net-ssh 8.0.4 → 8.1.1

data/lib/net/ssh/prompt.rb

@@ -26,22 +26,48 @@ module Net
 
       def initialize(options = {}); end
 
+      # Whether the default prompt has a terminal or an askpass program to ask with.
+      def self.can_ask?
+        $stdin.tty? || !askpass.nil?
+      end
+
+      # The SSH_ASKPASS program to ask with instead of the terminal, chosen with
+      # the SSH_ASKPASS_REQUIRE and DISPLAY rules described in ssh(1).
+      def self.askpass
+        program = ENV['SSH_ASKPASS'].to_s
+        return nil if program.empty?
+
+        display = !ENV['DISPLAY'].to_s.empty? || !ENV['WAYLAND_DISPLAY'].to_s.empty?
+        case ENV['SSH_ASKPASS_REQUIRE'].to_s.downcase
+        when 'force' then program
+        when 'never' then nil
+        when 'prefer' then (program if display)
+        else (program if display && !$stdin.tty?)
+        end
+      end
+
       # default prompt object implementation. More sophisticated implemenetations
       # might implement caching.
       class Prompter
         def initialize(info)
+          @askpass = Prompt.askpass
+          @header = []
           if info[:type] == 'keyboard-interactive'
-            $stdout.puts(info[:name]) unless info[:name].empty?
-            $stdout.puts(info[:instruction]) unless info[:instruction].empty?
+            @header << info[:name] unless info[:name].empty?
+            @header << info[:instruction] unless info[:instruction].empty?
           end
+          $stdout.puts(@header) unless @askpass || @header.empty?
         end
 
         # ask input from user, a prompter might ask for multiple inputs
         # (like user and password) in a single session.
         def ask(prompt, echo = true)
+          return ask_askpass(prompt) if @askpass
+
           $stdout.print(prompt)
           $stdout.flush
-          ret = echo ? $stdin.gets : $stdin.noecho(&:gets)
+          hide = !echo && $stdin.tty?
+          ret = hide ? $stdin.noecho(&:gets) : $stdin.gets
           $stdout.print("\n") unless echo
           ret.chomp
         end
@@ -49,6 +75,18 @@ module Net
         # success method will be called when the password was accepted
         # It's a good time to save password asked to a cache.
         def success; end
+
+        private
+
+        # Like OpenSSH, a cancelled or failed askpass answers with an empty string.
+        def ask_askpass(prompt)
+          text = (@header + [prompt]).join("\n")
+          @header = []
+          answer = IO.popen([@askpass, text], &:read)
+          Process.last_status.success? ? answer.chomp : ""
+        rescue SystemCallError
+          ""
+        end
       end
 
       # start password session. Multiple questions might be asked multiple times

data/lib/net/ssh/transport/algorithms.rb

@@ -424,7 +424,10 @@ module Net
         # a KEXINIT packet to send to the server. It does not actually send it,
         # it simply builds the packet and returns it.
         def build_client_algorithm_packet
-          kex         = algorithms[:kex].join(",")
+          kex_names   = algorithms[:kex]
+          # RFC 8308: ext-info-c is only meaningful in the first key exchange.
+          kex_names  += %w[ext-info-c] unless session_id
+          kex         = kex_names.join(",")
           host_key    = algorithms[:host_key].join(",")
           encryption  = algorithms[:encryption].join(",")
           hmac        = algorithms[:hmac].join(",")

data/lib/net/ssh/transport/session.rb

@@ -56,6 +56,11 @@ module Net
         # The hash of options that were given to the object at initialization.
         attr_reader :options
 
+        # The signature algorithms the server accepts for publickey
+        # authentication, from its RFC 8308 server-sig-algs extension, or nil if
+        # it did not send one.
+        attr_reader :server_sig_algs
+
         # Instantiates a new transport layer abstraction. This will block until
         # the initial key exchange completes, leaving you with a ready-to-use
         # transport session.
@@ -219,9 +224,8 @@ module Net
             when DEBUG
               send(packet[:always_display] ? :fatal : :debug) { packet[:message] }
 
-            # We don't advertise ext-info-c, but some servers send EXT_INFO anyway (#955).
             when EXT_INFO
-              debug { "ignoring EXT_INFO packet" }
+              accept_ext_info(packet)
 
             when KEXINIT
               algorithms.accept_kexinit(packet)
@@ -300,6 +304,20 @@ module Net
 
         private
 
+        # Parses an RFC 8308 EXT_INFO packet, which servers send after the first
+        # NEWKEYS and possibly again just before USERAUTH_SUCCESS.
+        def accept_ext_info(packet)
+          count = packet.read_long or raise Net::SSH::Exception, "malformed EXT_INFO packet from server"
+          count.times do
+            name = packet.read_string
+            value = packet.read_string
+            raise Net::SSH::Exception, "malformed EXT_INFO packet from server" if name.nil? || value.nil?
+
+            debug { "EXT_INFO #{name}: #{value}" }
+            @server_sig_algs = value.split(",") if name == "server-sig-algs"
+          end
+        end
+
         def shift_queue
           packet = @queue.shift
           @queued_bytes -= packet.length

data/lib/net/ssh/verifiers/accept_new_or_local_tunnel.rb

@@ -7,11 +7,13 @@ module Net
       # verify a connection if the server is the localhost and the port is a
       # nonstandard port number. Those two conditions will typically mean the
       # connection is being tunnelled through a forwarded port, so the known-hosts
-      # file will not be helpful (in general).
+      # file will not be helpful (in general). A key marked @revoked is refused
+      # either way.
       class AcceptNewOrLocalTunnel < AcceptNew
         # Tries to determine if the connection is being tunnelled, and if so,
         # returns true. Otherwise, performs the standard strict verification.
         def verify(arguments)
+          refuse_revoked!(arguments)
           return true if tunnelled?(arguments)
 
           super

data/lib/net/ssh/verifiers/always.rb

@@ -10,10 +10,13 @@ module Net
       # (HostKeyUnknown). This is in contrast to the "Strict" class, which will
       # silently add the key to your known_hosts file. If the server does appear at
       # least once, but the key given does not match any known for the server, an
-      # exception will be raised (HostKeyMismatch).
+      # exception will be raised (HostKeyMismatch). A key marked @revoked in a
+      # host file is always refused (HostKeyRevoked).
       # Otherwise, this returns true.
       class Always
         def verify(arguments)
+          refuse_revoked!(arguments)
+
           host_keys = arguments[:session].host_keys
 
           # We've never seen this host before, so raise an exception.
@@ -47,6 +50,18 @@ module Net
 
         private
 
+        # Custom :known_hosts objects may return a host_keys collection with no
+        # revocation support.
+        def refuse_revoked!(arguments)
+          host_keys = arguments[:session].host_keys
+          return unless host_keys.respond_to?(:revoked?) && host_keys.revoked?(arguments[:key])
+
+          exception = HostKeyRevoked.new("fingerprint #{arguments[:fingerprint]} " +
+                                         "is revoked for #{host_keys.host.inspect}")
+          exception.data = arguments
+          raise exception
+        end
+
         # Enforces the @cert-authority certificate constraints for entries that
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.

data/lib/net/ssh/verifiers/never.rb

@@ -3,7 +3,8 @@ module Net
     module Verifiers
       # This host key verifier simply allows every key it sees, without
       # any verification. This is simple, but very insecure because it
-      # exposes you to MiTM attacks.
+      # exposes you to MiTM attacks. It does not read the known hosts files,
+      # so it accepts keys marked @revoked as well.
       class Never
         # Returns true.
         def verify(arguments)

data/lib/net/ssh/version.rb

@@ -49,10 +49,10 @@ module Net
       MAJOR = 8
 
       # The minor component of this version of the Net::SSH library
-      MINOR = 0
+      MINOR = 1
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 4
+      TINY  = 1
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/lib/net/ssh.rb

@@ -69,7 +69,7 @@ module Net
       host_name user properties passphrase keys_only max_pkt_size
       max_win_size send_env set_env use_agent number_of_password_prompts
       append_all_supported_algorithms non_interactive password_prompt
-      agent_socket_factory minimum_dh_bits verify_host_key
+      prompt_without_tty agent_socket_factory minimum_dh_bits verify_host_key
       fingerprint_hash check_host_ip pubkey_algorithms no_delay
       control_master control_path preopen_channels
     ]
@@ -216,7 +216,10 @@ module Net
     # * :non_interactive => set to true if your app is non interactive and prefers
     #   authentication failure vs password prompt. Non-interactive applications
     #   should set it to true to prefer failing a password/etc auth methods vs.
-    #   asking for password.
+    #   asking for password. Like OpenSSH, Net::SSH never prompts when $stdin is
+    #   not a TTY (e.g. in a background job), so it defaults to +true+ then,
+    #   unless :password_prompt or :prompt_without_tty is given or an
+    #   SSH_ASKPASS program can be used (see Net::SSH::Prompt.askpass).
     # * :passphrase => the passphrase to use when loading a private key (default
     #   is +nil+, for no passphrase)
     # * :password => the password to use to login
@@ -227,6 +230,10 @@ module Net
     #   costs one round trip instead of two. The spare counts against the
     #   server's MaxSessions; if the server refuses it, pre-opening stops for
     #   the session. Defaults to +false+.
+    # * :prompt_without_tty => set to +true+ to prompt for passwords, key
+    #   passphrases and keyboard-interactive responses on $stdout/$stdin even
+    #   when $stdin is not a TTY, e.g. to read a password piped into the
+    #   process. Defaults to +false+.
     # * :properties => a hash of key/value pairs to add to the new connection's
     #   properties (see Net::SSH::Connection::Session#properties)
     # * :proxy => a proxy instance (see Proxy) to use when connecting
@@ -306,7 +313,7 @@ module Net
       assign_defaults(options)
 
       options[:user] = user if user
-      options = configuration_for(host, options.fetch(:config, true)).merge(options)
+      options = configuration_for(host, options.fetch(:config, true), user: options[:user]).merge(options)
       host = options.fetch(:host_name, host)
 
       options[:check_host_ip] = true unless options.key?(:check_host_ip)
@@ -365,15 +372,17 @@ module Net
     # be a file name (or array of file names) of SSH configuration file(s)
     # to read.
     #
+    # +user+ is the explicitly requested remote user, matched by <tt>Match User</tt>.
+    #
     # See Net::SSH::Config for the full description of all supported options.
-    def self.configuration_for(host, use_ssh_config)
+    def self.configuration_for(host, use_ssh_config, user: nil)
       files = case use_ssh_config
               when true then Net::SSH::Config.expandable_default_files
               when false, nil then return {}
               else Array(use_ssh_config)
               end
 
-      Net::SSH::Config.for(host, files)
+      Net::SSH::Config.for(host, files, user: user)
     end
 
     def self.assign_defaults(options)
@@ -382,6 +391,9 @@ module Net
         options[:logger].level = Logger::FATAL
       end
 
+      unless options[:password_prompt] || options[:prompt_without_tty] || Prompt.can_ask?
+        options[:non_interactive] = true
+      end
       options[:password_prompt] ||= Prompt.default(options)
 
