exec-helpers 8.1.3__tar.gz → 8.2.1__tar.gz

exec_helpers-8.2.1/.pre-commit-config.yaml

@@ -0,0 +1,34 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+    - id: check-yaml
+    - id: check-toml
+    - id: end-of-file-fixer
+    - id: trailing-whitespace
+    - id: mixed-line-ending
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    # Ruff version.
+    rev: v0.17.3
+    hooks:
+      # Run the linter.
+      - id: ruff-check
+        args: [ --fix ]
+      # Run the formatter.
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0  # Use the ref you want to point at
+    hooks:
+    - id: python-check-blanket-noqa
+    - id: python-check-blanket-type-ignore
+    - id: rst-directive-colons
+    - id: rst-inline-touching-normal
+
+  - repo: https://github.com/tox-dev/pyproject-fmt
+    # Use the sha / tag you want to point at
+    # or use `pre-commit autoupdate` to get the latest version
+    rev: "v2.30.3"
+    hooks:
+      - id: pyproject-fmt

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: exec-helpers
-Version: 8.1.3
+Version: 8.2.1
 Summary: Execution helpers for simplified usage of subprocess and ssh.
 Author-email: Aleksei Stepanov <penguinolog@gmail.com>
 Maintainer-email: Aleksei Stepanov <penguinolog@gmail.com>, Antonio Esposito <esposito.cloud@gmail.com>, Dennis Dmitriev <dis-xcom@gmail.com>
@@ -8,14 +8,12 @@ License-Expression: Apache-2.0
 Project-URL: Documentation, https://exec-helpers.readthedocs.io/
 Project-URL: Repository, https://github.com/python-useful-helpers/exec-helpers
 Project-URL: Bug Tracker, https://github.com/python-useful-helpers/exec-helpers/issues
-Keywords: subprocess,ssh
+Keywords: ssh,subprocess
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -23,7 +21,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
-Requires-Python: >=3.9.0
+Requires-Python: >=3.11.0
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Requires-Dist: paramiko>=2.4
@@ -33,13 +31,13 @@ Provides-Extra: xml
 Provides-Extra: lxml
 Requires-Dist: lxml>=4.6.2; extra == "lxml"
 Provides-Extra: yaml
-Requires-Dist: PyYAML>=3.12; extra == "yaml"
+Requires-Dist: pyyaml>=3.12; extra == "yaml"
 Provides-Extra: all-formats
 Requires-Dist: lxml>=4.6.2; extra == "all-formats"
-Requires-Dist: PyYAML>=3.12; extra == "all-formats"
+Requires-Dist: pyyaml>=3.12; extra == "all-formats"
 Provides-Extra: all-formats
 Requires-Dist: lxml>=4.6.2; extra == "all-formats"
-Requires-Dist: PyYAML>=3.12; extra == "all-formats"
+Requires-Dist: pyyaml>=3.12; extra == "all-formats"
 Dynamic: license-file
 
 exec-helpers
@@ -447,7 +445,11 @@ Keyword arguments:
 - cwd - working directory.
 - env - environment variables dict.
 
-.. note:: `shell=true` is always set.
+.. note:: The command is executed by the shell by default.
+   `Subprocess(shell=False)` (and `async_api.Subprocess(shell=False)`) executes it directly instead:
+   the command must be a list of arguments (a string raises `TypeError`),
+   and no shell syntax, expansion or `sh -c` inside a chroot is involved.
+   `SSHClient` can not do this: the remote side always passes the command to a shell.
 
 async_api.Subprocess specific
 -----------------------------

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/README.rst

@@ -403,7 +403,11 @@ Keyword arguments:
 - cwd - working directory.
 - env - environment variables dict.
 
