Package: dput-ng Version: 1.25+deb10u1 Severity: normal dput fails to validate the host key of ssh.upload.debian.org for me:
$ dput ssh-upload ../u-boot_2019.10+dfsg-1_source.changes
Uploading u-boot using sftp to ssh-upload (host: ssh.upload.debian.org;
directory: /srv/upload.debian.org/UploadQueue/)
running allowed-distribution: check whether a local profile permits uploads
to the target distribution
running protected-distribution: warn before uploading to distributions where
a special policy applies
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running gpg: check GnuPG signatures before the upload
Logging into host ssh.upload.debian.org as vagrant
/usr/lib/python3/dist-packages/paramiko/ecdsakey.py:164:
CryptographyDeprecationWarning: Support for unsafe construction of public
numbers from encoded data will be removed in a future version. Please use
EllipticCurvePublicKey.from_encoded_point
self.ecdsa_curve.curve_class(), pointinfo
/usr/lib/python3/dist-packages/paramiko/kex_ecdh_nist.py:39:
CryptographyDeprecationWarning: encode_point has been deprecated on
EllipticCurvePublicNumbers and will be removed in a future version. Please use
EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed
point encoding.
m.add_string(self.Q_C.public_numbers().encode_point())
/usr/lib/python3/dist-packages/paramiko/kex_ecdh_nist.py:96:
CryptographyDeprecationWarning: Support for unsafe construction of public
numbers from encoded data will be removed in a future version. Please use
EllipticCurvePublicKey.from_encoded_point
self.curve, Q_S_bytes
/usr/lib/python3/dist-packages/paramiko/kex_ecdh_nist.py:111:
CryptographyDeprecationWarning: encode_point has been deprecated on
EllipticCurvePublicNumbers and will be removed in a future version. Please use
EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed
point encoding.
hm.add_string(self.Q_C.public_numbers().encode_point())
please login: To accept ssh-ed25519 hostkey
b'5c90717e5b00364ec2130d9d7a46e4f7' for ssh.upload.debian.org type "yes": [yes,
no]: no
SFTP error uploading to ssh.upload.debian.org: SSHException('Unknown server
ssh.upload.debian.org')
The host key it presents is apparently in MD5 format, which ought to
be considered deprecated by now; it's not what openssh uses, at least.
I'm able to "ssh ssh.upload.debian.org" without trouble using openssh,
though I have a configuration file in ~/.ssh/config:
Host ssh.upload.debian.org
HostName usper.debian.org
But dput apparently doesn't respect those settings.
Maybe it would work if I added a known_hosts entry for
ssh.upload.debian.org, but then I'd have to manually remove it when
the server the ssh.upload.debian.org points to changes.
I'm quite sure this used to work, though I have no idea when it changed.
I'm guessing the real problem is in some backend that dput-ng is using
(paramiko?).
live well,
vagrant
-- System Information:
Debian Release: 10.1
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable'), (12, 'unstable'), (1,
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: armhf, arm64
Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages dput-ng depends on:
ii python3 3.7.3-1
ii python3-dput 1.25+deb10u1
dput-ng recommends no packages.
Versions of packages dput-ng suggests:
pn dput-ng-doc <none>
pn python3-twitter <none>
-- no debconf information
signature.asc
Description: PGP signature