       %i[password passphrase].each do |key|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.1.1
 platform: ruby
 authors:
 - Jamis Buck
 - Delano Mandelbaum
 - Miklós Fazekas
 autorequire:
-bindir: exe
+bindir: bin
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-25 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger
@@ -191,34 +191,9 @@ extra_rdoc_files:
 - LICENSE.txt
 - README.md
 files:
-- ".dockerignore"
-- ".github/FUNDING.yml"
-- ".github/config/rubocop_linter_action.yml"
-- ".github/pull_request_template.md"
-- ".github/workflows/changelog.yml"
-- ".github/workflows/ci-with-docker.yml"
-- ".github/workflows/ci.yml"
-- ".github/workflows/rubocop.yml"
-- ".gitignore"
-- ".rubocop.yml"
-- ".rubocop_todo.yml"
 - CHANGES.txt
-- CONTRIBUTING.md
-- DEVELOPMENT.md
-- Dockerfile
-- Dockerfile.openssl3
-- Dockerfile.zlib_ng
-- Gemfile
-- ISSUE_TEMPLATE.md
 - LICENSE.txt
-- Manifest
 - README.md
-- Rakefile
-- SECURITY.md
-- THANKS.txt
-- appveyor.yml
-- changelog.d/README.md
-- docker-compose.yml
 - lib/net/ssh.rb
 - lib/net/ssh/authentication/agent.rb
 - lib/net/ssh/authentication/certificate.rb
@@ -322,9 +297,6 @@ files:
 - lib/net/ssh/verifiers/always.rb
 - lib/net/ssh/verifiers/never.rb
 - lib/net/ssh/version.rb
-- net-ssh-public_cert.pem
-- net-ssh.gemspec
-- support/ssh_tunnel_bug.rb
 homepage: https://github.com/net-ssh/net-ssh
 licenses:
 - MIT

metadata.gz.sig

@@ -1 +1 @@
-�b�Qs�	Ţ��)֙wR��NC����UҀ@�VN��M��d��өTB��ZC "y_�]=!����0:s�v+!E�����x���y����ٻȰz[3'f��
+����K�#��إ�TJ�q�3v|�6e`�gI;f�s�"O)�R��/�?��

data/.dockerignore

@@ -1,9 +0,0 @@
-# Remove Git
-.git/
-.gitignore
-
-# Vagrant
-test/integration/.vagrant
-
-docker-compose.yml
-README.md

data/.github/FUNDING.yml

@@ -1 +0,0 @@
-github: [mfazekas]

data/.github/config/rubocop_linter_action.yml

@@ -1,4 +0,0 @@
-rubocop_fail_level: "convention"
-
-versions:
-  rubocop: "1.27.0"

data/.github/pull_request_template.md

@@ -1 +0,0 @@
-<!-- After opening the PR, add a changelog.d/<PR number>.<type>.txt fragment (none, change, security, breaking or breaking-security) instead of editing CHANGES.txt; see CONTRIBUTING.md#changelog. -->

data/.github/workflows/changelog.yml

@@ -1,18 +0,0 @@
-name: Changelog
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-jobs:
-  changelog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # HEAD is the PR merged into the base branch; HEAD^1 is the base it was merged into.
-          fetch-depth: 2
-      - uses: net-ssh/changelogd@v1

data/.github/workflows/ci-with-docker.yml

@@ -1,55 +0,0 @@
-name: Test
-on:
-  pull_request:
-  push: { branches: master }
-
-jobs:
-  test:
-    name: Run test suite with docker
-    runs-on: ubuntu-latest
-    env:
-      COMPOSE_FILE: docker-compose.yml
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Build docker images
-      run: docker compose build
-
-    - name: Run ruby 2.7
-      run: docker compose run ruby-2.7
-
-    - name: Run ruby 3.0
-      run: docker compose run ruby-3.0
-
-    - name: Run ruby 3.1
-      run: docker compose run ruby-3.1
-
-  test_openssl3:
-    name: Run test suite with docker and openssl 3.0
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Build docker images
-      run: docker build -t netssh_openssl3 -f Dockerfile.openssl3 .
-
-    - name: Run ruby 3.0 with openssl3
-      run: docker run --rm netssh_openssl3
-
-  test_zlib_ng:
-    name: Run test suite with docker and zlib-ng
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Build docker images
-      run: docker build -t netssh_zlib_ng -f Dockerfile.zlib_ng .
-
-    - name: Run ruby with zlib-ng
-      run: docker run --rm netssh_zlib_ng

