Repository navigation
update: adopt russh 0.65.1 with staged host-key verification - #353
Merged
Merged
Conversation
Update ten Rust dependencies. Adapt to russh's security-driven callback order by preflighting host trust without persistence, then checking the negotiated key type and committing trust before authentication. Recheck concurrent TOFU changes and preserve existing file modes and symlinks during atomic writes. Validation: 2,648 tests passed, 8 ignored; all-target Clippy and formatting pass. Audit retains the existing maintenance warning and RSA suppression. Local Linux/Windows cross-checks remain blocked by missing C toolchains. Rekey trust remains tracked in #336.
inureyes
added
type:enhancement
inureyes
added a commit
that referenced
this pull request
Nov 5, 2026
Bump the crate, lockfile, and manpages to 3.1.1 and add release entries to README, CHANGELOG, and debian/changelog covering #349, #350, #352, and #353: the cluster command argument fix, the russh 0.65.1 upgrade with staged host-key verification, session-bind on agent connections, and the dependency refresh.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update 10 compatible Rust packages, including russh 0.65.0 → 0.65.1. Its security fix moves
kex_doneaftercheck_server_key, breaking bssh's reliance on the opposite callback order. Rework initial host verification into two stages: preflight trust/revocation without persistence, then check the negotiated key type and commit trust before russh releases the connected handle for authentication. The raw KEX shared secret remains unused.Dependencies and limits
The sole Rust workspace has no web/pnpm projects. Nine other compatible upgrades: aes, async-compression, cc, compression-codecs, crc32fast, ctutils, finl_unicode, pest_stack_guard, psm. No major upgrade or MSRV change (1.97).
Retain ssh-key =0.7.0-rc.11 to match russh. Transitive holds: generic-array 0.14.7 → 0.14.9 is blocked by crypto-common 0.1.7; pkcs1 rc.4 → stable and rsa rc.18 → rc.20 are pinned by russh. cargo audit retains only the existing unsafe-libyaml maintenance warning and existing RSA advisory suppression.
Validation
cargo test --tests -- --skip integration_test: 2,648 passed, 8 ignored across 54 suites.cargo clippy --all-targets -- -D warnings, formatting, and diff checks pass. Regression coverage checks absent persistence on mismatches, pre-KEX trust rejection, commit-time conflicts, single command execution, symlink preservation, and the real russh authentication/certificate paths. Linux/Windows cross-checks are blocked by missing C compiler/SDK headers in aws-lc-sys, also present before this update; remote Linux/macOS checks run on this PR.