-.. note:: `shell=true` is always set.
+.. note:: The command is executed by the shell by default.
+   `Subprocess(shell=False)` (and `async_api.Subprocess(shell=False)`) executes it directly instead:
+   the command must be a list of arguments (a string raises `TypeError`),
+   and no shell syntax, expansion or `sh -c` inside a chroot is involved.
+   `SSHClient` can not do this: the remote side always passes the command to a shell.
 
 async_api.Subprocess specific
 -----------------------------

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/classifiers.txt

@@ -3,8 +3,6 @@ Intended Audience :: Developers
 Topic :: Software Development :: Libraries :: Python Modules
 Programming Language :: Python :: 3
 Programming Language :: Python :: 3 :: Only
-Programming Language :: Python :: 3.9
-Programming Language :: Python :: 3.10
 Programming Language :: Python :: 3.11
 Programming Language :: Python :: 3.12
 Programming Language :: Python :: 3.13

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/exec_helpers/__init__.py

@@ -16,14 +16,13 @@
 
 from __future__ import annotations
 
+import contextlib
 import importlib
 import typing
 import warnings
 
-try:  # noqa: SIM105,S314,RUF100
+with contextlib.suppress(ImportError):
     from ._version import version as __version__  # noqa: F401
-except ImportError:
-    pass
 
 if typing.TYPE_CHECKING:
     from collections.abc import Sequence

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/exec_helpers/_helpers.py

@@ -9,6 +9,7 @@ import typing
 
 if typing.TYPE_CHECKING:
     from collections.abc import Iterable
+    from collections.abc import Mapping
 
 
 def string_bytes_bytearray_as_bytes(src: str | bytes | bytearray) -> bytes:
@@ -96,3 +97,42 @@ def chroot_command(command: str, chroot_path: str | None = None, chroot_exe: str
         quoted_command = shlex.quote(command)
         return f"{chroot_exe} {chroot_dst} sh -c {shlex.quote(f'eval {quoted_command}')}"
     return command
+
+
+def chroot_argv_command(command: str, chroot_path: str | None = None, chroot_exe: str | None = None) -> str:
+    """Prepare command for chroot execution without a shell, only the arguments are joined.
+
+    :param command: Original command, a result of `shlex.join`.
+    :type command: str
+    :param chroot_path: chroot path.
+    :type chroot_path: str | None
+    :param chroot_exe: chroot executable, may carry its own arguments.
+    :type chroot_exe: str | None
+    :return: Command to be executed with chroot rules if applicable.
+    :rtype: str
+    """
+    if chroot_path and chroot_path != "/":
+        return shlex.join([*shlex.split(chroot_exe or "chroot"), chroot_path.strip(), *shlex.split(command)])
+    return command
+
+
+def repr_stdin(stdin: bytes | None) -> str:
+    """Describe STDIN data for a debug string without exposing it.
+
+    :param stdin: Data for STDIN.
+    :type stdin: bytes | None
+    :return: Size of the data, as the content can hold secrets.
+    :rtype: str
+    """
+    return "None" if stdin is None else f"<{len(stdin)} bytes>"
+
+
+def repr_env(env: Mapping[str, str] | None) -> str:
+    """Describe an environment for a debug string without exposing the values.
+
+    :param env: Process environment.
+    :type env: Mapping[str, str] | None
+    :return: Variable names only, as the values can hold secrets.
+    :rtype: str
+    """
+    return "None" if env is None else f"<names: {sorted(env, key=repr)}>"

{exec_helpers-8.1.3 → exec_helpers-8.2.1}/exec_helpers/_ssh_base.py

@@ -21,7 +21,7 @@ from __future__ import annotations
 import concurrent.futures
 import contextlib
 import copy
-import datetime
+import datetime as dt
 import getpass
 import logging
 import pathlib
@@ -50,8 +50,7 @@ if typing.TYPE_CHECKING:
     from collections.abc import Iterable
     from collections.abc import Sequence
     from types import TracebackType
-
-    from typing_extensions import Self
+    from typing import Self
 
     from exec_helpers.api import CalledProcessErrorSubClassT
     from exec_helpers.api import CommandT
@@ -66,8 +65,8 @@ if typing.TYPE_CHECKING:
 
 __all__ = ("SSHClientBase", "SshExecuteAsyncResult", "SupportPathT")
 
-KeepAlivePeriodT = typing.Union[int, bool]
-SupportPathT = typing.Union[str, pathlib.PurePath]
+KeepAlivePeriodT = int | bool
+SupportPathT = str | pathlib.PurePath
 
 
 class RetryOnExceptions(tenacity.retry_if_exception):
@@ -95,6 +94,7 @@ class SshExecuteAsyncResult(api.ExecuteAsyncResult):
     __slots__ = ()
 
     @property
+    # pyrefly: ignore[bad-override]  # the property narrows the NamedTuple field type
     def interface(self) -> paramiko.Channel:
         """Override original NamedTuple with proper typing.
 
