcat-openbsd \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_1' \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_2' \

data/Dockerfile.zlib_ng

@@ -11,7 +11,7 @@ ENV INSTALL_PATH="/netssh"
 # Ruby/OpenSSL initialises — setting it in the Rakefile is too late.
 ENV OPENSSL_CONF="/netssh/test/openssl3.conf"
 
-RUN dnf install -y openssl openssl-devel ruby ruby-devel git make gcc zlib-ng crypto-policies-scripts && \
+RUN dnf install -y openssl openssl-devel ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
     update-crypto-policies --set LEGACY
 
 WORKDIR $INSTALL_PATH

data/Rakefile

@@ -9,7 +9,11 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc is no longer a default gem as of Ruby 4.0; the rest of the Rakefile works without it.
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -27,17 +31,19 @@ require_relative "lib/net/ssh/version"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do

data/lib/net/ssh/authentication/key_manager.rb

@@ -127,9 +127,10 @@ module Net
           if agent
             agent.identities.each do |key|
               corresponding_user_identity = user_identities.detect { |identity|
-                identity[:public_key] && identity[:public_key].to_pem == key.to_pem
+                identity[:public_key] && identity[:public_key].to_blob == key.to_blob
               }
-              user_identities.delete(corresponding_user_identity) if corresponding_user_identity
+              # By identity: EC::Point#== raises TypeError when compared with other key types.
+              user_identities.reject! { |identity| identity.equal?(corresponding_user_identity) }
 
               if !options[:keys_only] || corresponding_user_identity
                 known_identities[key] = { from: :agent, identity: key }

data/lib/net/ssh/prompt.rb

@@ -41,9 +41,9 @@ module Net
         def ask(prompt, echo = true)
           $stdout.print(prompt)
           $stdout.flush
-          ret = $stdin.noecho(&:gets).chomp
-          $stdout.print("\n")
-          ret
+          ret = echo ? $stdin.gets : $stdin.noecho(&:gets)
+          $stdout.print("\n") unless echo
+          ret.chomp
         end
 
         # success method will be called when the password was accepted

data/lib/net/ssh/service/forward.rb

@@ -388,13 +388,13 @@ module Net
           originator_address = packet.read_string
           originator_port    = packet.read_long
 
-          puts "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}"
+          debug { "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}" }
           remote = @remote_forwarded_ports[[connected_port, connected_address]]
           if remote.nil?
             raise Net::SSH::ChannelOpenFailed.new(1, "unknown request from remote forwarded connection on #{connected_address}:#{connected_port}")
           end
 
-          puts "REMOTE: #{remote.host} #{remote.port}"
+          debug { "REMOTE: #{remote.host} #{remote.port}" }
           client = TCPSocket.new(remote.host, remote.port)
           info { "connected #{connected_address}:#{connected_port} originator #{originator_address}:#{originator_port}" }
 
@@ -409,7 +409,7 @@ module Net
           channel[:invisible] = true
 
           begin
-            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory])
+            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory], session.options[:identity_agent])
             if (agent.socket.is_a? ::IO)
               prepare_client(agent.socket, channel, :agent)
             else

data/lib/net/ssh/transport/algorithms.rb

@@ -347,16 +347,16 @@ module Net
 
           packet.read(16) # skip the cookie value
 
-          data[:kex]                = packet.read_string.split(/,/)
-          data[:host_key]           = packet.read_string.split(/,/)
-          data[:encryption_client]  = packet.read_string.split(/,/)
-          data[:encryption_server]  = packet.read_string.split(/,/)
-          data[:hmac_client]        = packet.read_string.split(/,/)
-          data[:hmac_server]        = packet.read_string.split(/,/)
-          data[:compression_client] = packet.read_string.split(/,/)
-          data[:compression_server] = packet.read_string.split(/,/)
-          data[:language_client]    = packet.read_string.split(/,/)
-          data[:language_server]    = packet.read_string.split(/,/)
+          data[:kex]                = read_name_list(packet)
+          data[:host_key]           = read_name_list(packet)
+          data[:encryption_client]  = read_name_list(packet)
+          data[:encryption_server]  = read_name_list(packet)
+          data[:hmac_client]        = read_name_list(packet)
+          data[:hmac_server]        = read_name_list(packet)
+          data[:compression_client] = read_name_list(packet)
+          data[:compression_server] = read_name_list(packet)
+          data[:language_client]    = read_name_list(packet)
+          data[:language_server]    = read_name_list(packet)
 
           # TODO: if first_kex_packet_follows, we need to try to skip the
           # actual kexinit stuff and try to guess what the server is doing...
@@ -366,6 +366,13 @@ module Net
           return data
         end
 
