Use standard SHA256 fingerprints
- Dominant language
- Cython
- Stars
- 79
- Forks
- 47
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 6
Description
Currently, the code in `_load_server_publickey()` in session.pyx makes SHA1 + hex fingerprints. The OpenSSH normally uses SHA256 + base64 these days. They are ugly and longer, but they are default in OpenSSH so needed when one needs to compare them with output from the ssh-keygen.
It should not be breaking change as the fingerprint should be just the user facing information and not a API.
We should probably move this FIXME into an issue on the tracker.
_Originally posted by @webknjaz in https://github.com/ansible/pylibssh/pull/597#discussion_r2023501660_
Contributor guide
Research direction
Start in session.pyx at _load_server_publickey(), where the current SHA1 and hexadecimal fingerprint is generated. Compare the expected result with ssh-keygen output, and consider any existing fingerprint coverage nearby. Done means the user-facing fingerprint uses SHA256 and base64, matching the standard OpenSSH representation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100