net-ssh 8.0.0.rc2 → 8.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd6a3f2cc54c2b16873c1bcd92038d6c70e09581fd29c5a6674b708a76c9fec9
-  data.tar.gz: 80fd4270605a25552b4cf7c0ca0c73b358f3806bd3a6654d15b94682fce0ff81
+  metadata.gz: 03f0ed4c48532bcfa337a176d655407155043de284d1428cd51a4bf2b7cb2f58
+  data.tar.gz: 49e8bbef56ac3139f5bb05cfad70afb33dda44227e9ce17f4424bd5aed749b95
 SHA512:
-  metadata.gz: 0cd7d51126432199154b9aeeaf28dd6f0df05c6673c4ccf580b27a84c54d6865500b6ff4e2814e9242cc7dc882d3eec7d95000856b5b732dab97d493d1eabe83
-  data.tar.gz: abce0bd3fcd5b47f74cc9fae9e684282e927b3af17c424e265f87aaf41fb85afbda631a588f080687804102a75692fa2086b8e82bda4af2d99ae824f2251b33d
+  metadata.gz: 56ec747abdff1eb6a0cbfb03adb3f880246372afe864f421c4241881671b9ce49dc1dc37a30c9e75e52526284b7c05caab1f14d367f94a1cdd422e1cf4aea93d
+  data.tar.gz: df092fc1f9da4c85eaf3b305890e0635b9d16d72b3bf05711180a9c28652d97a987be3011bbf7610363d0a9412dafa056c527172519a92c2bf77e7f228bcade8

data/.github/workflows/rubocop.yml

@@ -1,6 +1,8 @@
 name: Rubocop
 
-on: [push]
+on:
+  pull_request:
+  push: { branches: master }
 
 jobs:
   build:

data/CHANGES.txt

@@ -1,3 +1,11 @@
+=== 8.0.0 rc3
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]
+  * `ProxyJump none` now means no proxy instead of jumping through a host named "none", and `ProxyCommand none` is matched case-insensitively, as in OpenSSH [#893, #972, #1030]
+  * Send SIGHUP to the ProxyCommand process on close, as OpenSSH does, so tunnels such as EC2 Instance Connect Endpoint no longer hang at exit [#947]
+  * Reconnect when the ssh-agent closes the connection on the legacy version request (e.g. older Proton Pass) instead of raising FrozenError [#1008]
+  * ssh_config: parse `Key = value` lines like OpenSSH (the value no longer keeps the leading space, and the keyword ends at the first `=`), and honor ProxyJump/ProxyCommand before the first Host [#1034]
+
 === 8.0.0 rc2
 
   * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]

data/lib/net/ssh/authentication/agent.rb

@@ -17,6 +17,9 @@ module Net
       # An exception for indicating that the SSH agent is not available.
       class AgentNotAvailable < AgentError; end
 
+      # Raised when the agent closes the connection before replying.
+      class AgentClosedConnection < AgentError; end
+
       # This class implements a simple client for the ssh-agent protocol. It
       # does not implement any specific protocol, but instead copies the
       # behavior of the ssh-agent functions in the OpenSSH library (3.8).
@@ -83,12 +86,18 @@ module Net
         # socket reports that it is an SSH2-compatible agent, this will fail
         # (it only supports the ssh-agent distributed by OpenSSH).
         def connect!(agent_socket_factory = nil, identity_agent = nil)
+          @agent_socket_factory = agent_socket_factory
+          @identity_agent = identity_agent
+          open_agent_socket!
+        end
+
+        def open_agent_socket!
           debug { "connecting to ssh-agent" }
           @socket =
-            if agent_socket_factory
-              agent_socket_factory.call
-            elsif identity_agent
-              unix_socket_class.open(File.expand_path(identity_agent))
+            if @agent_socket_factory
+              @agent_socket_factory.call
+            elsif @identity_agent
+              unix_socket_class.open(File.expand_path(@identity_agent))
             elsif ENV['SSH_AUTH_SOCK'] && unix_socket_class
               unix_socket_class.open(File.expand_path(ENV['SSH_AUTH_SOCK']))
             elsif Gem.win_platform? && RUBY_ENGINE != "jruby"
@@ -100,6 +109,7 @@ module Net
           error { "could not connect to ssh-agent: #{e.message}" }
           raise AgentNotAvailable, $!.message
         end
+        private :open_agent_socket!
 
         # Attempts to negotiate the SSH agent protocol version. Raises an error
         # if the version could not be negotiated successfully.
@@ -114,6 +124,11 @@ module Net
           elsif type != SSH_AGENT_RSA_IDENTITIES_ANSWER1 && type != SSH_AGENT_RSA_IDENTITIES_ANSWER2
             raise AgentNotAvailable, "unknown response from agent: #{type}, #{body.to_s.inspect}"
           end
+        rescue AgentClosedConnection
+          # Agents built on ssh-agent-lib <= 0.6.0 (e.g. older Proton Pass) drop the connection on
+          # this legacy request but handle the rest of the protocol (#1008).
+          debug { "ssh-agent closed the connection on the version request; assuming a modern agent and reconnecting" }
+          open_agent_socket!
         end
 
         # Return an array of all identities (public keys) known to the agent.
@@ -223,8 +238,14 @@ module Net
         # tuple consisting of the packet type, and the packet's body (which
         # is returned as a Net::SSH::Buffer).
         def read_packet
-          buffer = Net::SSH::Buffer.new(@socket.read(4))
-          buffer.append(@socket.read(buffer.read_long))
+          header = @socket.read(4)
+          raise AgentClosedConnection, "agent closed the connection" if header.nil?
+
+          buffer = Net::SSH::Buffer.new(header)
+          body = @socket.read(buffer.read_long)
+          raise AgentClosedConnection, "agent closed the connection" if body.nil?
+
+          buffer.append(body)
           type = buffer.read_byte
           debug { "received agent packet #{type} len #{buffer.length - 4}" }
           return type, buffer

data/lib/net/ssh/config.rb

@@ -88,11 +88,8 @@ module Net
           IO.foreach(file) do |line|
             next if line =~ /^\s*(?:#.*)?$/
 
-            if line =~ /^\s*(\S+)\s*=(.*)$/
-              key, value = $1, $2
-            else
-              key, value = line.strip.split(/\s+/, 2)
-            end
+            # As in OpenSSH, the keyword ends at the first whitespace or "=".
+            key, value = line.strip.split(/\s*=\s*|\s+/, 2)
 
             # silently ignore malformed entries
             next if value.nil?
@@ -152,9 +149,11 @@ module Net
             end
 
             # ProxyCommand and ProxyJump override each other so they need to be tracked togeather
-            %w[proxyjump proxycommand].each do |proxy_key|
-              if (proxy_value = settings.delete(proxy_key))
-                settings['proxy'] ||= [proxy_key, proxy_value]
+            [globals, settings].each do |hash|
+              %w[proxyjump proxycommand].each do |proxy_key|
+                if (proxy_value = hash.delete(proxy_key))
+                  hash['proxy'] ||= [proxy_key, proxy_value]
+                end
               end
             end
           end
@@ -302,13 +301,15 @@ module Net
         def setup_proxy(type, value)
           case type
           when 'proxycommand'
-            if value !~ /^none$/
+            if value !~ /^none$/i
               require 'net/ssh/proxy/command'
               Net::SSH::Proxy::Command.new(value)
             end
           when 'proxyjump'
-            require 'net/ssh/proxy/jump'
-            Net::SSH::Proxy::Jump.new(value)
+            if value !~ /^none$/i
+              require 'net/ssh/proxy/jump'
+              Net::SSH::Proxy::Jump.new(value)
+            end
           end
         end
 

data/lib/net/ssh/transport/packet_stream.rb

@@ -190,6 +190,7 @@ module Net
         def cleanup
           client.cleanup
           server.cleanup
+          hang_up_proxy_command
         end
 
         # If the IO object requires a rekey operation (as indicated by either its
@@ -205,6 +206,17 @@ module Net
 
         protected
 
+        # Like OpenSSH, hang up a ProxyCommand child: tunnels such as EC2 Instance
+        # Connect don't exit on their own, and IO#close waits for them.
+        def hang_up_proxy_command
+          return unless respond_to?(:pid)
+
+          child = pid
+          Process.kill('HUP', child) if child
+        rescue IOError, Errno::ESRCH
+          # already closed, or the child has already been reaped
+        end
+
         # Called when this module is used to extend an object. It initializes
         # the states and generally prepares the object for use as a packet stream.
         def initialize_ssh

data/lib/net/ssh/verifiers/always.rb

@@ -51,6 +51,9 @@ module Net
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.
         def verify_certificate!(entry, host_keys, arguments)
+          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
+          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
+
           cert = arguments[:key]
 
           if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)

data/lib/net/ssh/version.rb

@@ -56,7 +56,7 @@ module Net
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed
-      PRE   = "rc2"
+      PRE   = "rc3"
 
       # The current version of the Net::SSH library as a Version instance
       CURRENT = new(*[MAJOR, MINOR, TINY, PRE].compact)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.0.rc2
+  version: 8.0.0.rc3
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger