search

oklimberg / fastlane-plugin-sftp

MIT License
7 stars 5 forks source link

Not compatible with OpenSSL 3 #6

Open odrobnik opened 1 year ago

odrobnik commented 1 year ago

trying to run this plugin via fastlane on ruby 3.2.2, I get "pkeys are immutable on OpenSSL 3.0".

bundler: failed to load command: fastlane (/Users/oliver/.rbenv/versions/3.2.2/bin/fastlane)
/Users/oliver/.rbenv/versions/3.2.2/lib/ruby/gems/3.2.0/gems/net-ssh-5.2.0/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb:55:in `generate_key!': [!] pkeys are immutable on OpenSSL 3.0 (OpenSSL::PKey::PKeyError)
    from /Users/oliver/.rbenv/versions/3.2.2/lib/ruby/gems/3.2.0/gems/net-ssh-5.2.0/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb:55:in `generate_key'
    from /Users/oliver/.rbenv/versions/3.2.2/lib/ruby/gems/3.2.0/gems/net-ssh-5.2.0/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb:31:in `initialize'
oklimberg commented 1 year ago

Hi, i am currently looking into updating the net-ssh and net-sftp dependencies to current versions. I hope this will fix your issue as well.

Can you provide some more information about your setup so I can check if I can include a test as well for this situation?

odrobnik commented 1 year ago

I found that on one Machine I didn't have issues, because it had libressl instead of openssl. I found that if I go to ruby 2.7.8 it doesn't use openSSL 3:

ruby 2.7.8p225 (2023-03-30 revision 1f4d455848) [arm64-darwin22]

This is my gemfile.lock, in this environment it was working fine.:

GEM
  remote: https://rubygems.org/
  specs:
    CFPropertyList (3.0.6)
      rexml
    addressable (2.8.4)
      public_suffix (>= 2.0.2, < 6.0)
    artifactory (3.0.15)
    atomos (0.1.3)
    aws-eventstream (1.2.0)
    aws-partitions (1.784.0)
    aws-sdk-core (3.177.0)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.5)
      jmespath (~> 1, >= 1.6.1)
    aws-sdk-kms (1.70.0)
      aws-sdk-core (~> 3, >= 3.177.0)
      aws-sigv4 (~> 1.1)
    aws-sdk-s3 (1.128.0)
      aws-sdk-core (~> 3, >= 3.177.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.6)
    aws-sigv4 (1.6.0)
      aws-eventstream (~> 1, >= 1.0.2)
    babosa (1.0.4)
    bcrypt_pbkdf (1.1.0)
    claide (1.1.0)
    colored (1.2)
    colored2 (3.1.2)
    commander (4.6.0)
      highline (~> 2.0.0)
    declarative (0.0.20)
    digest-crc (0.6.5)
      rake (>= 12.0.0, < 14.0.0)
    domain_name (0.5.20190701)
      unf (>= 0.0.5, < 1.0.0)
    dotenv (2.8.1)
    ed25519 (1.3.0)
    emoji_regex (3.2.3)
    excon (0.100.0)
    faraday (1.10.3)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
      faraday-httpclient (~> 1.0)
      faraday-multipart (~> 1.0)
      faraday-net_http (~> 1.0)
      faraday-net_http_persistent (~> 1.0)
      faraday-patron (~> 1.0)
      faraday-rack (~> 1.0)
      faraday-retry (~> 1.0)
      ruby2_keywords (>= 0.0.4)
    faraday-cookie_jar (0.0.7)
      faraday (>= 0.8.0)
      http-cookie (~> 1.0.0)
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
    faraday-multipart (1.0.4)
      multipart-post (~> 2)
    faraday-net_http (1.0.1)
    faraday-net_http_persistent (1.2.0)
    faraday-patron (1.0.0)
    faraday-rack (1.0.0)
    faraday-retry (1.0.3)
    faraday_middleware (1.2.0)
      faraday (~> 1.0)
    fastimage (2.2.7)
    fastlane (2.213.0)
      CFPropertyList (>= 2.3, < 4.0.0)
      addressable (>= 2.8, < 3.0.0)
      artifactory (~> 3.0)
      aws-sdk-s3 (~> 1.0)
      babosa (>= 1.0.3, < 2.0.0)
      bundler (>= 1.12.0, < 3.0.0)
      colored
      commander (~> 4.6)
      dotenv (>= 2.1.1, < 3.0.0)
      emoji_regex (>= 0.1, < 4.0)
      excon (>= 0.71.0, < 1.0.0)
      faraday (~> 1.0)
      faraday-cookie_jar (~> 0.0.6)
      faraday_middleware (~> 1.0)
      fastimage (>= 2.1.0, < 3.0.0)
      gh_inspector (>= 1.1.2, < 2.0.0)
      google-apis-androidpublisher_v3 (~> 0.3)
      google-apis-playcustomapp_v1 (~> 0.1)
      google-cloud-storage (~> 1.31)
      highline (~> 2.0)
      json (< 3.0.0)
      jwt (>= 2.1.0, < 3)
      mini_magick (>= 4.9.4, < 5.0.0)
      multipart-post (>= 2.0.0, < 3.0.0)
      naturally (~> 2.2)
      optparse (~> 0.1.1)
      plist (>= 3.1.0, < 4.0.0)
      rubyzip (>= 2.0.0, < 3.0.0)
      security (= 0.1.3)
      simctl (~> 1.6.3)
      terminal-notifier (>= 2.0.0, < 3.0.0)
      terminal-table (>= 1.4.5, < 2.0.0)
      tty-screen (>= 0.6.3, < 1.0.0)
      tty-spinner (>= 0.8.0, < 1.0.0)
      word_wrap (~> 1.0.0)
      xcodeproj (>= 1.13.0, < 2.0.0)
      xcpretty (~> 0.3.0)
      xcpretty-travis-formatter (>= 0.0.3)
    fastlane-plugin-sftp (1.2.0)
      bcrypt_pbkdf (~> 1.0)
      ed25519 (~> 1.2)
      net-sftp (~> 2.1, >= 2.1.2)
      net-ssh (~> 5.1, >= 5.1.0)
    gh_inspector (1.1.3)
    google-apis-androidpublisher_v3 (0.45.0)
      google-apis-core (>= 0.11.0, < 2.a)
    google-apis-core (0.11.0)
      addressable (~> 2.5, >= 2.5.1)
      googleauth (>= 0.16.2, < 2.a)
      httpclient (>= 2.8.1, < 3.a)
      mini_mime (~> 1.0)
      representable (~> 3.0)
      retriable (>= 2.0, < 4.a)
      rexml
      webrick
    google-apis-iamcredentials_v1 (0.17.0)
      google-apis-core (>= 0.11.0, < 2.a)
    google-apis-playcustomapp_v1 (0.13.0)
      google-apis-core (>= 0.11.0, < 2.a)
    google-apis-storage_v1 (0.19.0)
      google-apis-core (>= 0.9.0, < 2.a)
    google-cloud-core (1.6.0)
      google-cloud-env (~> 1.0)
      google-cloud-errors (~> 1.0)
    google-cloud-env (1.6.0)
      faraday (>= 0.17.3, < 3.0)
    google-cloud-errors (1.3.1)
    google-cloud-storage (1.44.0)
      addressable (~> 2.8)
      digest-crc (~> 0.4)
      google-apis-iamcredentials_v1 (~> 0.1)
      google-apis-storage_v1 (~> 0.19.0)
      google-cloud-core (~> 1.6)
      googleauth (>= 0.16.2, < 2.a)
      mini_mime (~> 1.0)
    googleauth (1.6.0)
      faraday (>= 0.17.3, < 3.a)
      jwt (>= 1.4, < 3.0)
      memoist (~> 0.16)
      multi_json (~> 1.11)
      os (>= 0.9, < 2.0)
      signet (>= 0.16, < 2.a)
    highline (2.0.3)
    http-cookie (1.0.5)
      domain_name (~> 0.5)
    httpclient (2.8.3)
    jmespath (1.6.2)
    json (2.6.3)
    jwt (2.7.1)
    kramdown (2.4.0)
      rexml
    memoist (0.16.2)
    mini_magick (4.12.0)
    mini_mime (1.1.2)
    multi_json (1.15.0)
    multipart-post (2.3.0)
    nanaimo (0.3.0)
    naturally (2.2.1)
    net-scp (4.0.0)
      net-ssh (>= 2.6.5, < 8.0.0)
    net-sftp (2.1.2)
      net-ssh (>= 2.6.5)
    net-ssh (5.2.0)
    optparse (0.1.1)
    os (1.1.4)
    plist (3.7.0)
    public_suffix (5.0.1)
    rake (13.0.6)
    representable (3.2.0)
      declarative (< 0.1.0)
      trailblazer-option (>= 0.1.1, < 0.2.0)
      uber (< 0.2.0)
    retriable (3.1.2)
    rexml (3.2.5)
    rouge (2.0.7)
    ruby2_keywords (0.0.5)
    rubyzip (2.3.2)
    security (0.1.3)
    signet (0.17.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
    simctl (1.6.10)
      CFPropertyList
      naturally
    terminal-notifier (2.0.0)
    terminal-table (1.8.0)
      unicode-display_width (~> 1.1, >= 1.1.1)
    trailblazer-option (0.1.2)
    tty-cursor (0.7.1)
    tty-screen (0.8.1)
    tty-spinner (0.9.3)
      tty-cursor (~> 0.7)
    uber (0.1.0)
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.8.2)
    unicode-display_width (1.8.0)
    webrick (1.8.1)
    word_wrap (1.0.0)
    xcodeproj (1.22.0)
      CFPropertyList (>= 2.3.3, < 4.0)
      atomos (~> 0.1.3)
      claide (>= 1.0.2, < 2.0)
      colored2 (~> 3.1)
      nanaimo (~> 0.3.0)
      rexml (~> 3.2.4)
    xcpretty (0.3.0)
      rouge (~> 2.0.7)
    xcpretty-travis-formatter (1.0.1)
      xcpretty (~> 0.2, >= 0.0.7)

PLATFORMS
  ruby

DEPENDENCIES
  bcrypt_pbkdf
  ed25519
  fastlane
  fastlane-plugin-sftp
  kramdown
  net-scp
  net-ssh

BUNDLED WITH
   2.4.15

My conclusion at the moment is that ruby 3 and higher uses OpenSSL 3 and is where the problems will start.

mc-eddi commented 1 year ago

Hello, maybe I can contribute some more information.

1. With the current fastlane-plugin-sftp 1.2.0 the highest version we were able to use was 3.1.4 RUBY needs to be below 3.2 because of fastlane-plugin-sftp uses undefined method `exists?' for File:Class which was removed in ruby 3.2.

2. Connection error after recent security update on target SFTP server We use the login with RSA server_key and server_key_passphrase Since some weeks we also have problems with an updated system (which I guess is based on OpenSSL 3.0) The SFTP server is running the software MOVEit Transfer in Release 2022.1.8. After updating to this version the fastlane plugins throws the following error:

INFO [2023-07-17 13:13:15.56]: Successfully loaded RSA key... INFO [2023-07-17 13:13:15.56]: Using custom port 22... INFO [2023-07-17 13:13:15.56]: Logging in with RSA key... ERROR [2023-07-17 13:13:15.65]: could not verify server signature

or more detailed in the trace: /root/.rbenv/versions/3.1.4/lib/ruby/gems/3.1.0/gems/net-ssh-5.2.0/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb:209:inverify_signature': could not verify server signature (Net::SSH::Exception)`

There were some updates regarding security, e.g. "Host key algorithm is deprecated" https://docs.progress.com/de-DE/bundle/moveit-transfer-release-notes-2022_1/page/Whats-New-in-MOVEit-Transfer.html#d3067e303 Maybe net-ssh 7.1.0 should fix problems. This workaround could help maybe: VALID_OPTIONS << :pubkey_algorithms https://github.com/net-ssh/net-ssh/issues/874#issuecomment-1442459666

3. Help on updating the net-ssh and net-sftp dependencies @oklimberg are you able to estimate when the new release of the fastlane-plugin-sftp would be available to test (maybe as beta version). I would be happy to assist with testing in our environment with the SFTP servers causing the errors.

Best regards Malte

odrobnik commented 3 months ago

@oklimberg This has been an issue for almost a year now. Is there a way for your to fix it?