step-node-agent 3.20.2 → 3.21.1

package/node_modules/npm/node_modules/sshpk/README.md

@@ -126,6 +126,9 @@ Parameters
   - `rfc4253`: raw OpenSSH wire format
   - `openssh`: new post-OpenSSH 6.5 internal format, produced by 
                `ssh-keygen -o`
+  - `dnssec`: `.key` file format output by `dnssec-keygen` etc
+  - `putty`: the PuTTY `.ppk` file format (supports truncated variant without
+             all the lines from `Private-Lines:` onwards)
 - `options` -- Optional Object, extra options, with keys:
   - `filename` -- Optional String, name for the key being parsed 
                   (eg. the filename that was opened). Used to generate
@@ -174,7 +177,7 @@ Parameters
 
 Same as `this.toBuffer(format).toString()`.
 
-### `Key#fingerprint([algorithm = 'sha256'])`
+### `Key#fingerprint([algorithm = 'sha256'[, hashType = 'ssh']])`
 
 Creates a new `Fingerprint` object representing this Key's fingerprint.
 
@@ -182,6 +185,9 @@ Parameters
 
 - `algorithm` -- String name of hash algorithm to use, valid options are `md5`,
                  `sha1`, `sha256`, `sha384`, `sha512`
+- `hashType` -- String name of fingerprint hash type to use, valid options are
+                `ssh` (the type of fingerprint used by OpenSSH, e.g. in
+                `ssh-keygen`), `spki` (used by HPKP, some OpenSSL applications)
 
 ### `Key#createVerify([hashAlgorithm])`
 
@@ -231,6 +237,7 @@ Parameters
                       `ssh-keygen -o`
   - `pkcs1`, `pkcs8`: variants of `pem`
   - `rfc4253`: raw OpenSSH wire format
+  - `dnssec`: `.private` format output by `dnssec-keygen` etc.
 - `options` -- Optional Object, extra options, with keys:
   - `filename` -- Optional String, name for the key being parsed
                   (eg. the filename that was opened). Used to generate
@@ -333,7 +340,7 @@ Parameters
 
 ## Fingerprints
 
-### `parseFingerprint(fingerprint[, algorithms])`
+### `parseFingerprint(fingerprint[, options])`
 
 Pre-parses a fingerprint, creating a `Fingerprint` object that can be used to
 quickly locate a key by using the `Fingerprint#matches` function.
@@ -341,9 +348,15 @@ quickly locate a key by using the `Fingerprint#matches` function.
 Parameters
 
 - `fingerprint` -- String, the fingerprint value, in any supported format
-- `algorithms` -- Optional list of strings, names of hash algorithms to limit
-                  support to. If `fingerprint` uses a hash algorithm not on
-                  this list, throws `InvalidAlgorithmError`.
+- `options` -- Optional Object, with properties:
+  - `algorithms` -- Array of strings, names of hash algorithms to limit
+                support to. If `fingerprint` uses a hash algorithm not on
+                this list, throws `InvalidAlgorithmError`.
+  - `hashType` -- String, the type of hash the fingerprint uses, either `ssh`
+                  or `spki` (normally auto-detected based on the format, but
+                  can be overridden)
+  - `type` -- String, the entity this fingerprint identifies, either `key` or
+              `certificate`
 
 ### `Fingerprint.isFingerprint(obj)`
 
@@ -364,14 +377,19 @@ Parameters
               `base64`. If this `Fingerprint` uses the `md5` algorithm, the
               default format is `hex`. Otherwise, the default is `base64`.
 
-### `Fingerprint#matches(key)`
+### `Fingerprint#matches(keyOrCertificate)`
 
-Verifies whether or not this `Fingerprint` matches a given `Key`. This function
-uses double-hashing to avoid leaking timing information. Returns a boolean.
+Verifies whether or not this `Fingerprint` matches a given `Key` or
+`Certificate`. This function uses double-hashing to avoid leaking timing
+information. Returns a boolean.
+
+Note that a `Key`-type Fingerprint will always return `false` if asked to match
+a `Certificate` and vice versa.
 