data/.github/workflows/ci.yml

@@ -1,84 +0,0 @@
-name: CI
-on:
-  pull_request:
-  push: { branches: master }
-jobs:
-  test:
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        ruby-version: [2.7.8, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Ruby ${{ matrix.ruby-version }}
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby-version }}
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.8
-
-      - name: Cache bundler
-        uses: actions/cache@v4
-        id: bundler-cache
-        with:
-          path: vendor/bundle
-          key: ${{ runner.os }}-${{ matrix.ruby-version }}-gem-v3-${{ hashFiles('**/Gemfile') }}-${{ hashFiles('**/net-ssh.gemspec') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ matrix.ruby-version }}-gem-v3-
-
-      - name: Cache pip
-        uses: actions/cache@v4
-        id: pip-cache
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-v1
-          restore-keys: |
-            ${{ runner.os }}-pip-v1
-      - name: Bundle install
-        run: |
-          gem install bundler ${{ startsWith(matrix.ruby-version, '2.7.') && '-v 2.4.22' || '' }}
-          bundle config set path 'vendor/bundle'
-          bundle config set --local path 'vendor/bundle'
-          bundle install --jobs 4 --retry 3
-        env:
-          BUNDLE_PATH: vendor/bundle
-
-
-      - name: Add to etc/hosts
-        run: |
-          sudo echo "127.0.0.1  gateway.netssh" | sudo tee -a /etc/hosts
-      - name: Check sshd_config
-        run: sudo cat '/etc/ssh/sshd_config' || true
-      - name: Check sshd_config2
-        run: sudo cat /etc/ssh/sshd_config.d/*.conf || true
-      - name: Check sshd pid
-        run: sudo ps aux | grep sshd
-      - name: Ansible install
-        run: |
-          python -m pip install --upgrade pip
-          pip install ansible urllib3 pyOpenSSL ndg-httpsclient pyasn1
-          ansible-galaxy install rvm.ruby
-          pwd
-          uname -a
-          export
-          who am i
-          ansible-playbook ./test/integration/playbook.yml -i "localhost," --become -c local -e 'no_rvm=true' -e 'myuser=runner' -e 'mygroup=runner' -e 'homedir=/home/runner'
-      - name: Check sshd_config
-        run: sudo cat '/etc/ssh/sshd_config' || true
-      - name: Check sshd pid
-        run: sudo ps aux | grep sshd
-      - name: Check sshd_config2
-        run: sudo cat /etc/ssh/sshd_config.d/*.conf || true
-      - name: Run Tests
-        run: bundle exec rake test
-        env:
-          NET_SSH_RUN_INTEGRATION_TESTS: 1
-          CI: 1
-          RUBYOPT: '--enable=frozen-string-literal'
-      - name: Run test helper test
-        run: bundle exec rake test_test
-        env:
-          RUBYOPT: '--enable=frozen-string-literal'

data/.github/workflows/rubocop.yml

@@ -1,18 +0,0 @@
-name: Rubocop
-
-on:
-  pull_request:
-  push: { branches: master }
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up Ruby 3.1
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 3.1
-          bundler-cache: true
-      - name: Run RuboCop
-        run: bundle exec rubocop

data/.gitignore

@@ -1,15 +0,0 @@
-/Gemfile.lock
-/Gemfile.noed25519.lock
-doc
-rdoc
-ri
-pkg
-*.swp
-test/integration/.vagrant
-test/integration/playbook.retry
-
-lib/net/ssh/version.rb.old
-
-.byebug_history
-
-tryout

data/.rubocop.yml

@@ -1,26 +0,0 @@
-AllCops:
-  Exclude:
-    - 'tryout/**/*'
-    - "vendor/**/.*"
-    - "vendor/**/*"
-  NewCops: enable
-  TargetRubyVersion: 2.7
-
-inherit_from: .rubocop_todo.yml
-
-Style/DoubleNegation:
-  Exclude:
-    - 'lib/net/ssh/key_factory.rb'
-
-Layout/LineLength:
-  Max: 150
-  Exclude:
-    - 'test/**/*.rb'
-    - 'net-ssh.gemspec'
-
-Style/EmptyLiteral:
-  Enabled: false
-
-# CI runs the suite with RUBYOPT=--enable=frozen-string-literal instead of a magic comment in every file.
-Style/FrozenStringLiteralComment:
-  Enabled: false