dstack 0.0.9__py3-none-any.whl → 0.20.7__py3-none-any.whl

dstack/_internal/core/services/profiles.py

@@ -0,0 +1,46 @@
+from typing import Optional, Tuple
+
+from dstack._internal.core.models.profiles import (
+    DEFAULT_RETRY_DURATION,
+    Profile,
+    RetryEvent,
+    TerminationPolicy,
+)
+from dstack._internal.core.models.runs import Retry
+
+
+def get_retry(profile: Profile) -> Optional[Retry]:
+    profile_retry = profile.retry
+    if profile_retry is None:
+        return None
+    if isinstance(profile_retry, bool):
+        if profile_retry:
+            return Retry(
+                on_events=[RetryEvent.NO_CAPACITY, RetryEvent.INTERRUPTION, RetryEvent.ERROR],
+                duration=DEFAULT_RETRY_DURATION,
+            )
+        return None
+    profile_retry = profile_retry.copy()
+    if profile_retry.on_events is None:
+        profile_retry.on_events = [
+            RetryEvent.NO_CAPACITY,
+            RetryEvent.INTERRUPTION,
+            RetryEvent.ERROR,
+        ]
+    if profile_retry.duration is None:
+        profile_retry.duration = DEFAULT_RETRY_DURATION
+    return Retry.parse_obj(profile_retry)
+
+
+def get_termination(
+    profile: Profile, default_termination_idle_time: int
+) -> Tuple[TerminationPolicy, int]:
+    termination_policy = TerminationPolicy.DESTROY_AFTER_IDLE
+    termination_idle_time = default_termination_idle_time
+    if profile.idle_duration is not None and profile.idle_duration < 0:
+        termination_policy = TerminationPolicy.DONT_DESTROY
+    elif profile.idle_duration is not None:
+        termination_idle_time = profile.idle_duration
+    if termination_policy == TerminationPolicy.DONT_DESTROY:
+        termination_idle_time = -1
+    return termination_policy, termination_idle_time

dstack/_internal/core/services/repos.py

@@ -0,0 +1,236 @@
+import os
+from contextlib import suppress
+from pathlib import Path
+from tempfile import NamedTemporaryFile
+from typing import Optional
+
+import git.cmd
+import yaml
+from git.exc import GitCommandError
+
+from dstack._internal.core.errors import DstackError
+from dstack._internal.core.models.repos import RemoteRepoCreds
+from dstack._internal.core.models.repos.remote import GitRepoURL
+from dstack._internal.utils.logging import get_logger
+from dstack._internal.utils.path import PathLike
+from dstack._internal.utils.ssh import get_host_config, make_git_env, try_ssh_key_passphrase
+
+logger = get_logger(__name__)
+
+gh_config_path = os.path.expanduser("~/.config/gh/hosts.yml")
+default_ssh_key = os.path.expanduser("~/.ssh/id_rsa")
+
+
+class InvalidRepoCredentialsError(DstackError):
+    pass
+
+
+def get_repo_creds_and_default_branch(
+    repo_url: str,
+    identity_file: Optional[PathLike] = None,
+    private_key: Optional[str] = None,
+    oauth_token: Optional[str] = None,
+) -> tuple[RemoteRepoCreds, Optional[str]]:
+    url = GitRepoURL.parse(repo_url, get_ssh_config=get_host_config)
+
+    # no auth
+    with suppress(InvalidRepoCredentialsError):
+        creds, default_branch = _get_repo_creds_and_default_branch_https(url)
+        logger.debug(
+            "Git repo %s is public. Using no auth. Default branch: %s", repo_url, default_branch
+        )
+        return creds, default_branch
+
+    # ssh key provided by the user or pulled from the server
+    if identity_file is not None or private_key is not None:
+        if identity_file is not None:
+            private_key = _read_private_key(identity_file)
+            creds, default_branch = _get_repo_creds_and_default_branch_ssh(
+                url, identity_file, private_key
+            )
+            logger.debug(
+                "Git repo %s is private. Using identity file: %s. Default branch: %s",
+                repo_url,
+                identity_file,
+                default_branch,
+            )
+            return creds, default_branch
+        elif private_key is not None:
+            with NamedTemporaryFile("w+", 0o600) as f:
+                f.write(private_key)
+                f.flush()
+                creds, default_branch = _get_repo_creds_and_default_branch_ssh(
+                    url, f.name, private_key
+                )
+                masked_key = "***" + private_key[-10:] if len(private_key) > 10 else "***MASKED***"
+                logger.debug(
+                    "Git repo %s is private. Using private key: %s. Default branch: %s",
+                    repo_url,
+                    masked_key,
+                    default_branch,
+                )
+                return creds, default_branch
+        else:
+            assert False, "should not reach here"
+
+    # oauth token provided by the user or pulled from the server
+    if oauth_token is not None:
+        creds, default_branch = _get_repo_creds_and_default_branch_https(url, oauth_token)
+        masked_token = (
+            len(oauth_token[:-4]) * "*" + oauth_token[-4:]
+            if len(oauth_token) > 4
+            else "***MASKED***"
+        )
+        logger.debug(
+            "Git repo %s is private. Using provided OAuth token: %s. Default branch: %s",
+            repo_url,
+            masked_token,
+            default_branch,
+        )
+        return creds, default_branch
+
+    # key from ssh config
+    identities = get_host_config(url.original_host).get("identityfile")
+    if identities:
+        _identity_file = identities[0]
+        with suppress(InvalidRepoCredentialsError):
+            _private_key = _read_private_key(_identity_file)
+            creds, default_branch = _get_repo_creds_and_default_branch_ssh(
+                url, _identity_file, _private_key
+            )
+            logger.debug(
+                "Git repo %s is private. Using SSH config identity file: %s. Default branch: %s",
+                repo_url,
+                _identity_file,
+                default_branch,
+            )
+            return creds, default_branch
+
+    # token from gh config
+    if os.path.exists(gh_config_path):
+        with open(gh_config_path, "r") as f:
+            gh_hosts = yaml.load(f, Loader=yaml.FullLoader)
+        _oauth_token = gh_hosts.get(url.host, {}).get("oauth_token")
+        if _oauth_token is not None:
+            with suppress(InvalidRepoCredentialsError):
+                creds, default_branch = _get_repo_creds_and_default_branch_https(url, _oauth_token)
+                masked_token = (
+                    len(_oauth_token[:-4]) * "*" + _oauth_token[-4:]
+                    if len(_oauth_token) > 4
+                    else "***MASKED***"
+                )
+                logger.debug(
+                    "Git repo %s is private. Using GitHub config token: %s from %s. Default branch: %s",
+                    repo_url,
+                    masked_token,
+                    gh_config_path,
+                    default_branch,
+                )
+                return creds, default_branch
+
+    # default user key
+    if os.path.exists(default_ssh_key):
+        with suppress(InvalidRepoCredentialsError):
+            _private_key = _read_private_key(default_ssh_key)
+            creds, default_branch = _get_repo_creds_and_default_branch_ssh(
+                url, default_ssh_key, _private_key
+            )
+            logger.debug(
+                "Git repo %s is private. Using default identity file: %s. Default branch: %s",
+                repo_url,
+                default_ssh_key,
+                default_branch,
+            )
+            return creds, default_branch
+
+    raise InvalidRepoCredentialsError(
+        "No valid default Git credentials found. Pass valid `--token` or `--git-identity`."
+    )
+
+
+def _get_repo_creds_and_default_branch_ssh(
+    url: GitRepoURL, identity_file: PathLike, private_key: str
+) -> tuple[RemoteRepoCreds, Optional[str]]:
+    _url = url.as_ssh()
+    env = _make_git_env_for_creds_check(identity_file=identity_file)
+    try:
+        default_branch = _get_repo_default_branch(_url, env)
+    except GitCommandError as e:
+        message = f"Cannot access `{_url}` using the `{identity_file}` private SSH key"
+        raise InvalidRepoCredentialsError(message) from e
+    creds = RemoteRepoCreds(
+        clone_url=_url,
+        private_key=private_key,
+        oauth_token=None,
+    )
+    return creds, default_branch
+
+
+def _get_repo_creds_and_default_branch_https(
+    url: GitRepoURL, oauth_token: Optional[str] = None
+) -> tuple[RemoteRepoCreds, Optional[str]]:
+    _url = url.as_https()
+    env = _make_git_env_for_creds_check()
+    try:
+        default_branch = _get_repo_default_branch(url.as_https(oauth_token), env)
+    except GitCommandError as e:
+        message = f"Cannot access `{_url}`"
+        if oauth_token is not None:
+            masked_token = len(oauth_token[:-4]) * "*" + oauth_token[-4:]
+            message = f"{message} using the `{masked_token}` token"
+        raise InvalidRepoCredentialsError(message) from e
+    creds = RemoteRepoCreds(
+        clone_url=_url,
+        private_key=None,
+        oauth_token=oauth_token,
+    )
+    return creds, default_branch
+
+
+def _make_git_env_for_creds_check(identity_file: Optional[PathLike] = None) -> dict[str, str]:
+    # Our goal is to check if _provided_ creds (if any) are correct, so we need to be sure that
+    # only the provided creds are used, without falling back to any additional mechanisms.