 Parameters
 
-- `key` -- a `Key` object, the key to match this fingerprint against
+- `keyOrCertificate` -- a `Key` object or `Certificate` object, the entity to
+                        match this fingerprint against
 
 ## Signatures
 
@@ -507,6 +525,24 @@ is valid for. The possible strings at the moment are:
              Authority)
  * `'crl'` -- key can be used to sign Certificate Revocation Lists (CRLs)
 
+### `Certificate#getExtension(nameOrOid)`
+
+Retrieves information about a certificate extension, if present, or returns
+`undefined` if not. The string argument `nameOrOid` should be either the OID
+(for X509 extensions) or the name (for OpenSSH extensions) of the extension
+to retrieve.
+
+The object returned will have the following properties:
+
+ * `format` -- String, set to either `'x509'` or `'openssh'`
+ * `name` or `oid` -- String, only one set based on value of `format`
+ * `data` -- Buffer, the raw data inside the extension
+
+### `Certificate#getExtensions()`
+
+Returns an Array of all present certificate extensions, in the same manner and
+format as `getExtension()`.
+
 ### `Certificate#isExpired([when])`
 
 Tests whether the Certificate is currently expired (i.e. the `validFrom` and
@@ -614,6 +650,44 @@ Parameters
 
 Returns an Identity instance.
 
+### `identityFromArray(arr)`
+
+Constructs an Identity from an array of DN components (see `Identity#toArray()`
+for the format).
+
+Parameters
+
+ - `arr` -- an Array of Objects, DN components with `name` and `value`
+
+Returns an Identity instance.
+
+
+Supported attributes in DNs:
+
+| Attribute name | OID |
+| -------------- | --- |
+| `cn` | `2.5.4.3` |
+| `o` | `2.5.4.10` |
+| `ou` | `2.5.4.11` |
+| `l` | `2.5.4.7` |
+| `s` | `2.5.4.8` |
+| `c` | `2.5.4.6` |
+| `sn` | `2.5.4.4` |
+| `postalCode` | `2.5.4.17` |
+| `serialNumber` | `2.5.4.5` |
+| `street` | `2.5.4.9` |
+| `x500UniqueIdentifier` | `2.5.4.45` |
+| `role` | `2.5.4.72` |
+| `telephoneNumber` | `2.5.4.20` |
+| `description` | `2.5.4.13` |
+| `dc` | `0.9.2342.19200300.100.1.25` |
+| `uid` | `0.9.2342.19200300.100.1.1` |
+| `mail` | `0.9.2342.19200300.100.1.3` |
+| `title` | `2.5.4.12` |
+| `gn` | `2.5.4.42` |
+| `initials` | `2.5.4.43` |
+| `pseudonym` | `2.5.4.65` |
+
 ### `Identity#toString()`
 
 Returns the identity as an LDAP-style DN string.
@@ -631,7 +705,39 @@ Set when `type` is `'host'`, `'user'`, or `'email'`, respectively. Strings.
 
 ### `Identity#cn`
 
-The value of the first `CN=` in the DN, if any.
+The value of the first `CN=` in the DN, if any. It's probably better to use
+the `#get()` method instead of this property.
+
+### `Identity#get(name[, asArray])`
+
+Returns the value of a named attribute in the Identity DN. If there is no
+attribute of the given name, returns `undefined`. If multiple components
+of the DN contain an attribute of this name, an exception is thrown unless
+the `asArray` argument is given as `true` -- then they will be returned as
+an Array in the same order they appear in the DN.
+
+Parameters
+
+ - `name` -- a String
+ - `asArray` -- an optional Boolean
+
+### `Identity#toArray()`
+
+Returns the Identity as an Array of DN component objects. This looks like:
+
+```js
+[ {
+  "name": "cn",
+  "value": "Joe Bloggs"
+},
+{
+  "name": "o",
+  "value": "Organisation Ltd"
+} ]
+```
+
+Each object has a `name` and a `value` property. The returned objects may be
+safely modified.
 
