Add support for OpenSSH certificates, resolve #31 by luigidemasi · Pull Request #901 · mwiede/jsch

luigidemasi · 2025-09-17T16:23:38Z

No description provided.

norrisjeremy

Can you run mvn formatter:format to ensure that everything is formatted correctly?
Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time.

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/Buffer.java

src/main/java/com/jcraft/jsch/JSch.java

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/OpenSshCertificate.java

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

src/main/java/com/jcraft/jsch/OpenSshCertificateBuffer.java

src/main/java/com/jcraft/jsch/OpensshCertificateParser.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/OpenSshCertificateBuffer.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

davsclaus · 2025-09-23T05:21:21Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

norrisjeremy · 2025-09-23T10:08:10Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

None of my earlier feedback appears to have actually been incorporated: the PR author simply marked them all as resolved w/o making any of the suggested changes.
To quote part of my earlier review: "Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time."

luigidemasi · 2025-09-23T10:57:35Z

@norrisjeremy is there more feedback to this, as it would be nice to get to the finish line, thanks

None of my earlier feedback appears to have actually been incorporated: the PR author simply marked them all as resolved w/o making any of the suggested changes.

To quote part of my earlier review: "Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time."

Hi @norrisjeremy, thanks for following up. I marked the comments as resolved on GitHub because I had already addressed them locally and didn’t want to lose track of your suggestions. I’m currently adding support for host keys as well (it’s nearly finished) and I’ll push everything together in the next update. Please let me know if you have any additional suggestions in the meantime.

norrisjeremy · 2025-09-23T11:01:08Z

Hi @norrisjeremy, thanks for following up. I marked the comments as resolved on GitHub because I had already addressed them locally and didn’t want to lose track of your suggestions. I’m currently adding support for host keys as well (it’s nearly finished) and I’ll push everything together in the next update. Please let me know if you have any additional suggestions in the meantime.

Hi @luigidemasi,

Great, thanks! We are excited to have someone step up and contribute this work!

Thanks,
Jeremy

luigidemasi · 2025-09-29T17:35:39Z

@norrisjeremy

Does this support SSH certs for host keys? If not, we need to add support for that too, as I'm opposed to only adding support SSH certs for user pubkey auth, w/o also adding support for SSH certs as host keys as well at the same time.

I added the support for Host Certificate, let me know wdyt.

davsclaus · 2025-10-02T11:28:28Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

norrisjeremy · 2025-10-02T11:42:55Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

I probably won't have time to start reviewing this again until next week.

davsclaus · 2025-10-02T11:51:09Z

Great to see progress on this one. If we are getting close to the finish line it would be good to do the last review and update the reported findings so fingers crossed we can get this merged and released. Thank you.

I probably won't have time to start reviewing this again until next week.

Thanks for the update, no problem. Just glad we are on path to the goal line.

davsclaus · 2025-10-14T12:38:49Z

Sorry to bother - but would be good to get this reviewed

norrisjeremy · 2025-10-14T20:05:55Z

Sorry to bother - but would be good to get this reviewed

HI @davsclaus,

Yes, I haven't forgotten, I will try to review it when I have some time available.

Thanks,
Jeremy

norrisjeremy

Just a few initial comments, I still have a lot left to review.

src/main/java/com/jcraft/jsch/Buffer.java

src/main/java/com/jcraft/jsch/KeyExchange.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/UserAuthPublicKey.java

src/test/java/com/jcraft/jsch/HostCertificateIT.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/OpenSshCertificateHostKeyVerifier.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/SignatureWrapper.java

… code review

… Host Certificate

… code review for Host Certificate support

… code review for Host Certificate support - part2

… code review for Host Certificate support - part3

norrisjeremy

Thank you for all your effort and patience working on this PR!
I think we're getting very close, just a few minor items left I think.

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/Session.java

src/test/java/com/jcraft/jsch/HostCertificateIT.java

src/test/java/com/jcraft/jsch/HostCertificateAsyncSshIT.java

src/test/java/com/jcraft/jsch/UserCertAuthAsyncSshIT.java

src/test/java/com/jcraft/jsch/HostCertificateAsyncSshIT.java

src/test/java/com/jcraft/jsch/UserCertAuthAsyncSshIT.java

norrisjeremy

Thank you for all your hard work & patience working on this.
I believe that I see only one minor item left to address.

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/OpenSshCertificateHostKeyVerifier.java

norrisjeremy

Hmm, the latest changes seem to have introduced some unit test failures in the host certificate ITs, can you investigate?

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/OpenSshCertificateHostKeyVerifier.java

src/test/java/com/jcraft/jsch/HostCertificateEd448IT.java

src/main/java/com/jcraft/jsch/Session.java

src/main/java/com/jcraft/jsch/OpenSshCertificateUtil.java

src/main/java/com/jcraft/jsch/Session.java

norrisjeremy · 2026-03-10T19:00:02Z

Looks like we need to run mvn formatter:format?

… code review for Host Certificate support - part4

sonarqubecloud · 2026-03-10T19:11:03Z

Quality Gate passed

Issues
245 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

norrisjeremy suggested changes Sep 17, 2025

View reviewed changes

norrisjeremy reviewed Sep 17, 2025

View reviewed changes

norrisjeremy reviewed Sep 18, 2025

View reviewed changes