potiuk opened a new pull request, #73419: URL: https://github.com/apache/airflow/pull/73419
The SFTP filesystem backend (`providers/sftp/.../fs/sftp.py`) has always verified host keys by default. `SSHHook`, `SSHHookAsync` and `SFTPHookAsync` did not — `no_host_key_check` defaulted to `true`, so any connection that didn't say otherwise got paramiko's `AutoAddPolicy`, or `known_hosts=None` on the asyncssh paths. This brings the hooks in line with the filesystem backend. ### Breaking change A connection to a host with no entry in the known hosts file is now refused. Existing behaviour can be kept by any of: - adding the host key to the known hosts file - supplying `host_key` on the connection - setting the `no_host_key_check` connection extra to `true` - passing `no_host_key_check=True` to the hook constructor The constructor argument takes precedence over the connection extra. ### Three supporting changes **`no_host_key_check` constructor argument on `SSHHook`.** The setting could only come from a Connection extra, so callers building the hook directly had no opt-out at all — the migration path above would not have worked for them. **`ignore_hostkey_verification` is now a deprecated alias.** Nothing read this extra. Connections setting it were relying on the permissive default, not on the setting, so flipping the default would have broken them with no working replacement. It now works and emits an `AirflowProviderDeprecationWarning`. **Worker hooks inherit configuration.** `store_directory_concurrently` and `retrieve_directory_concurrently` built their per-worker hooks as `SFTPHook(ssh_conn_id=self.ssh_conn_id)`, dropping everything else configured on the parent. Harmless while the default was permissive; now the workers inherit the host key setting. ### Test plan - [x] `breeze testing providers-tests --test-type "Providers[ssh,sftp]"` — 404 passed, 0 failed - [x] New tests verified to fail without the source changes (checked by reverting each) - [x] `ruff check`, `ruff format --check`, and the pre-commit hook set all clean ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
