shivaam opened a new pull request, #69712: URL: https://github.com/apache/airflow/pull/69712
Follow-up to #69669. ## What This removes the temporary `paramiko<5.0.0` cap from the SSH and SFTP providers and updates the generated dependency tables/lockfile so the providers can resolve Paramiko 5. It also keeps RSA private-key validation working with Paramiko 5 by validating RSA keys with `rsa-sha2-512` instead of Paramiko's removed legacy `ssh-rsa` SHA-1 signing path. ## Why Paramiko 5 removed legacy SHA-1 SSH behavior, including RSA SHA-1 `ssh-rsa` signing. Airflow's SSH hook private-key loader was using `key.sign_ssh_data(b"")` as a validation probe, which makes RSA keys fail under Paramiko 5 with `KeyError: 'ssh-rsa'`. RSA keys are still supported; the issue is only the old SHA-1 `ssh-rsa` algorithm. The changelog notes call this out for users whose servers only support legacy SHA-1 SSH algorithms. ## Validation - `uv run python -c 'import inspect, paramiko; print(paramiko.__version__); print(inspect.signature(paramiko.SSHClient.connect)); print(paramiko.RSAKey.HASHES.keys())'` - `uv lock --check` - `git diff --check` - `uv run pytest providers/ssh/tests/unit/ssh/hooks/test_ssh.py -k 'private_key or host_key or dss_host_key or unsupported_host_key' -q` - `uv run pytest providers/ssh/tests/unit/ssh/hooks/test_ssh_async.py providers/sftp/tests/unit/sftp/hooks/test_sftp.py -k 'host_key or private_key or connection' -q` - `uv run ruff format --check providers/ssh/src/airflow/providers/ssh/hooks/ssh.py` - `uv run ruff check providers/ssh/src/airflow/providers/ssh/hooks/ssh.py` - `uv run mypy --config-file pyproject.toml providers/ssh/src/airflow/providers/ssh/hooks/ssh.py` - `uv run prek --files providers/ssh/src/airflow/providers/ssh/hooks/ssh.py providers/ssh/pyproject.toml providers/ssh/README.rst providers/ssh/docs/index.rst providers/ssh/docs/changelog.rst providers/sftp/pyproject.toml providers/sftp/README.rst providers/sftp/docs/index.rst providers/sftp/docs/changelog.rst uv.lock` Local caveat: `uv run prek mypy-providers --files providers/ssh/src/airflow/providers/ssh/hooks/ssh.py` exits 137 during the local Breeze provider mypy environment setup, without emitting a mypy type error. The direct mypy command above passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