@@ -104,6 +104,7 @@ class SshExecuteAsyncResult(api.ExecuteAsyncResult):
         return super().interface  # type: ignore[no-any-return]
 
     @property
+    # pyrefly: ignore[bad-override]  # the property narrows the NamedTuple field type
     def stdin(self) -> paramiko.channel.ChannelStdinFile:
         """Override original NamedTuple with proper typing.
 
@@ -118,6 +119,7 @@ class SshExecuteAsyncResult(api.ExecuteAsyncResult):
         return super().stdin  # type: ignore[return-value]
 
     @property
+    # pyrefly: ignore[bad-override]  # the property narrows the NamedTuple field type
     def stderr(self) -> paramiko.channel.ChannelStderrFile | None:
         """Override original NamedTuple with proper typing.
 
@@ -127,6 +129,7 @@ class SshExecuteAsyncResult(api.ExecuteAsyncResult):
         return super().stderr
 
     @property
+    # pyrefly: ignore[bad-override]  # the property narrows the NamedTuple field type
     def stdout(self) -> paramiko.channel.ChannelFile | None:
         """Override original NamedTuple with proper typing.
 
@@ -136,7 +139,7 @@ class SshExecuteAsyncResult(api.ExecuteAsyncResult):
         return super().stdout
 
 
-class _SSHExecuteContext(api.ExecuteContext, contextlib.AbstractContextManager[SshExecuteAsyncResult]):
+class _SSHExecuteContext(api.ExecuteContext):
     """SSH Execute context."""
 
     __slots__ = (
@@ -223,8 +226,8 @@ class _SSHExecuteContext(api.ExecuteContext, contextlib.AbstractContextManager[S
         """
         return (
             f"<SSHClient().open_execute_context("
-            f"command={self.command!r}, "
-            f"stdin={self.stdin!r}, "
+            f"command={self._masked_command!r}, "
+            f"stdin={_helpers.repr_stdin(self.stdin)}, "
             f"open_stdout={self.open_stdout!r}, "
             f"open_stderr={self.open_stderr!r}, "
             f"get_pty={self.__get_pty!r}, "
@@ -309,7 +312,7 @@ class _SSHExecuteContext(api.ExecuteContext, contextlib.AbstractContextManager[S
             stderr = None
         _stdin: paramiko.channel.ChannelFile
         with chan.makefile("wb") as _stdin:
-            started = datetime.datetime.now(tz=datetime.timezone.utc)
+            started = dt.datetime.now(tz=dt.UTC)
             if self.__sudo_mode:
                 chan.exec_command(self.command)  # nosec  # Sanitize on caller side
                 if not stdout.channel.closed:
@@ -334,13 +337,8 @@ class _SSHExecuteContext(api.ExecuteContext, contextlib.AbstractContextManager[S
             res_stdout = None
 
         # noinspection PyArgumentList
-        return SshExecuteAsyncResult(
-            interface=chan,
-            stdin=_stdin,
-            stderr=stderr,
-            stdout=res_stdout,
-            started=started,
-        )
+        # The fields are typed by properties of the subclass, which type checkers do not accept as constructor arguments
+        return SshExecuteAsyncResult._make((chan, _stdin, stderr, res_stdout, started))
 
     def __exit__(
         self,
@@ -457,6 +455,15 @@ class SSHClientBase(api.ExecHelper):
     :type keepalive: int | bool
     :param allow_ssh_agent: Use SSH Agent if available.
     :type allow_ssh_agent: bool
+    :param missing_host_key_policy: Missing host key policy class. See paramiko.MissingHostKeyPolicy for details.
+    :type missing_host_key_policy: type[paramiko.MissingHostKeyPolicy]
+    :param connect_timeout: Timeout in seconds for the TCP connection, the SSH banner, the key exchange and the
+        authentication of every connection step, including hosts reached through `proxy_to`.
+        An authentication timeout is reported as an authentication failure. By default: None
+        (paramiko defaults: no TCP and key exchange limit, banner 15 s, authentication 30 s). A connection attempt
+        is retried 3 times with a 3 s pause, so a hung host takes up to 3 times the timeout plus 6 s to report.
+    :type connect_timeout: float | None
+    :raises ValueError: connect_timeout is not positive.
 
     .. note:: auth has priority over username/password/private_keys.
     .. note::
@@ -475,12 +482,17 @@ class SSHClientBase(api.ExecHelper):
     .. versionchanged:: 7.0.0 keepalive_mode is removed.
     .. versionchanged:: 7.4.0 Return of keepalive_mode to prevent mix with a keepalive period. Default is `False`.
     .. versionchanged:: 8.0.0 Expose SSH Agent usage override.
+    .. versionchanged:: 8.1.4 Allow specifying missing_host_key_policy.
+    .. versionchanged:: 8.2.1 Added connect_timeout.
+    .. versionchanged:: 8.2.1 Direct connection to the local host accepts the host keys of this machine without
+        the unknown host key warning; a key of another server is handled by the missing host key policy as before.
     """
 
     __slots__ = (
         "__allow_agent",
         "__auth_mapping",
         "__conn_chain",
+        "__connect_timeout",
         "__hostname",
         "__keepalive_mode",
         "__keepalive_period",
@@ -491,6 +503,7 @@ class SSHClientBase(api.ExecHelper):
         "__ssh_config",
         "__sudo_mode",
         "__verbose",
+        "_missing_host_key_policy",
     )
 
     def __hash__(self) -> int:
@@ -515,13 +528,19 @@ class SSHClientBase(api.ExecHelper):
         sock: paramiko.ProxyCommand | paramiko.Channel | socket.socket | None = None,
         keepalive: KeepAlivePeriodT = 1,
         allow_ssh_agent: bool = True,
+        missing_host_key_policy: type[paramiko.MissingHostKeyPolicy] = paramiko.WarningPolicy,
+        connect_timeout: float | None = None,
     ) -> None:
-        """Main SSH Client helper."""
+        """Initialize the SSH client helper."""
         self.__sudo_mode = False
         self.__keepalive_period: int = int(keepalive)
         self.__keepalive_mode = False
         self.__verbose: bool = verbose
         self.__sock = sock
+        self._missing_host_key_policy = missing_host_key_policy
+        if connect_timeout is not None and connect_timeout <= 0:
+            raise ValueError(f"connect_timeout should be positive, got {connect_timeout!r}")
+        self.__connect_timeout = connect_timeout
 
         self.__ssh: paramiko.SSHClient
         self.__sftp: paramiko.SFTPClient | None = None
@@ -744,18 +763,35 @@ class SSHClientBase(api.ExecHelper):
         """
         return self.__ssh
 
+    def __connect(self) -> None:
+        """Open the connection, with retries unless a socket was supplied.
+
+        A failed attempt closes the supplied socket, so there is nothing to retry on:
+        the next attempt would only fail on the closed socket and hide the original error.
+        """
+        with self.lock:
+            if self.__sock is None:
+                self.__connect_with_retries()
+            else:
+                self.__connect_once()
+
     @tenacity.retry(
         retry=RetryOnExceptions(retry_on=paramiko.SSHException, reraise=paramiko.AuthenticationException),
         stop=tenacity.stop.stop_after_attempt(3),
         wait=tenacity.wait.wait_fixed(3),
         reraise=True,
     )
-    def __connect(self) -> None:
-        """Main method for connection open."""
+    def __connect_with_retries(self) -> None:
+        """Open the connection, retry on the connection errors."""
+        self.__connect_once()
+
+    def __connect_once(self) -> None:
+        """Open the connection, one attempt."""
         with self.lock:
             if self.__sock is not None:
                 self.__ssh = paramiko.SSHClient()
-                self.__ssh.set_missing_host_key_policy(paramiko.WarningPolicy())
+                self.__ssh.load_system_host_keys()
+                self.__ssh.set_missing_host_key_policy(self._missing_host_key_policy)
                 self.auth.connect(
                     client=self.__ssh,
                     hostname=self.hostname,
@@ -763,6 +799,7 @@ class SSHClientBase(api.ExecHelper):
                     log=self.__verbose,
                     sock=self.__sock,
                     allow_ssh_agent=self.allow_ssh_agent,
+                    timeout=self.__connect_timeout,
                 )
             else:
                 self.__ssh = self.__get_client()
@@ -770,6 +807,27 @@ class SSHClientBase(api.ExecHelper):
             transport: paramiko.Transport = self._ssh_transport
             transport.set_keepalive(1 if self.__keepalive_period else 0)  # send keepalive packets
 
+    def __host_key_policy(self, hostname: str) -> paramiko.MissingHostKeyPolicy | type[paramiko.MissingHostKeyPolicy]:
+        """Select the missing host key policy for a host which is connected to directly.
+
+        :param hostname: Host to connect to, without a proxy or a jump host.
+        :type hostname: str
+        :return: Configured policy; for the local host a policy, which accepts the keys of this machine first.
+        :rtype: paramiko.MissingHostKeyPolicy | type[paramiko.MissingHostKeyPolicy]
+
+        The local host is normally absent from `known_hosts`, so its own keys are the reference. A key of another
+        server (any local address can be a container, a tunnel or another server) goes to the configured policy as
+        before, so nothing which worked fails because of it. Without readable keys the configured policy decides.
+        The own key is accepted without asking the configured policy, so that policy does not see it.
+        """
+        try:
+            keys = _ssh_helpers.local_host_keys() if _ssh_helpers.is_local_host(hostname) else ()
+        except OSError:  # the answer only silences a warning, so a failure of the lookup must not fail the connection
+            keys = ()
+        if keys:
+            return _ssh_helpers.LocalHostKeyPolicy(keys, fallback=self._missing_host_key_policy)
+        return self._missing_host_key_policy
+
     def __get_client(self) -> paramiko.SSHClient:
         """Connect using connection chain information.
 
@@ -779,11 +837,33 @@ class SSHClientBase(api.ExecHelper):
         :raises RuntimeError: Unexpected state.
         :raises ConnectionError: Cannot get SSH transport.
         """
+        opened: list[paramiko.SSHClient] = []
+        try:
+            return self.__connect_chain(opened)
+        except BaseException:
+            for client in reversed(opened):  # paramiko leaves the transports of a failed connect running
+                client.close()
+            raise
+
+    def __connect_chain(self, opened: list[paramiko.SSHClient]) -> paramiko.SSHClient:
+        """Connect the hosts of the connection chain one by one.
+
+        :param opened: Every client created here is added to the list at once, for the cleanup on failure.
+        :type opened: list[paramiko.SSHClient]
+        :return: Paramiko ssh connection object of the last host.
+        :rtype: paramiko.SSHClient
+        :raises ValueError: ProxyCommand found in a connection chain after the first host reached an.
+        :raises RuntimeError: Unexpected state.
+        :raises ConnectionError: Cannot get SSH transport.
+        """
+        config, auth = self.__conn_chain[0]
 
         last_ssh_client: paramiko.SSHClient = paramiko.SSHClient()
-        last_ssh_client.set_missing_host_key_policy(paramiko.WarningPolicy())  # noqa: S507,RUF100
-
-        config, auth = self.__conn_chain[0]
+        opened.append(last_ssh_client)
+        last_ssh_client.load_system_host_keys()
+        last_ssh_client.set_missing_host_key_policy(
+            self._missing_host_key_policy if config.proxycommand else self.__host_key_policy(config.hostname)
+        )
 
         auth.connect(
             last_ssh_client,
@@ -791,11 +871,14 @@ class SSHClientBase(api.ExecHelper):
             port=config.port or 22,
             sock=paramiko.ProxyCommand(config.proxycommand) if config.proxycommand else None,
             allow_ssh_agent=self.allow_ssh_agent,
+            timeout=self.__connect_timeout,
         )
 
         for config, auth in self.__conn_chain[1:]:  # start has another logic, so do it out of cycle
             ssh = paramiko.SSHClient()
-            ssh.set_missing_host_key_policy(paramiko.WarningPolicy())  # noqa: S507,RUF100
+            opened.append(ssh)
+            ssh.load_system_host_keys()
+            ssh.set_missing_host_key_policy(self._missing_host_key_policy)
 
             if config.proxyjump:
                 transport = last_ssh_client.get_transport()
@@ -812,6 +895,7 @@ class SSHClientBase(api.ExecHelper):
                     port=config.port or 22,
                     sock=sock,
                     allow_ssh_agent=self.allow_ssh_agent,
+                    timeout=self.__connect_timeout,
                 )
                 last_ssh_client = ssh
                 continue
@@ -823,10 +907,11 @@ class SSHClientBase(api.ExecHelper):
         return last_ssh_client
 
     def __connect_sftp(self) -> None:
-        """SFTP connection opener."""
+        """Open the SFTP channel, reconnecting the SSH session first if it was closed."""
         with self.lock:
+            transport = self._ssh_transport  # a failed reconnect is not "SFTP unavailable": let it propagate
             try:
-                self.__sftp = self.__ssh.open_sftp()
+                self.__sftp = transport.open_sftp_client()
             except paramiko.SSHException:
                 self.logger.warning("SFTP enable failed! SSH only is accessible.")
 
@@ -836,6 +921,11 @@ class SSHClientBase(api.ExecHelper):
 
         :rtype: paramiko.sftp_client.SFTPClient
         :raises paramiko.SSHException: SFTP connection failed.
+        :raises ConnectionError: SSH session was closed and the reconnect failed.
+        :raises paramiko.SSHException: SSH session was closed and the reconnect failed (the original exception).
+
+        .. versionchanged:: 8.2.1 The SFTP channel is opened through the reconnecting transport getter,
+            so a closed SSH session is restored instead of failing with `AttributeError`.
         """
         if self.__sftp is not None:
             return self.__sftp
@@ -869,7 +959,7 @@ class SSHClientBase(api.ExecHelper):
         """
         try:
             self.__ssh.close()
-        except BaseException as e:  # pragma: no cover  # NOSONAR
+        except BaseException as e:  # noqa: BLE001  # pragma: no cover  # NOSONAR
             with contextlib.suppress(AttributeError):
                 self.logger.debug(f"Exception in {self!s} destructor call: {e}")
         self.__sftp = None
@@ -900,7 +990,7 @@ class SSHClientBase(api.ExecHelper):
 
     @sudo_mode.setter
     def sudo_mode(self, mode: bool) -> None:
-        """Persistent sudo mode change for connection object.
+        """Change the persistent sudo mode of the connection object.
 
         :param mode: Sudo status: enabled | disabled.
         :type mode: bool
@@ -1053,7 +1143,7 @@ class SSHClientBase(api.ExecHelper):
                 result.read_stderr(src=async_result.stderr, log=self.logger if log_stderr else None, verbose=verbose)
 
         def poll_pipes() -> None:
-            """Polling task for FIFO buffers."""
+            """Poll FIFO buffers."""
             while not async_result.interface.status_event.is_set():
                 time.sleep(0.1)
                 if async_result.stdout or async_result.stderr:
@@ -1147,6 +1237,7 @@ class SSHClientBase(api.ExecHelper):
             sudo_mode=self.sudo_mode,
             auth=self.auth,
             logger=self.logger,
+            log_mask_re=self.log_mask_re,
             **kwargs,
         )
 
@@ -1556,6 +1647,7 @@ class SSHClientBase(api.ExecHelper):
             sock=sock,
             ssh_auth_map=ssh_auth_map if ssh_auth_map is not None else self.__auth_mapping,
             keepalive=int(keepalive),
+            connect_timeout=self.__connect_timeout,
         )
 
     def execute_through_host(
@@ -1779,7 +1871,7 @@ class SSHClientBase(api.ExecHelper):
                 results[remote.hostname, remote.port] = result
                 if result.exit_code not in prep_expected:
                     errors[remote.hostname, remote.port] = result
-            except Exception as e:  # noqa: PERF203
+            except Exception as e:  # noqa: BLE001  # stored and reported to the caller
                 raised_exceptions[remote.hostname, remote.port] = e
 
         if raised_exceptions:  # always raise