Add support for OpenSSH certificates, resolve #31 #901

luigidemasi · 2025-09-17T16:23:38Z

No description provided.

norrisjeremy

Can you run mvn formatter:format to ensure that everything is formatted correctly?
Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time.

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/Buffer.java

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/OpenSshCertificate.java

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

src/main/java/com/jcraft/jsch/OpenSshCertificateBuffer.java

src/main/java/com/jcraft/jsch/OpensshCertificateParser.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/OpenSshCertificateBuffer.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

davsclaus · 2025-09-23T05:21:21Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

norrisjeremy · 2025-09-23T10:08:10Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

None of my earlier feedback appears to have actually been incorporated: the PR author simply marked them all as resolved w/o making any of the suggested changes.
To quote part of my earlier review: "Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time."

luigidemasi · 2025-09-23T10:57:35Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

None of my earlier feedback appears to have actually been incorporated: the PR author simply marked them all as resolved w/o making any of the suggested changes.

To quote part of my earlier review: "Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time."

Hi @norrisjeremy, thanks for following up. I marked the comments as resolved on GitHub because I had already addressed them locally and didn’t want to lose track of your suggestions. I’m currently adding support for host keys as well (it’s nearly finished) and I’ll push everything together in the next update. Please let me know if you have any additional suggestions in the meantime.

norrisjeremy · 2025-09-23T11:01:08Z

Hi @norrisjeremy, thanks for following up. I marked the comments as resolved on GitHub because I had already addressed them locally and didn’t want to lose track of your suggestions. I’m currently adding support for host keys as well (it’s nearly finished) and I’ll push everything together in the next update. Please let me know if you have any additional suggestions in the meantime.

Hi @luigidemasi,

Great, thanks! We are excited to have someone step up and contribute this work!

Thanks,
Jeremy

luigidemasi · 2025-09-29T17:35:39Z

@norrisjeremy

Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time.

I added the support for Host Certificate, let me know wdyt.

davsclaus · 2025-10-02T11:28:28Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

norrisjeremy · 2025-10-02T11:42:55Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

I probably won't have time to start reviewing this again until next week.

davsclaus · 2025-10-02T11:51:09Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

I probably won't have time to start reviewing this again until next week.

Thanks for the update, no problem. Just glad we are on path to the goal line.

davsclaus · 2025-10-14T12:38:49Z

Sorry to bother - but would be good to get this reviewed

norrisjeremy · 2025-10-14T20:05:55Z

Sorry to bother - but would be good to get this reviewed

HI @davsclaus,

Yes, I haven't forgotten, I will try to review it when I have some time available.

Thanks,
Jeremy

norrisjeremy

Just a few initial comments, I still have a lot left to review.

src/main/java/com/jcraft/jsch/Buffer.java

src/main/java/com/jcraft/jsch/KeyExchange.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/UserAuthPublicKey.java

src/test/java/com/jcraft/jsch/HostCertificateIT.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/OpenSshCertificateHostKeyVerifier.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/SignatureWrapper.java

norrisjeremy

Thank you for your patience as I continue review this.

Aside from a few small stylistic nits I've pointed out, the only signficant item I can see is API changes proposed for KeyExchange (changing the next() method to no longer be abstract & introducing the the doNext() and getFingerprint(byte[]) methods).

As I mentioned inline, if these API changes to KeyExchange aren't necessary for the cert support (which I don't believe they are, but I could have missed it since this is such a large PR), I'd rather they not be made (at least as part of this PR).

norrisjeremy · 2026-01-20T13:34:34Z

src/main/java/com/jcraft/jsch/KeyExchange.java

+  }
+
+
+  protected boolean doNext(Buffer buf, int sshMessageType) throws Exception {


From what I can see, the cert support being introduced here doesn't seem to require the changes here though to the next() method (and introduction of doNext()), right?

If that's true, then I'd rather not introduce API changes like this into KeyExchange.

src/main/java/com/jcraft/jsch/KeyExchange.java

src/main/java/com/jcraft/jsch/Session.java

src/test/java/com/jcraft/jsch/UserCertAuthIT.java

src/test/java/com/jcraft/jsch/HostCertificateIT.java

src/test/java/com/jcraft/jsch/OpenSshCertificateUtilTest.java

davsclaus · 2026-01-22T10:18:26Z

Thanks for the progress on this one - looks like we are getting close to be ready. @luigidemasi there is a few things still to do thanks.

norrisjeremy · 2026-01-22T17:31:33Z

Hi @luigidemasi,

Can you run mvn formatter:format?
It seems the build fails currently:

Error:  Failed to execute goal net.revelc.code.formatter:formatter-maven-plugin:2.29.0:validate (default) on project jsch: File '/home/runner/work/jsch/jsch/src/test/java/com/jcraft/jsch/HostCertificateIT.java' has not been previously formatted. Please format file (for example by invoking `mvn net.revelc.code.formatter:formatter-maven-plugin:2.29.0:format`) and commit before running validation! -> [Help 1]

Thanks!
Jeremy

luigidemasi · 2026-01-22T17:36:31Z

Hi @luigidemasi,

Can you run mvn formatter:format? It seems the build fails currently:

Error:  Failed to execute goal net.revelc.code.formatter:formatter-maven-plugin:2.29.0:validate (default) on project jsch: File '/home/runner/work/jsch/jsch/src/test/java/com/jcraft/jsch/HostCertificateIT.java' has not been previously formatted. Please format file (for example by invoking `mvn net.revelc.code.formatter:formatter-maven-plugin:2.29.0:format`) and commit before running validation! -> [Help 1]

Thanks! Jeremy

@norrisjeremy done!

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/KeyExchange.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/UserAuthPublicKey.java

… code review

… Host Certificate

… code review for Host Certificate support

… code review for Host Certificate support - part2

… code review for Host Certificate support - part3

sonarqubecloud · 2026-01-28T10:34:22Z

Quality Gate passed

Issues
210 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

norrisjeremy suggested changes Sep 17, 2025

View reviewed changes

norrisjeremy reviewed Sep 17, 2025

View reviewed changes

norrisjeremy reviewed Sep 18, 2025

View reviewed changes