+    # To do this, we:
+    # 1. Disable all configs to ignore any stored creds
+    # 2. Disable askpass to avoid asking for creds interactively or fetching stored creds from
+    # a non-interactive askpass helper (for example, VS Code sets GIT_ASKPASS to its own helper,
+    # which silently provides creds to Git).
+    return make_git_env(disable_config=True, disable_askpass=True, identity_file=identity_file)
+
+
+def _get_repo_default_branch(url: str, env: dict[str, str]) -> Optional[str]:
+    # Git shipped by Apple with XCode is patched to support an additional config scope
+    # above "system" called "xcode". There is no option in `git config list` to show this config,
+    # but you can list the merged config (`git config list` without options) and then exclude
+    # all settings listed in `git config list --{system,global,local,worktree}`.
+    # As of time of writing, there are only two settings in the "xcode" config, one of which breaks
+    # our "is repo public?" check, namely "credential.helper=osxkeychain".
+    # As there is no way to disable "xcode" config (no env variable, no CLI option, etc.),
+    # the only way to disable credential helper is to override this specific setting with an empty
+    # string via command line argument: `git -c credential.helper= COMMAND [ARGS ...]`.
+    # See: https://github.com/git/git/commit/3d4355712b9fe77a96ad4ad877d92dc7ff6e0874
+    # See: https://gist.github.com/ChrisTollefson/ab9c0a5d1dd4dd615217345c6936a307
+    _git = git.cmd.Git()(c="credential.helper=")
+    # output example: "ref: refs/heads/dev\tHEAD\n545344f77c0df78367085952a97fc3a058eb4c65\tHEAD"
+    output: str = _git.ls_remote("--symref", url, "HEAD", env=env)
+    for line in output.splitlines():
+        # line format: `<oid> TAB <ref> LF`
+        oid, _, ref = line.partition("\t")
+        if oid.startswith("ref:") and ref == "HEAD":
+            return oid.rsplit("/", maxsplit=1)[-1]
+    return None
+
+
+def _read_private_key(identity_file: PathLike) -> str:
+    identity_file = Path(identity_file).expanduser().resolve()
+    if not Path(identity_file).exists():
+        raise InvalidRepoCredentialsError(f"The `{identity_file}` private SSH key doesn't exist")
+    if not os.access(identity_file, os.R_OK):
+        raise InvalidRepoCredentialsError(f"Cannot access the `{identity_file}` private SSH key")
+    if not try_ssh_key_passphrase(identity_file):
+        raise InvalidRepoCredentialsError(
+            f"Cannot use the `{identity_file}` private SSH key. "
+            "Ensure that it is valid and passphrase-free"
+        )
+    with open(identity_file, "r") as file:
+        return file.read()

dstack/_internal/core/services/ssh/__init__.py

@@ -0,0 +1,27 @@
+from dstack._internal.core.errors import (
+    SSHConnectionRefusedError,
+    SSHError,
+    SSHKeyError,
+    SSHPortInUseError,
+    SSHTimeoutError,
+)
+
+
+def get_ssh_error(stderr: bytes) -> SSHError:
+    if b": Permission denied (publickey)" in stderr:
+        return SSHKeyError(stderr)
+
+    for pattern, cls in [
+        (b": Operation timed out", SSHTimeoutError),
+        (b": Connection refused", SSHConnectionRefusedError),
+        (b": Address already in use", SSHPortInUseError),
+        (b" port forwarding failed", SSHPortInUseError),
+    ]:
+        if pattern in stderr:
+            return cls(
+                b"\n".join(line for line in stderr.split(b"\n") if pattern in line).decode()
+            )
+
+    # TODO: kex_exchange_identification: read: Connection reset by peer
+    # TODO: Connection timed out during banner exchange
+    return SSHError(stderr.decode())

dstack/_internal/core/services/ssh/attach.py

@@ -0,0 +1,241 @@
+import atexit
+import re
+import time
+from pathlib import Path
+from typing import Optional, Union
+
+import psutil
+
+from dstack._internal.core.errors import SSHError
+from dstack._internal.core.models.instances import SSHConnectionParams
+from dstack._internal.core.services.configs import ConfigManager
+from dstack._internal.core.services.ssh.client import get_ssh_client_info
+from dstack._internal.core.services.ssh.ports import PortsLock
+from dstack._internal.core.services.ssh.tunnel import SSHTunnel, ports_to_forwarded_sockets
+from dstack._internal.utils.logging import get_logger
+from dstack._internal.utils.path import FilePath, PathLike
+from dstack._internal.utils.ssh import (
+    default_ssh_config_path,
+    get_host_config,
+    include_ssh_config,
+    normalize_path,
+    update_ssh_config,
+)
+
+logger = get_logger(__name__)
+
+# ssh -L option format: [bind_address:]port:host:hostport
+_SSH_TUNNEL_REGEX = re.compile(r"(?:[\w.-]+:)?(?P<local_port>\d+):localhost:(?P<remote_port>\d+)")
+
+
+class SSHAttach:
+    @classmethod
+    def get_control_sock_path(cls, run_name: str) -> Path:
+        return ConfigManager().dstack_ssh_dir / f"%r@{run_name}.control.sock"
+
+    @classmethod
+    def reuse_ports_lock(cls, run_name: str) -> Optional[PortsLock]:
+        ssh_client_info = get_ssh_client_info()
+        if not ssh_client_info.supports_control_socket:
+            raise SSHError("Unsupported SSH client")
+        ssh_exe = str(ssh_client_info.path)
+        control_sock_path = normalize_path(cls.get_control_sock_path(run_name))
+        for process in psutil.process_iter(["cmdline"]):
+            cmdline = process.info["cmdline"]
+            if not (cmdline and cmdline[0] == ssh_exe and control_sock_path in cmdline):
+                continue
+            port_mapping: dict[int, int] = {}
+            cmdline_iter = iter(cmdline)
+            for arg in cmdline_iter:
+                if arg != "-L" or not (next_arg := next(cmdline_iter, None)):
+                    continue
+                if match := _SSH_TUNNEL_REGEX.fullmatch(next_arg):
+                    local_port, remote_port = match.group("local_port", "remote_port")
+                    port_mapping[int(remote_port)] = int(local_port)
+            return PortsLock(port_mapping)
+        return None
+
+    def __init__(
+        self,
+        hostname: str,
+        ssh_port: int,
+        container_ssh_port: int,
+        user: str,
+        container_user: str,
+        id_rsa_path: PathLike,
+        ports_lock: PortsLock,
+        run_name: str,
+        dockerized: bool,
+        ssh_proxy: Optional[SSHConnectionParams] = None,
+        service_port: Optional[int] = None,
+        local_backend: bool = False,
+        bind_address: Optional[str] = None,
+    ):
+        self._attached = False
+        self._ports_lock = ports_lock
+        self.ports = ports_lock.dict()
+        self.run_name = run_name
+        self.ssh_config_path = ConfigManager().dstack_ssh_config_path
+        control_sock_path = self.get_control_sock_path(run_name)
+        # Cast all path-like values used in configs to FilePath instances for automatic
+        # path normalization in :func:`update_ssh_config`.
+        self.control_sock_path = FilePath(control_sock_path)
+        self.identity_file = FilePath(id_rsa_path)
+        self.tunnel = SSHTunnel(
+            destination=f"root@{run_name}",
+            identity=self.identity_file,
+            forwarded_sockets=ports_to_forwarded_sockets(
+                ports=self.ports,
+                bind_local=bind_address or "localhost",
+            ),
+            control_sock_path=control_sock_path,
+            ssh_config_path=self.ssh_config_path,
+            options={
+                "ExitOnForwardFailure": "yes",
+            },
+        )
+        self.ssh_proxy = ssh_proxy
+        self.service_port = service_port
+
+        hosts: dict[str, dict[str, Union[str, int, FilePath]]] = {}
+        self.hosts = hosts
+
+        if local_backend:
+            hosts[run_name] = {
+                "HostName": hostname,
+                "Port": container_ssh_port,
+                "User": container_user,
+                "IdentityFile": self.identity_file,
+                "IdentitiesOnly": "yes",
+                "StrictHostKeyChecking": "no",
+                "UserKnownHostsFile": "/dev/null",
+            }
+        elif dockerized:
+            if ssh_proxy is not None:
+                # SSH instance with jump host
+                # dstack has no IdentityFile for jump host, it must be either preconfigured
+                # in the ~/.ssh/config or loaded into ssh-agent
+                hosts[f"{run_name}-jump-host"] = {
+                    "HostName": ssh_proxy.hostname,
+                    "Port": ssh_proxy.port,
+                    "User": ssh_proxy.username,
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                }
+                jump_host_config = get_host_config(ssh_proxy.hostname, default_ssh_config_path)
+                jump_host_identity_files = jump_host_config.get("identityfile")
+                if jump_host_identity_files:
+                    hosts[f"{run_name}-jump-host"].update(
+                        {
+                            "IdentityFile": jump_host_identity_files[0],
+                            "IdentitiesOnly": "yes",
+                        }
+                    )
+                hosts[f"{run_name}-host"] = {
+                    "HostName": hostname,
+                    "Port": ssh_port,
+                    "User": user,
+                    "IdentityFile": self.identity_file,
+                    "IdentitiesOnly": "yes",
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                    "ProxyJump": f"{run_name}-jump-host",
+                }
+            else:
+                # Regular SSH instance or VM-based cloud instance
+                hosts[f"{run_name}-host"] = {
+                    "HostName": hostname,
+                    "Port": ssh_port,
+                    "User": user,
+                    "IdentityFile": self.identity_file,
+                    "IdentitiesOnly": "yes",
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                }
+            hosts[run_name] = {
+                "HostName": "localhost",
+                "Port": container_ssh_port,
+                "User": container_user,
+                "IdentityFile": self.identity_file,
+                "IdentitiesOnly": "yes",
+                "StrictHostKeyChecking": "no",
+                "UserKnownHostsFile": "/dev/null",
+                "ProxyJump": f"{run_name}-host",
+            }
+        else:
+            if ssh_proxy is not None:
+                # Kubernetes
+                hosts[f"{run_name}-jump-host"] = {
+                    "HostName": ssh_proxy.hostname,
+                    "Port": ssh_proxy.port,
+                    "User": ssh_proxy.username,
+                    "IdentityFile": self.identity_file,
+                    "IdentitiesOnly": "yes",
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                }
+                hosts[run_name] = {
+                    "HostName": hostname,
+                    "Port": ssh_port,
+                    "User": container_user,
+                    "IdentityFile": self.identity_file,
+                    "IdentitiesOnly": "yes",
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                    "ProxyJump": f"{run_name}-jump-host",
+                }
+            else:
+                # Container-based backends
+                hosts[run_name] = {
+                    "HostName": hostname,
+                    "Port": ssh_port,
+                    "User": container_user,
+                    "IdentityFile": self.identity_file,
+                    "IdentitiesOnly": "yes",
+                    "StrictHostKeyChecking": "no",
+                    "UserKnownHostsFile": "/dev/null",
+                }
+        if get_ssh_client_info().supports_multiplexing:
+            hosts[run_name].update(
+                {
+                    "ControlMaster": "auto",
+                    "ControlPath": self.control_sock_path,
+                }
+            )
+
+    def attach(self):
+        include_ssh_config(self.ssh_config_path)
+        for host, options in self.hosts.items():
+            update_ssh_config(self.ssh_config_path, host, options)
+
+        max_retries = 10
+        self._ports_lock.release()
+        for i in range(max_retries):
+            try:
+                self.tunnel.open()
+                self._attached = True
+                atexit.register(self.detach)
+                break
+            except SSHError:
+                if i < max_retries - 1:
+                    time.sleep(1)
+        else:
+            self.detach()
+            raise SSHError("Can't connect to the remote host")
+
+    def detach(self):
+        if not self._attached:
+            logger.debug("Not attached")
+            return
+        self.tunnel.close()
+        for host in self.hosts:
+            update_ssh_config(self.ssh_config_path, host, {})
+        self._attached = False
+        logger.debug("Detached")
+
+    def __enter__(self):
+        self.attach()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.detach()

dstack/_internal/core/services/ssh/client.py

@@ -0,0 +1,113 @@
+import re
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Optional, Tuple
+
+from dstack._internal.compat import IS_WINDOWS
+from dstack._internal.core.errors import SSHError
+from dstack._internal.utils.path import PathLike
+from dstack._internal.utils.ssh import find_ssh_client
+
+
+@dataclass
+class SSHClientInfo:
+    # Path to `ssh` executable
+    path: Path
+    # Full version including portable suffix, e.g., "9.6p1"
+    version: str
+    # Base version not including portable suffix, e.g., (9, 6)
+    version_tuple: Tuple[int, ...]
+    # True if OpenSSH_for_Windows (Microsoft's OpenSSH Portable fork)
+    for_windows: bool
+    # Supports Control{Master,Path,Persist} directives, but only for control purposes
+    # (e.g., `ssh -O exit`), cannot be used for connection multiplexing
+    supports_control_socket: bool
+    # Supports Control{Master,Path,Persist} for connection multiplexing
+    supports_multiplexing: bool
+    # Supports ForkAfterAuthentication (`ssh -f`)
+    supports_background_mode: bool
+
+    RAW_VERSION_REGEX = re.compile(
+        r"OpenSSH_(?P<for_windows>for_Windows_)?(?P<base_version>[\d.]+)(?P<portable_version>p\d+)?",
+        flags=re.I,
+    )
+
+    @classmethod
+    def from_raw_version(cls, raw_version: str, path: Path) -> "SSHClientInfo":
+        match = cls.RAW_VERSION_REGEX.match(raw_version)
+        if not match:
+            raise ValueError("no match")
+        for_windows, base_version, portable_version = match.group(
+            "for_windows", "base_version", "portable_version"
+        )
+        if portable_version:
+            version = f"{base_version}{portable_version}"
+        else:
+            version = base_version
+        return cls(
+            path=path,
+            version=version,
+            version_tuple=tuple(map(int, base_version.split("."))),
+            for_windows=bool(for_windows),
+            supports_control_socket=(not for_windows),
+            supports_multiplexing=(not IS_WINDOWS),
+            supports_background_mode=(not for_windows),
+        )
+
+
+def inspect_ssh_client(path: PathLike) -> SSHClientInfo:
+    """
+    Inspects various aspects of a given SSH client — version, "flavor", features — by executing
+    and parsing `ssh -V`.
+
+    :param path: a path of the ssh executable.
+    :return: :class:`SSHClientInfo` named tuple.
+    :raise dstack._internal.core.errors.SSHError: if path does not exist, `ssh -V` returns
+        non-zero exit status, or `ssh -V` output does not match the pattern.
+    """
+    path = Path(path).resolve()
+    try:
+        cp = subprocess.run(
+            [path, "-V"],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.PIPE,
+            text=True,
+            timeout=5,
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        raise SSHError(f"failed to execute `{path} -V`: {e}") from e
+    output = cp.stderr
+    if cp.returncode != 0:
+        raise SSHError(f"`{path} -V` returned non-zero exit status {cp.returncode}: {output}")
+    try:
+        return SSHClientInfo.from_raw_version(output, path)
+    except ValueError:
+        raise SSHError(f"failed to parse `{path} -V` output: {output}")
+
+
+_ssh_client_info: Optional[SSHClientInfo] = None
+
+
+def get_ssh_client_info() -> SSHClientInfo:
+    """
+    Returns :class:`SSHClientInfo` for the default SSH client. The result is cached.
+
+    :return: :class:`SSHClientInfo` named tuple.
+    :raise dstack._internal.core.errors.SSHError: if no ssh client found or the underlying
+    :func:`inspect_ssh_client` raises an error.
+    """
+    global _ssh_client_info
+    if _ssh_client_info is not None:
+        return _ssh_client_info
+    path = find_ssh_client()
+    if path is None:
+        if IS_WINDOWS:
+            msg = "SSH client not found, install Git for Windows."
+        else:
+            msg = "SSH client not found."
+        raise SSHError(msg)
+    _ssh_client_info = inspect_ssh_client(path)
+    if _ssh_client_info.for_windows:
+        raise SSHError("OpenSSH for Windows is not supported, install Git for Windows.")
+    return _ssh_client_info