 Errors
 ------

package/node_modules/npm/node_modules/sshpk/bin/sshpk-conv

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // -*- mode: js -*-
 // vim: set filetype=javascript :
-// Copyright 2015 Joyent, Inc.	All rights reserved.
+// Copyright 2018 Joyent, Inc.	All rights reserved.
 
 var dashdash = require('dashdash');
 var sshpk = require('../lib/index');
@@ -47,6 +47,21 @@ var options = [
 		type: 'bool',
 		help: 'Print key metadata instead of converting'
 	},
+	{
+		names: ['fingerprint', 'F'],
+		type: 'bool',
+		help: 'Output key fingerprint'
+	},
+	{
+		names: ['hash', 'H'],
+		type: 'string',
+		help: 'Hash function to use for key fingeprint with -F'
+	},
+	{
+		names: ['spki', 's'],
+		type: 'bool',
+		help: 'With -F, generates an SPKI fingerprint instead of SSH'
+	},
 	{
 		names: ['comment', 'c'],
 		type: 'string',
@@ -75,13 +90,18 @@ if (require.main === module) {
 		var help = parser.help({}).trimRight();
 		console.error('sshpk-conv: converts between SSH key formats\n');
 		console.error(help);
-		console.error('\navailable formats:');
+		console.error('\navailable key formats:');
 		console.error('	 - pem, pkcs1	  eg id_rsa');
 		console.error('	 - ssh		  eg id_rsa.pub');
 		console.error('	 - pkcs8	  format you want for openssl');
 		console.error('	 - openssh	  like output of ssh-keygen -o');
 		console.error('	 - rfc4253	  raw OpenSSH wire format');
 		console.error('	 - dnssec	  dnssec-keygen format');
+		console.error('  - putty          PuTTY ppk format');
+		console.error('\navailable fingerprint formats:');
+		console.error('  - hex            colon-separated hex for SSH');
+		console.error('                   straight hex for SPKI');
+		console.error('  - base64         SHA256:* format from OpenSSH');
 		process.exit(1);
 	}
 
@@ -111,9 +131,7 @@ if (require.main === module) {
 			inFile = fs.createReadStream(inFilePath);
 		}
 	} catch (e) {
-		console.error('sshpk-conv: error opening input file' +
-		     ': ' + e.name + ': ' + e.message);
-		process.exit(1);
+		ifError(e, 'error opening input file');
 	}
 
 	var outFile = process.stdout;
@@ -124,9 +142,7 @@ if (require.main === module) {
 			outFile = fs.createWriteStream(opts.out);
 		}
 	} catch (e) {
-		console.error('sshpk-conv: error opening output file' +
-		    ': ' + e.name + ': ' + e.message);
-		process.exit(1);
+		ifError(e, 'error opening output file');
 	}
 
 	var bufs = [];
@@ -150,20 +166,14 @@ if (require.main === module) {
 		} catch (e) {
 			if (e.name === 'KeyEncryptedError') {
 				getPassword(function (err, pw) {
-					if (err) {
-						console.log('sshpk-conv: ' +
-						    err.name + ': ' +
-						    err.message);
-						process.exit(1);
-					}
+					if (err)
+						ifError(err);
 					parseOpts.passphrase = pw;
 					processKey();
 				});
 				return;
 			}
-			console.error('sshpk-conv: ' +
-			    e.name + ': ' + e.message);
-			process.exit(1);
+			ifError(e);
 		}
 
 		if (opts.derive)
@@ -172,18 +182,7 @@ if (require.main === module) {
 		if (opts.comment)
 			key.comment = opts.comment;
 
-		if (!opts.identify) {
-			fmt = undefined;
-			if (opts.outformat)
-				fmt = opts.outformat;
-			outFile.write(key.toBuffer(fmt));
-			if (fmt === 'ssh' ||
-			    (!opts.private && fmt === undefined))
-				outFile.write('\n');
-			outFile.once('drain', function () {
-				process.exit(0);
-			});
-		} else {
+		if (opts.identify) {
 			var kind = 'public';
 			if (sshpk.PrivateKey.isPrivateKey(key))
 				kind = 'private';
@@ -193,10 +192,52 @@ if (require.main === module) {
 				console.log('ECDSA curve: %s', key.curve);
 			if (key.comment)
 				console.log('Comment: %s', key.comment);
-			console.log('Fingerprint:');
-			console.log('  ' + key.fingerprint().toString());
-			console.log('  ' + key.fingerprint('md5').toString());
+			console.log('SHA256 fingerprint: ' +
+			    key.fingerprint('sha256').toString());
+			console.log('MD5 fingerprint: ' +
+			    key.fingerprint('md5').toString());
+			console.log('SPKI-SHA256 fingerprint: ' +
+			    key.fingerprint('sha256', 'spki').toString());
 			process.exit(0);
+			return;
+		}
+
+		if (opts.fingerprint) {
+			var hash = opts.hash;
+			var type = opts.spki ? 'spki' : 'ssh';
+			var format = opts.outformat;
+			var fp = key.fingerprint(hash, type).toString(format);
+			outFile.write(fp);
+			outFile.write('\n');
+			outFile.once('drain', function () {
+				process.exit(0);
+			});
+			return;
 		}
+
+		fmt = undefined;
+		if (opts.outformat)
+			fmt = opts.outformat;
+		outFile.write(key.toBuffer(fmt));
+		if (fmt === 'ssh' ||
+		    (!opts.private && fmt === undefined))
+			outFile.write('\n');
+		outFile.once('drain', function () {
+			process.exit(0);
+		});
 	});
 }
+
+function ifError(e, txt) {
+	if (txt)
+		txt = txt + ': ';
+	else
+		txt = '';
+	console.error('sshpk-conv: ' + txt + e.name + ': ' + e.message);
+	if (process.env['DEBUG'] || process.env['V']) {
+		console.error(e.stack);
+		if (e.innerErr)
+			console.error(e.innerErr.stack);
+	}
+	process.exit(1);
+}

