shivaam opened a new pull request, #69669:
URL: https://github.com/apache/airflow/pull/69669
## What
This bumps the SSH/SFTP provider Paramiko dependency to Paramiko 4.x and
removes Airflow's remaining DSS/DSA key handling paths.
Changes:
- remove `paramiko.DSSKey` from SSH private-key loading
- reject `ssh-dss` host keys with a clear migration error
- parse real OpenSSH `known_hosts` host-key tokens:
- `ssh-rsa`
- `ecdsa-sha2-nistp256`
- `ecdsa-sha2-nistp384`
- `ecdsa-sha2-nistp521`
- `ssh-ed25519`
- keep bare base64 `host_key` values as RSA for backward compatibility
- update SSH/SFTP provider docs, README dependency tables, changelogs, and
lockfile
- cap Paramiko at `<5.0.0` because Paramiko 5 currently breaks existing SSH
hook RSA private-key tests
## Why
Paramiko 4 removed DSS/DSA support. Airflow was still referencing
`paramiko.DSSKey`, which blocks moving the SSH/SFTP providers to Paramiko 4.
This also avoids a host-key regression: users with a configured `ssh-dss`
host key now get an explicit migration error instead of a raw `KeyError`, and
ECDSA `known_hosts` values such as `ecdsa-sha2-nistp256 ...` are parsed with
`paramiko.ECDSAKey` instead of falling through to RSA parsing.
## Tests
```bash
uv run ruff format providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
providers/ssh/tests/unit/ssh/hooks/test_ssh.py
uv run ruff check --fix providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
providers/ssh/tests/unit/ssh/hooks/test_ssh.py
uv run --frozen pytest providers/ssh/tests/unit/ssh/hooks/test_ssh.py -q -k
'host_key or dss or unsupported'
```
Result:
```text
ruff format: 2 files left unchanged
ruff check --fix: All checks passed!
12 passed, 50 deselected, 1 warning
```
Also ran file-scoped `prek` validation. All applicable checks passed except
`Update providers build files`, which could not run because Docker was not
running locally.
Closes: #54079
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