+        # Reads one comma-separated algorithm name-list from a KEXINIT packet.
+        def read_name_list(packet)
+          list = packet.read_string or raise Net::SSH::Exception, "malformed KEXINIT packet from server"
+
+          list.split(/,/)
+        end
+
         # Given the #algorithms map of preferred algorithm types, this constructs
         # a KEXINIT packet to send to the server. It does not actually send it,
         # it simply builds the packet and returns it.

data/lib/net/ssh/transport/constants.rb

@@ -12,6 +12,7 @@ module Net
         DEBUG                     = 4
         SERVICE_REQUEST           = 5
         SERVICE_ACCEPT            = 6
+        EXT_INFO                  = 7
 
         #--
         # Algorithm negotiation messages

data/lib/net/ssh/transport/session.rb

@@ -62,6 +62,7 @@ module Net
           @port = options[:port] || DEFAULT_PORT
           @bind_address = options[:bind_address] || nil
           @options = options
+          @host_key_verifier = select_host_key_verifier(options[:verify_host_key])
 
           @socket =
             if (factory = options[:proxy])
@@ -75,20 +76,23 @@ module Net
 
           @socket.extend(PacketStream)
           @socket.logger = @logger
+          set_no_delay unless options[:no_delay] == false
 
           debug { "connection established" }
 
           @queue = []
 
-          @host_key_verifier = select_host_key_verifier(options[:verify_host_key])
-
           @server_version = ServerVersion.new(socket, logger, options[:timeout])
 
           @algorithms = Algorithms.new(self, options)
           @algorithms.start
           wait { algorithms.initialized? }
         rescue Errno::ETIMEDOUT
+          @socket&.close
           raise Net::SSH::ConnectionTimeout
+        rescue StandardError
+          @socket&.close
+          raise
         end
 
         def host_keys
@@ -206,6 +210,10 @@ module Net
             when DEBUG
               send(packet[:always_display] ? :fatal : :debug) { packet[:message] }
 
+            # We don't advertise ext-info-c, but some servers send EXT_INFO anyway (#955).
+            when EXT_INFO
+              debug { "ignoring EXT_INFO packet" }
+
             when KEXINIT
               algorithms.accept_kexinit(packet)
 
@@ -276,6 +284,18 @@ module Net
 
         private
 
+        # Turns Nagle's algorithm off on the socket, so that a packet written
+        # while the previous one is still unacknowledged goes out right away
+        # instead of waiting for the server's ACK. A ProxyCommand hands the
+        # transport a pipe rather than a socket, and the command on its other
+        # end owns the TCP connection, so there is nothing to set in that case.
+        def set_no_delay
+          return unless socket.respond_to?(:setsockopt)
+
+          debug { "setting TCP_NODELAY" }
+          socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
+        end
+
         # Compatibility verifier which allows users to keep using
         # custom verifier code without adding new :verify_signature
         # method.

data/lib/net/ssh/version.rb

@@ -56,7 +56,7 @@ module Net
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed
-      PRE   = "beta3"
+      PRE   = "rc1"
 
       # The current version of the Net::SSH library as a Version instance
       CURRENT = new(*[MAJOR, MINOR, TINY, PRE].compact)

data/lib/net/ssh.rb

@@ -69,7 +69,7 @@ module Net
       max_win_size send_env set_env use_agent number_of_password_prompts
       append_all_supported_algorithms non_interactive password_prompt
       agent_socket_factory minimum_dh_bits verify_host_key
-      fingerprint_hash check_host_ip pubkey_algorithms
+      fingerprint_hash check_host_ip pubkey_algorithms no_delay
     ]
 
     # The standard means of starting a new SSH connection. When used with a
@@ -156,6 +156,12 @@ module Net
     #   for better performance if your SSH server supports it (most do).
     # * :max_win_size => maximum size we tell the other side that is supported for
     #   the window.
+    # * :no_delay => turns Nagle's algorithm off on the connection's socket
+    #   (TCP_NODELAY), so a packet written while the previous one is still
+    #   unacknowledged is sent right away instead of waiting for the server's
+    #   ACK. OpenSSH does the same for every connection. Set to +false+ to keep
+    #   Nagle's algorithm on. Has no effect when the socket comes from a
+    #   ProxyCommand, whose command owns the TCP connection. Defaults to +true+.
     # * :non_interactive => set to true if your app is non interactive and prefers
     #   authentication failure vs password prompt. Non-interactive applications
     #   should set it to true to prefer failing a password/etc auth methods vs.

data/net-ssh.gemspec

@@ -30,6 +30,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency("logger")
   spec.add_dependency("openssl", ">= 3.2.0")
 
   spec.add_development_dependency("bcrypt_pbkdf", "~> 1.0") unless RUBY_PLATFORM == "java"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.0.beta3
+  version: 8.0.0.rc1
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,8 +32,22 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-08-09 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement