net-ssh 8.0.0.rc1 → 8.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aad28c615382be2934f9a43923ede5e5eed71383f3af54a0440ebf94ad40dc1a
-  data.tar.gz: 938c219b1073d44e27de4b5d4c95c01df2903d52f6b737454fb504d878ee6592
+  metadata.gz: 03f0ed4c48532bcfa337a176d655407155043de284d1428cd51a4bf2b7cb2f58
+  data.tar.gz: 49e8bbef56ac3139f5bb05cfad70afb33dda44227e9ce17f4424bd5aed749b95
 SHA512:
-  metadata.gz: a9663038da70081bafeaa5a9bfabc0241f7c249386fc6f475f09611d697c6db00161624777ec92abe0ae8f301f4ba20b2ba3ea869766ebccd6c11648acf5834b
-  data.tar.gz: d8eb01f0e3aad7af012363f211873842c9b80e382d304fb0c3faef045d3eea4ec389ec6aa54be49c600a70bacb566c23b18f0aa0d2d6decf5631169bec01aa59
+  metadata.gz: 56ec747abdff1eb6a0cbfb03adb3f880246372afe864f421c4241881671b9ce49dc1dc37a30c9e75e52526284b7c05caab1f14d367f94a1cdd422e1cf4aea93d
+  data.tar.gz: df092fc1f9da4c85eaf3b305890e0635b9d16d72b3bf05711180a9c28652d97a987be3011bbf7610363d0a9412dafa056c527172519a92c2bf77e7f228bcade8

checksums.yaml.gz.sig

@@ -1 +1 @@
-`t�����}k?G�$�ܸ���j�m_bݗ�A�w��Щ}�k��	t�)d�`������V�	T��E�#u��҉&ۈ�0~��КKK��J-�֨J�}~s�7b�Z�<�grN�?\jAv�T∖ٙ��Չ�<[*ɇ���Ε4uVGSh����ۣ3��H��ʟ�R��թ.uWu���,�L����˓���*:����fVPy��f�;�C�⥒�)���>���1�BC�g���l^hg{`��m�5%��Yg�'�Ԇ���
+E��x��~o�$�>�d"W���f��WZ4���VE���[��*{dO�8F��dsd���E��I~���]�uԑL���=����= ]չ�Ӈ���I�>���J���Ç���;q=G�	�B=�s,��!���9�-M~����������~�J�V:�a�o�s(�7	D6r|z�+H>���y�=���QF�)��R�m��)�E݇AO�-o�c��d�q�.��j�0�t���]�r$�	���щ}5�=d����

data/.github/workflows/rubocop.yml

@@ -1,6 +1,8 @@
 name: Rubocop
 
-on: [push]
+on:
+  pull_request:
+  push: { branches: master }
 
 jobs:
   build:

data/CHANGES.txt

@@ -1,3 +1,20 @@
+=== 8.0.0 rc3
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]
+  * `ProxyJump none` now means no proxy instead of jumping through a host named "none", and `ProxyCommand none` is matched case-insensitively, as in OpenSSH [#893, #972, #1030]
+  * Send SIGHUP to the ProxyCommand process on close, as OpenSSH does, so tunnels such as EC2 Instance Connect Endpoint no longer hang at exit [#947]
+  * Reconnect when the ssh-agent closes the connection on the legacy version request (e.g. older Proton Pass) instead of raising FrozenError [#1008]
+  * ssh_config: parse `Key = value` lines like OpenSSH (the value no longer keeps the leading space, and the keyword ends at the first `=`), and honor ProxyJump/ProxyCommand before the first Host [#1034]
+
+=== 8.0.0 rc2
+
+  * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
+  * Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
+  * Security: reject OpenSSH private keys claiming more than 2**20 bcrypt rounds, and only run the KDF once a passphrase is given [GHSA-rpq3-v334-f5pm]
+  * Security: bound the server's identification banner like OpenSSH (8192-byte lines, 1024 lines), and apply `:timeout` to the whole version exchange instead of only its first byte [GHSA-r75w-7fhp-84w8]
+  * Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
+  * Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]
+
 === 8.0.0 rc1
 
   * BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass `no_delay: false` to keep Nagle's algorithm on [#1017]

data/lib/net/ssh/authentication/agent.rb

@@ -17,6 +17,9 @@ module Net
       # An exception for indicating that the SSH agent is not available.
       class AgentNotAvailable < AgentError; end
 
+      # Raised when the agent closes the connection before replying.
+      class AgentClosedConnection < AgentError; end
+
       # This class implements a simple client for the ssh-agent protocol. It
       # does not implement any specific protocol, but instead copies the
       # behavior of the ssh-agent functions in the OpenSSH library (3.8).
@@ -83,12 +86,18 @@ module Net
         # socket reports that it is an SSH2-compatible agent, this will fail
         # (it only supports the ssh-agent distributed by OpenSSH).
         def connect!(agent_socket_factory = nil, identity_agent = nil)
+          @agent_socket_factory = agent_socket_factory
+          @identity_agent = identity_agent
+          open_agent_socket!
+        end
+
+        def open_agent_socket!
           debug { "connecting to ssh-agent" }
           @socket =
-            if agent_socket_factory
-              agent_socket_factory.call
-            elsif identity_agent
-              unix_socket_class.open(File.expand_path(identity_agent))
+            if @agent_socket_factory
+              @agent_socket_factory.call
+            elsif @identity_agent
+              unix_socket_class.open(File.expand_path(@identity_agent))
             elsif ENV['SSH_AUTH_SOCK'] && unix_socket_class
               unix_socket_class.open(File.expand_path(ENV['SSH_AUTH_SOCK']))
             elsif Gem.win_platform? && RUBY_ENGINE != "jruby"
@@ -100,6 +109,7 @@ module Net
           error { "could not connect to ssh-agent: #{e.message}" }
           raise AgentNotAvailable, $!.message
         end
+        private :open_agent_socket!
 
         # Attempts to negotiate the SSH agent protocol version. Raises an error
         # if the version could not be negotiated successfully.
@@ -114,6 +124,11 @@ module Net
           elsif type != SSH_AGENT_RSA_IDENTITIES_ANSWER1 && type != SSH_AGENT_RSA_IDENTITIES_ANSWER2
             raise AgentNotAvailable, "unknown response from agent: #{type}, #{body.to_s.inspect}"
           end
+        rescue AgentClosedConnection
+          # Agents built on ssh-agent-lib <= 0.6.0 (e.g. older Proton Pass) drop the connection on
+          # this legacy request but handle the rest of the protocol (#1008).
+          debug { "ssh-agent closed the connection on the version request; assuming a modern agent and reconnecting" }
+          open_agent_socket!
         end
 
         # Return an array of all identities (public keys) known to the agent.
@@ -223,8 +238,14 @@ module Net
         # tuple consisting of the packet type, and the packet's body (which
         # is returned as a Net::SSH::Buffer).
         def read_packet
-          buffer = Net::SSH::Buffer.new(@socket.read(4))
-          buffer.append(@socket.read(buffer.read_long))
+          header = @socket.read(4)
+          raise AgentClosedConnection, "agent closed the connection" if header.nil?
+
+          buffer = Net::SSH::Buffer.new(header)
+          body = @socket.read(buffer.read_long)
+          raise AgentClosedConnection, "agent closed the connection" if body.nil?
+
+          buffer.append(body)
           type = buffer.read_byte
           debug { "received agent packet #{type} len #{buffer.length - 4}" }
           return type, buffer

data/lib/net/ssh/authentication/ed25519.rb

@@ -59,6 +59,9 @@ module Net
           MEND = "-----END OPENSSH PRIVATE KEY-----"
           MAGIC = "openssh-key-v1"
 
+          # Same limit as OpenSSH; bcrypt_pbkdf with 2**32 rounds would run for months (GHSA-rpq3-v334-f5pm).
+          MAX_KDF_ROUNDS = 1 << 20
+
           class DecryptError < ArgumentError
             def initialize(message, encrypted_key: false)
               super(message)
@@ -109,6 +112,7 @@ module Net
             if kdfname == 'bcrypt'
               salt = kdfopts.read_string
               rounds = kdfopts.read_long
+              raise ArgumentError.new("Private key bcrypt rounds #{rounds} exceeds #{MAX_KDF_ROUNDS}") if rounds > MAX_KDF_ROUNDS
 
               key = bcrypt_pbkdf_key(password, salt, keylen + ivlen, rounds)
             else
@@ -145,6 +149,7 @@ module Net
             rescue LoadError
               raise DecryptError.new("bcrypt_pbkdf is required to decrypt bcrypt-encrypted OpenSSH private keys")
             end
+            raise DecryptError.new("Passphrase required for encrypted private key", encrypted_key: true) if password.nil? || password.empty?
 
             key = BCryptPbkdf::key(password, salt, length, rounds)
             raise DecryptError.new("BCryptPbkdf failed", encrypted_key: true) unless key

data/lib/net/ssh/config.rb

@@ -88,11 +88,8 @@ module Net
           IO.foreach(file) do |line|
             next if line =~ /^\s*(?:#.*)?$/
 
-            if line =~ /^\s*(\S+)\s*=(.*)$/
-              key, value = $1, $2
-            else
-              key, value = line.strip.split(/\s+/, 2)
-            end
+            # As in OpenSSH, the keyword ends at the first whitespace or "=".
+            key, value = line.strip.split(/\s*=\s*|\s+/, 2)
 
             # silently ignore malformed entries
             next if value.nil?
@@ -152,9 +149,11 @@ module Net
             end
 
             # ProxyCommand and ProxyJump override each other so they need to be tracked togeather
-            %w[proxyjump proxycommand].each do |proxy_key|
-              if (proxy_value = settings.delete(proxy_key))
-                settings['proxy'] ||= [proxy_key, proxy_value]
+            [globals, settings].each do |hash|
+              %w[proxyjump proxycommand].each do |proxy_key|
+                if (proxy_value = hash.delete(proxy_key))
+                  hash['proxy'] ||= [proxy_key, proxy_value]
+                end
               end
             end
           end
@@ -302,13 +301,15 @@ module Net
         def setup_proxy(type, value)
           case type
           when 'proxycommand'
-            if value !~ /^none$/
+            if value !~ /^none$/i
               require 'net/ssh/proxy/command'
               Net::SSH::Proxy::Command.new(value)
             end
           when 'proxyjump'
-            require 'net/ssh/proxy/jump'
-            Net::SSH::Proxy::Jump.new(value)
+            if value !~ /^none$/i
+              require 'net/ssh/proxy/jump'
+              Net::SSH::Proxy::Jump.new(value)
+            end
           end
         end
 

data/lib/net/ssh/key_factory.rb

@@ -55,7 +55,7 @@ module Net
           prompter = nil
           result =
             begin
-              key_type.read(data, passphrase || 'invalid')
+              key_type.read(data, passphrase)
             rescue *key_type.error_classes => e
               encrypted_key = !!key_type.encrypted_key?(data, e) if encrypted_key.nil?
               if encrypted_key && ask_passphrase
@@ -138,8 +138,9 @@ module Net
             raise Exception, "TODO: subclasses should implement"
           end
 
+          # A nil passphrase would make OpenSSL prompt on the terminal itself.
           def self.read(key_data, passphrase)
-            open_ssl_class.new(key_data, passphrase)
+            open_ssl_class.new(key_data, passphrase || 'invalid')
           end
 
           def self.encrypted_key?(key_data, error)
@@ -149,7 +150,7 @@ module Net
 
         class OpenSSLPKeyType < OpenSSLKeyTypeBase
           def self.read(key_data, passphrase)
-            open_ssl_class.read(key_data, passphrase)
+            open_ssl_class.read(key_data, passphrase || 'invalid')
           end
 
           def self.open_ssl_class

data/lib/net/ssh/proxy/command.rb

@@ -16,6 +16,11 @@ module Net
       #     ...
       #   end
       class Command
+        # The command line is run by the shell, so like OpenSSH 9.6 (CVE-2023-51385) we refuse
+        # host and user names containing shell metacharacters rather than substituting them.
+        INVALID_HOST_NAME = /\A-|[[:space:][:cntrl:]'`"$\\;&<>|(){},]/.freeze
+        INVALID_USER_NAME = /\A-|[[:cntrl:]'`";&<>|(){}]|[[:space:]]-|\\\z/.freeze
+
         # The command line template
         attr_reader :command_line_template
 
@@ -41,13 +46,13 @@ module Net
           command_line = @command_line_template.gsub(/%(.)/) {
             case $1
             when 'h'
-              host
+              validate_host_name!(host)
             when 'p'
-              port.to_s
+              validate_port!(port)
             when 'r'
               remote_user = connection_options && connection_options[:remote_user]
               if remote_user
-                remote_user
+                validate_user_name!(remote_user)
               else
                 raise ArgumentError, "remote user name not available"
               end
@@ -117,6 +122,26 @@ module Net
           Process.kill('TERM', io.pid)
           Thread.new { io.close }
         end
+
+        private
+
+        def validate_host_name!(host)
+          raise ArgumentError, "host name contains invalid characters: #{host.inspect}" if host.to_s.match?(INVALID_HOST_NAME)
+
+          host
+        end
+
+        def validate_user_name!(user)
+          raise ArgumentError, "user name contains invalid characters: #{user.inspect}" if user.to_s.match?(INVALID_USER_NAME)
+
+          user
+        end
+
+        def validate_port!(port)
+          raise ArgumentError, "port is not a number: #{port.inspect}" unless port.to_s.match?(/\A\d+\z/)
+
+          port.to_s
+        end
       end
     end
   end

data/lib/net/ssh/proxy/jump.rb

@@ -1,3 +1,4 @@
+require 'shellwords'
 require 'uri'
 require 'net/ssh/proxy/command'
 
@@ -34,20 +35,29 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          first_jump, extra_jumps = jump_proxies.split(",", 2)
+          extra_jumps = jump_proxies.split(",", 2)[1]
           config = connection_options && connection_options[:config]
-          uri = URI.parse("ssh://#{first_jump}")
+          uri, = jump_proxies.split(",").map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
           template << " -l #{uri.user}"    if uri.user
           template << " -p #{uri.port}"    if uri.port
           template << " -J #{extra_jumps}" if extra_jumps
-          template << " -F #{config}" if config != true && config
+          template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
           template << uri.host
 
           @command_line_template = template
         end
+
+        private
+
+        def validate_jump!(jump)
+          uri = URI.parse("ssh://#{jump}")
+          validate_user_name!(uri.user) if uri.user
+          validate_host_name!(uri.host)
+          uri
+        end
       end
     end
   end

data/lib/net/ssh/service/forward.rb

@@ -405,6 +405,12 @@ module Net
 
         # The callback used when an auth-agent channel is requested by the server.
         def auth_agent_channel(session, channel, packet)
+          # Like OpenSSH, only relay the local agent when forwarding was requested (GHSA-qpg5-fx6p-8cq3).
+          unless session.options[:forward_agent] || @agent_forwarded
+            error { "server tried agent forwarding, which was not requested; refusing" }
+            raise Net::SSH::ChannelOpenFailed.new(1, "agent forwarding was not requested")
+          end
+
           info { "opening auth-agent channel" }
           channel[:invisible] = true
 

data/lib/net/ssh/transport/packet_stream.rb

@@ -15,6 +15,9 @@ module Net
       module PacketStream # rubocop:disable Metrics/ModuleLength
         PROXY_COMMAND_HOST_IP = '<no hostip for proxy command>'.freeze
 
+        # Same limit as OpenSSH; a larger length would make us buffer whatever the server streams (GHSA-pfqh-p9vh-wx4p).
+        PACKET_MAX_SIZE = 256 * 1024
+
         include BufferedIo
 
         def self.extended(object)
@@ -187,6 +190,7 @@ module Net
         def cleanup
           client.cleanup
           server.cleanup
+          hang_up_proxy_command
         end
 
         # If the IO object requires a rekey operation (as indicated by either its
@@ -202,6 +206,17 @@ module Net
 
         protected
 
+        # Like OpenSSH, hang up a ProxyCommand child: tunnels such as EC2 Instance
+        # Connect don't exit on their own, and IO#close waits for them.
+        def hang_up_proxy_command
+          return unless respond_to?(:pid)
+
+          child = pid
+          Process.kill('HUP', child) if child
+        rescue IOError, Errno::ESRCH
+          # already closed, or the child has already been reaped
+        end
+
         # Called when this module is used to extend an object. It initializes
         # the states and generally prepares the object for use as a packet stream.
         def initialize_ssh
@@ -240,6 +255,7 @@ module Net
               @packet = Net::SSH::Buffer.new(server.update_cipher(data))
               @packet_length = @packet.read_long
             end
+            raise Net::SSH::Exception, "bad packet length #{@packet_length}" if @packet_length < 5 || @packet_length > PACKET_MAX_SIZE
           end
 
           need = @packet_length + 4 - aad_length - server.block_size

data/lib/net/ssh/transport/server_version.rb

@@ -18,6 +18,10 @@ module Net
         # The SSH version string as reported by Net::SSH
         PROTO_VERSION = "SSH-2.0-Ruby/Net::SSH_#{Net::SSH::Version::CURRENT} #{RUBY_PLATFORM}"
 
+        # Same limits as OpenSSH, so a server can't make us buffer its banner without bound (GHSA-r75w-7fhp-84w8).
+        MAX_LINE_LENGTH = 8192
+        MAX_HEADER_LINES = 1024
+
         # Any header text sent by the server prior to sending the version.
         attr_reader :header
 
@@ -45,24 +49,15 @@ module Net
           socket.write "#{PROTO_VERSION}\r\n"
           socket.flush
 
-          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating" if timeout && !IO.select([socket], nil, nil, timeout)
+          deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
 
-          loop do
-            @version = String.new
-            loop do
-              begin
-                b = socket.readpartial(1)
-                raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
-              rescue EOFError
-                raise Net::SSH::Disconnect, "connection closed by remote host"
-              end
-              @version << b
-              break if b == "\n"
-            end
+          MAX_HEADER_LINES.times do
+            @version = read_line(socket, deadline)
             break if @version.match(/^SSH-/)
 
             @header << @version
           end
+          raise Net::SSH::Exception, "no SSH version received in the first #{MAX_HEADER_LINES} lines" unless @version.match(/^SSH-/)
 
           @version.chomp!
           debug { "remote is `#{@version}'" }
@@ -71,6 +66,31 @@ module Net
 
           raise Net::SSH::ConnectionTimeout, "timeout during client version negotiating" if timeout && !IO.select(nil, [socket], nil, timeout)
         end
+
+        def read_line(socket, deadline)
+          line = String.new
+          loop do
+            wait_readable(socket, deadline)
+            begin
+              b = socket.readpartial(1)
+              raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
+            rescue EOFError
+              raise Net::SSH::Disconnect, "connection closed by remote host"
+            end
+            line << b
+            return line if b == "\n"
+            raise Net::SSH::Exception, "server version line exceeds #{MAX_LINE_LENGTH} bytes" if line.bytesize > MAX_LINE_LENGTH
+          end
+        end
+
+        def wait_readable(socket, deadline)
+          return unless deadline
+
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining > 0 && IO.select([socket], nil, nil, remaining)
+
+          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating"
+        end
       end
     end
   end

data/lib/net/ssh/transport/session.rb

@@ -27,6 +27,10 @@ module Net
         # The standard port for the SSH protocol.
         DEFAULT_PORT = 22
 
+        # Packets held back during a re-key are bounded so a server can't exhaust memory (GHSA-ggxh-cfwq-5xqc).
+        MAX_QUEUED_PACKETS = 16_384
+        MAX_QUEUED_BYTES = 32 * 1024 * 1024
+
         # The host to connect to, as given to the constructor.
         attr_reader :host
 
@@ -81,6 +85,7 @@ module Net
           debug { "connection established" }
 
           @queue = []
+          @queued_bytes = 0
 
           @server_version = ServerVersion.new(socket, logger, options[:timeout])
 
@@ -192,7 +197,7 @@ module Net
         # read from the queue before the socket is queried.
         def poll_message(mode = :nonblock, consume_queue = true)
           loop do
-            return @queue.shift if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
+            return shift_queue if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
 
             packet = socket.next_packet(mode, options[:timeout])
             return nil if packet.nil?
@@ -219,6 +224,7 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.initialized?
 
               push(packet)
             end
@@ -242,6 +248,11 @@ module Net
         # #poll_message will return packets from the queue in the order they
         # were received.
         def push(packet)
+          @queued_bytes += packet.length
+          if @queue.size >= MAX_QUEUED_PACKETS || @queued_bytes > MAX_QUEUED_BYTES
+            raise Net::SSH::Exception, "too many packets queued during key exchange"
+          end
+
           @queue.push(packet)
         end
 
@@ -284,6 +295,12 @@ module Net
 
         private
 
+        def shift_queue
+          packet = @queue.shift
+          @queued_bytes -= packet.length
+          packet
+        end
+
         # Turns Nagle's algorithm off on the socket, so that a packet written
         # while the previous one is still unacknowledged goes out right away
         # instead of waiting for the server's ACK. A ProxyCommand hands the

data/lib/net/ssh/verifiers/always.rb

@@ -51,6 +51,9 @@ module Net
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.
         def verify_certificate!(entry, host_keys, arguments)
+          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
+          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
+
           cert = arguments[:key]
 
           if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)

data/lib/net/ssh/version.rb

@@ -56,7 +56,7 @@ module Net
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed
-      PRE   = "rc1"
+      PRE   = "rc3"
 
       # The current version of the Net::SSH library as a Version instance
       CURRENT = new(*[MAJOR, MINOR, TINY, PRE].compact)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.0.rc1
+  version: 8.0.0.rc3
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger