Repository navigation
fix(openssh): close residual regress compatibility gaps #314
Description
Part of #275. Follow-up to #313.
Context
The final OpenSSH V_10_3_P1 compatibility runs for #313 reached the epic gate on both CI platforms:
- macOS: 60 passed out of 66 eligible tests, 6 failed, 7 environmental, 6 skipped
- Ubuntu: 61 passed out of 69 eligible tests, 8 failed, 4 environmental, 6 skipped
This issue keeps every remaining candidate-only failure explicitly tracked after the epic closes. It does not reclassify environmental failures or reduce the committed score floor.
Remaining candidate failures
| Test | macOS | Ubuntu | First observed gap |
|---|---|---|---|
agent-restrict |
fail | fail | candidate key generation path |
dynamic-forward |
fail | fail | dynamic forwarding startup and SOCKS coverage |
hostkey-agent |
fail | fail | Ed25519 host-key agent behavior |
multiplex |
fail | fail | unsupported -O conninfo and remaining control operations |
percent |
fail | fail | percent expansion in match/exec handling |
proxyjump |
fail | fail | basic parsing and multi-hop behavior |
rekey |
environmental | fail | Ubuntu candidate timeout |
scp3 |
environmental | fail | Ubuntu remote-to-remote copy behavior |
The uploaded result tables classify channel-timeout, connection-timeout, forwarding, and sftp-badcmds as environmental on both platforms. macOS additionally classifies forward-control, rekey, and scp3 as environmental because the reference client fails in the same environment. The six upstream skips remain unchanged.
Scope
- reproduce each candidate-only failure against the pinned harness
- fix compatibility gaps without weakening fixture validation or score floors
- split independent implementation areas into linked issues when a focused fix is safer
- retain reference-client evidence for platform-specific environmental classifications
Acceptance criteria
- Every listed candidate-only failure either passes on both supported CI platforms or has a narrower linked issue with reproduction evidence.
- The committed eligible-result floors are not lowered to hide a regression.
- macOS and Ubuntu result artifacts identify all remaining fail, environmental, and skip verdicts.
-
rekeypasses on Ubuntu withRekeyLimitenforced by the candidate. This criterion is carried over from feat(ssh_config): wire the parsed-but-unused ssh_config keywords #281, whose other first-wave criteria are met; feat(ssh_config): wire the parsed-but-unused ssh_config keywords #281 is closed in favor of tracking it here.
Status after #325 (2026-10-21)
Measured on main 5c4261a (run 39535872538):
| Test | macOS | Ubuntu |
|---|---|---|
dynamic-forward, percent, proxyjump |
pass | pass |
scp3 |
environmental | pass |
agent-restrict |
fail | fail |
hostkey-agent |
fail | fail |
multiplex |
fail | fail |
rekey |
environmental | fail (candidate timeout) |
agent-restrict depends on the upstream russh binding API (russh PR #794). The ProxyCommand token expansion issue found during #325 is tracked in #326.
Activity
fix: harden OpenSSH compatibility review findings
fix: close OpenSSH startup races
fix: preserve SSH diagnostic contracts
fix: advance OpenSSH client compatibility (#325)
feat(ssh): add Unix-domain forwarding and validated host certificates
inureyes commentedon Oct 21, 2026
Status after the implementation branch
fix/issue-314-regress-residual-gaps, measured on a Linux aarch64 host with the pinnedV_10_3_P1harness:rekey: passes in 114.3 s (reference client 114.5 s). The 0.6 s per-connection padding in the client is gone and the manifest minimum is 180 s with the measured numbers recorded indocs/openssh-regress.md.multiplex: passes in 72.1 s including Unix-domain-O forward/-O cancelwhen the regress path fitssockaddr_un; on this host the pinned harness reports both clients environmental because the path is too long. The CI log's singlecmpfailure was the Unix phase.hostkey-agent: every plain and non-FIDO certificate phase andmultiple hostkeyspass with full host-certificate validation. The twosk-*certificate phases are tracked in fix(openssh): decide FIDO host-key coverage for the hostkey-agent sk certificate phases #328.agent-restrict: thehost_d/host_efailures were missing host-certificate support and pass now; the eight phases that needsession-bind@openssh.comare tracked in feat(agent): bind destination-constrained agent keys with session-bind@openssh.com #327 (russh PR #794).CI on Ubuntu and macOS will provide the two-platform artifacts for the remaining checkboxes.
test(openssh-regress): expect the rekey timeout override in the manif…
fix(ssh): honor CA scope negation and fail closed on bad RevokedHostKeys
docs: describe host certificate validation and Unix-socket forwarding
fix(ssh): close host-certificate and Unix-socket hardening gaps (#332)