package/node_modules/npm/node_modules/sshpk/lib/certificate.js

@@ -120,6 +120,37 @@ Certificate.prototype.isSignedBy = function (issuerCert) {
 	return (this.isSignedByKey(issuerCert.subjectKey));
 };
 
+Certificate.prototype.getExtension = function (keyOrOid) {
+	assert.string(keyOrOid, 'keyOrOid');
+	var ext = this.getExtensions().filter(function (maybeExt) {
+		if (maybeExt.format === 'x509')
+			return (maybeExt.oid === keyOrOid);
+		if (maybeExt.format === 'openssh')
+			return (maybeExt.name === keyOrOid);
+		return (false);
+	})[0];
+	return (ext);
+};
+
+Certificate.prototype.getExtensions = function () {
+	var exts = [];
+	var x509 = this.signatures.x509;
+	if (x509 && x509.extras && x509.extras.exts) {
+		x509.extras.exts.forEach(function (ext) {
+			ext.format = 'x509';
+			exts.push(ext);
+		});
+	}
+	var openssh = this.signatures.openssh;
+	if (openssh && openssh.exts) {
+		openssh.exts.forEach(function (ext) {
+			ext.format = 'openssh';
+			exts.push(ext);
+		});
+	}
+	return (exts);
+};
+
 Certificate.prototype.isSignedByKey = function (issuerKey) {
 	utils.assertCompatible(issuerKey, Key, [1, 2], 'issuerKey');
 
@@ -370,8 +401,9 @@ Certificate.isCertificate = function (obj, ver) {
 /*
  * API versions for Certificate:
  * [1,0] -- initial ver
+ * [1,1] -- openssh format now unpacks extensions
  */
-Certificate.prototype._sshpkApiVersion = [1, 0];
+Certificate.prototype._sshpkApiVersion = [1, 1];
 
 Certificate._oldVersionDetect = function (obj) {
 	return ([1, 0]);

package/node_modules/npm/node_modules/sshpk/lib/dhe.js

@@ -11,14 +11,16 @@ var crypto = require('crypto');
 var Buffer = require('safer-buffer').Buffer;
 var algs = require('./algs');
 var utils = require('./utils');
-var nacl;
+var nacl = require('tweetnacl');
 
 var Key = require('./key');
 var PrivateKey = require('./private-key');
 
 var CRYPTO_HAVE_ECDH = (crypto.createECDH !== undefined);
 
-var ecdh, ec, jsbn;
+var ecdh = require('ecc-jsbn');
+var ec = require('ecc-jsbn/lib/ec');
+var jsbn = require('jsbn').BigInteger;
 
 function DiffieHellman(key) {
 	utils.assertCompatible(key, Key, [1, 4], 'key');
@@ -43,13 +45,6 @@ function DiffieHellman(key) {
 
 	} else if (key.type === 'ecdsa') {
 		if (!CRYPTO_HAVE_ECDH) {
-			if (ecdh === undefined)
-				ecdh = require('ecc-jsbn');
-			if (ec === undefined)
-				ec = require('ecc-jsbn/lib/ec');
-			if (jsbn === undefined)
-				jsbn = require('jsbn').BigInteger;
-
 			this._ecParams = new X9ECParameters(this._curve);
 
 			if (this._isPriv) {
@@ -76,9 +71,6 @@ function DiffieHellman(key) {
 		this._dh.setPublicKey(key.part.Q.data);
 
 	} else if (key.type === 'curve25519') {
-		if (nacl === undefined)
-			nacl = require('tweetnacl');
-
 		if (this._isPriv) {
 			utils.assertCompatible(key, PrivateKey, [1, 5], 'key');
 			this._priv = key.part.k.data;
@@ -321,9 +313,6 @@ ECPrivate.prototype.deriveSharedSecret = function (pubKey) {
 };
 
 function generateED25519() {
-	if (nacl === undefined)
-		nacl = require('tweetnacl');
-
 	var pair = nacl.sign.keyPair();
 	var priv = Buffer.from(pair.secretKey);
 	var pub = Buffer.from(pair.publicKey);
@@ -374,12 +363,6 @@ function generateECDSA(curve) {
 		});
 		return (key);
 	} else {
-		if (ecdh === undefined)
-			ecdh = require('ecc-jsbn');
-		if (ec === undefined)
-			ec = require('ecc-jsbn/lib/ec');
-		if (jsbn === undefined)
-			jsbn = require('jsbn').BigInteger;
 
 		var ecParams = new X9ECParameters(curve);
 

package/node_modules/npm/node_modules/sshpk/lib/ed-compat.js

@@ -5,7 +5,7 @@ module.exports = {
 	Signer: Signer
 };
 
-var nacl;
+var nacl = require('tweetnacl');
 var stream = require('stream');
 var util = require('util');
 var assert = require('assert-plus');
@@ -13,9 +13,6 @@ var Buffer = require('safer-buffer').Buffer;
 var Signature = require('./signature');
 
 function Verifier(key, hashAlgo) {
-	if (nacl === undefined)
-		nacl = require('tweetnacl');
-
 	if (hashAlgo.toLowerCase() !== 'sha512')
 		throw (new Error('ED25519 only supports the use of ' +
 		    'SHA-512 hashes'));
@@ -61,9 +58,6 @@ Verifier.prototype.verify = function (signature, fmt) {
 };
 
 function Signer(key, hashAlgo) {
-	if (nacl === undefined)
-		nacl = require('tweetnacl');
-
 	if (hashAlgo.toLowerCase() !== 'sha512')
 		throw (new Error('ED25519 only supports the use of ' +
 		    'SHA-512 hashes'));

package/node_modules/npm/node_modules/sshpk/lib/fingerprint.js

@@ -1,4 +1,4 @@
-// Copyright 2015 Joyent, Inc.
+// Copyright 2018 Joyent, Inc.
 
 module.exports = Fingerprint;
 
@@ -8,6 +8,7 @@ var algs = require('./algs');
 var crypto = require('crypto');
 var errs = require('./errors');
 var Key = require('./key');
+var PrivateKey = require('./private-key');
 var Certificate = require('./certificate');
 var utils = require('./utils');
 
@@ -26,11 +27,12 @@ function Fingerprint(opts) {
 
 	this.hash = opts.hash;
 	this.type = opts.type;
+	this.hashType = opts.hashType;
 }
 
 Fingerprint.prototype.toString = function (format) {
 	if (format === undefined) {
-		if (this.algorithm === 'md5')
+		if (this.algorithm === 'md5' || this.hashType === 'spki')
 			format = 'hex';
 		else
 			format = 'base64';
@@ -39,8 +41,12 @@ Fingerprint.prototype.toString = function (format) {
 
 	switch (format) {
 	case 'hex':
+		if (this.hashType === 'spki')
+			return (this.hash.toString('hex'));
 		return (addColons(this.hash.toString('hex')));
 	case 'base64':
+		if (this.hashType === 'spki')
+			return (this.hash.toString('base64'));
 		return (sshBase64Format(this.algorithm,
 		    this.hash.toString('base64')));
 	default:
@@ -50,14 +56,20 @@ Fingerprint.prototype.toString = function (format) {
 
 Fingerprint.prototype.matches = function (other) {
 	assert.object(other, 'key or certificate');
-	if (this.type === 'key') {
+	if (this.type === 'key' && this.hashType !== 'ssh') {
+		utils.assertCompatible(other, Key, [1, 7], 'key with spki');
+		if (PrivateKey.isPrivateKey(other)) {
+			utils.assertCompatible(other, PrivateKey, [1, 6],
+			    'privatekey with spki support');
+		}
+	} else if (this.type === 'key') {
 		utils.assertCompatible(other, Key, [1, 0], 'key');
 	} else {
 		utils.assertCompatible(other, Certificate, [1, 0],
 		    'certificate');
 	}
 
-	var theirHash = other.hash(this.algorithm);
+	var theirHash = other.hash(this.algorithm, this.hashType);
 	var theirHash2 = crypto.createHash(this.algorithm).
 	    update(theirHash).digest('base64');
 
@@ -68,6 +80,11 @@ Fingerprint.prototype.matches = function (other) {
 	return (this.hash2 === theirHash2);
 };
 
+/*JSSTYLED*/
+var base64RE = /^[A-Za-z0-9+\/=]+$/;
+/*JSSTYLED*/
+var hexRE = /^[a-fA-F0-9]+$/;
+
 Fingerprint.parse = function (fp, options) {
 	assert.string(fp, 'fingerprint');
 
@@ -81,13 +98,18 @@ Fingerprint.parse = function (fp, options) {
 		options = {};
 	if (options.enAlgs !== undefined)
 		enAlgs = options.enAlgs;
+	if (options.algorithms !== undefined)
+		enAlgs = options.algorithms;
 	assert.optionalArrayOfString(enAlgs, 'algorithms');
 
+	var hashType = 'ssh';
+	if (options.hashType !== undefined)
+		hashType = options.hashType;
+	assert.string(hashType, 'options.hashType');
+
 	var parts = fp.split(':');
 	if (parts.length == 2) {
 		alg = parts[0].toLowerCase();
-		/*JSSTYLED*/
-		var base64RE = /^[A-Za-z0-9+\/=]+$/;
 		if (!base64RE.test(parts[1]))
 			throw (new FingerprintFormatError(fp));
 		try {
@@ -99,16 +121,50 @@ Fingerprint.parse = function (fp, options) {
 		alg = 'md5';
 		if (parts[0].toLowerCase() === 'md5')
 			parts = parts.slice(1);
+		parts = parts.map(function (p) {
+			while (p.length < 2)
+				p = '0' + p;
+			if (p.length > 2)
+				throw (new FingerprintFormatError(fp));
+			return (p);
+		});
 		parts = parts.join('');
-		/*JSSTYLED*/
-		var md5RE = /^[a-fA-F0-9]+$/;
-		if (!md5RE.test(parts))
+		if (!hexRE.test(parts) || parts.length % 2 !== 0)
 			throw (new FingerprintFormatError(fp));
 		try {
 			hash = Buffer.from(parts, 'hex');
 		} catch (e) {
 			throw (new FingerprintFormatError(fp));
 		}
+	} else {
+		if (hexRE.test(fp)) {
+			hash = Buffer.from(fp, 'hex');
+		} else if (base64RE.test(fp)) {
+			hash = Buffer.from(fp, 'base64');
+		} else {
+			throw (new FingerprintFormatError(fp));
+		}
+
+		switch (hash.length) {
+		case 32:
+			alg = 'sha256';
+			break;
+		case 16:
+			alg = 'md5';
+			break;
+		case 20:
+			alg = 'sha1';
+			break;
+		case 64:
+			alg = 'sha512';
+			break;
+		default:
+			throw (new FingerprintFormatError(fp));
+		}
+
+		/* Plain hex/base64: guess it's probably SPKI unless told. */
+		if (options.hashType === undefined)
+			hashType = 'spki';
 	}
 
 	if (alg === undefined)
@@ -126,7 +182,8 @@ Fingerprint.parse = function (fp, options) {
 	return (new Fingerprint({
 		algorithm: alg,
 		hash: hash,
-		type: options.type || 'key'
+		type: options.type || 'key',
+		hashType: hashType
 	}));
 };
 
@@ -152,8 +209,9 @@ Fingerprint.isFingerprint = function (obj, ver) {
  * API versions for Fingerprint:
  * [1,0] -- initial ver
  * [1,1] -- first tagged ver
+ * [1,2] -- hashType and spki support
  */
-Fingerprint.prototype._sshpkApiVersion = [1, 1];
+Fingerprint.prototype._sshpkApiVersion = [1, 2];
 
 Fingerprint._oldVersionDetect = function (obj) {
 	assert.func(obj.toString);