Merge branch 'master' into patch-2

Author: github-pawo

.github/labeler.yml

@@ -0,0 +1,25 @@
+dependencies:
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'build.gradle'
+      - 'build-publishing.gradle'
+      - 'settings.gradle'
+      - 'gradle/**'
+      - 'mise.toml'
+      - 'gradlew'
+      - 'gradlew.bat'
+
+infrastructure:
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.github/**'
+
+documentation:
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'README.adoc'
+      - 'CONTRIBUTORS'
+      - 'NOTICE'
+      - 'LICENSE'
+      - 'LICENSE_HEADER'
+      - 'examples/**'

.github/release-drafter.yml

@@ -0,0 +1,60 @@
+name-template: 'SSHJ $RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+categories:
+  - title: '🔒 Security'
+    labels:
+      - 'security'
+  - title: '🐛 Bug Fixes'
+    labels:
+      - 'bug'
+      - 'fix'
+  - title: '✨ New Features'
+    labels:
+      - 'enhancement'
+      - 'feature'
+  - title: '📦 Dependency Updates'
+    labels:
+      - 'dependencies'
+      - 'dependency-upgrade'
+  - title: '🔨 Improvements'
+    labels:
+      - 'improvement'
+      - 'refactoring'
+      - 'cleanup'
+  - title: '📝 Documentation'
+    labels:
+      - 'documentation'
+  - title: '🏗️ Infrastructure'
+    labels:
+      - 'ci'
+      - 'build'
+      - 'infrastructure'
+
+change-template: '* $TITLE (#$NUMBER) @$AUTHOR'
+change-title-escapes: '\<*_&'
+
+version-resolver:
+  major:
+    labels:
+      - 'major'
+  minor:
+    labels:
+      - 'minor'
+      - 'enhancement'
+      - 'feature'
+  patch:
+    labels:
+      - 'patch'
+      - 'bug'
+      - 'fix'
+      - 'security'
+      - 'dependencies'
+  default: minor
+
+template: |
+  ## Changes
+
+  $CHANGES
+
+  **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION

.github/workflows/labeler.yml

@@ -0,0 +1,46 @@
+name: Labeler
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label-by-files:
+    name: Label by changed files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: false
+
+  label-by-title:
+    name: Label by PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const title = context.payload.pull_request.title.toLowerCase();
+
+            const rules = [
+              { label: 'security',     re: /\b(cve|security|vulnerability|exploit|terrapin)\b/ },
+              { label: 'bug',          re: /\b(fix(es|ed|ing)?|bug|regression|broken|crash)\b/ },
+              { label: 'enhancement',  re: /\b(add(s|ed|ing)?|support(s|ed|ing)?|implement(s|ed)?|feature)\b/ },
+              { label: 'dependencies', re: /\b(upgrad(e|es|ed|ing)|bump(s|ed)?|depend(ency|encies))\b/ },
+              { label: 'improvement',  re: /\b(refactor(ed|ing)?|clean(up)?|improv(e|es|ed|ing)|remov(e|es|ed|ing)|replac(e|es|ed|ing))\b/ },
+            ];
+
+            const toAdd = rules.filter(r => r.re.test(title)).map(r => r.label);
+            if (toAdd.length === 0) return;
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: toAdd,
+            });

.github/workflows/release-drafter.yml

@@ -0,0 +1,20 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update_release_draft:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -47,3 +47,10 @@ jobs:
           ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNINGPASSWORD }}
           ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USERNAME }}
           ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_PASSWORD }}
+      - name: Publish GitHub Release
+        uses: release-drafter/release-drafter@v6
+        with:
+          publish: true
+          tag: ${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.adoc

@@ -57,6 +57,7 @@ In the `examples` directory, there is a separate Maven project that shows how th
 
 * reading known_hosts files for host key verification
 * publickey, password and keyboard-interactive authentication
+* FIDO/U2F security keys (`sk-ecdsa-sha2-nistp256@openssh.com`, `sk-ssh-ed25519@openssh.com`) via a pluggable `SecurityKeySigner`
 * SSH agent authentication over the `SSH_AUTH_SOCK` unix-domain socket (RSA, ECDSA, Ed25519, and FIDO/U2F security keys)
 +
 NOTE: The built-in unix-domain socket transport requires a Java 16+ runtime. On older runtimes, supply your own `AgentConnection` implementation.
@@ -82,7 +83,8 @@ key exchange::
   `diffie-hellman-group16-sha256`, `diffie-hellman-group16-sha384@ssh.com`, `diffie-hellman-group16-sha512@ssh.com`, `diffie-hellman-group18-sha512@ssh.com`
 
 signatures::
-  `ssh-rsa`, `ssh-dss`, `ecdsa-sha2-nistp256`, `ecdsa-sha2-nistp384`, `ecdsa-sha2-nistp521`, `ssh-ed25519`, `ssh-rsa2-256`, `ssh-rsa2-512`
+  `ssh-rsa`, `ssh-dss`, `ecdsa-sha2-nistp256`, `ecdsa-sha2-nistp384`, `ecdsa-sha2-nistp521`, `ssh-ed25519`, `ssh-rsa2-256`, `ssh-rsa2-512`,
+  `sk-ecdsa-sha2-nistp256@openssh.com`, `sk-ssh-ed25519@openssh.com` (FIDO/U2F security keys)
 
 mac::
   `hmac-md5`, `hmac-md5-96`, `hmac-sha1`, `hmac-sha1-96`, `hmac-sha2-256`, `hmac-sha2-512`, `hmac-ripemd160`, `hmac-ripemd160@openssh.com`
@@ -92,7 +94,7 @@ compression::
   `zlib` and `zlib@openssh.com` (delayed zlib)
 
 private key files::
-   `pkcs5`, `pkcs8`, `openssh-key-v1`, `ssh-rsa-cert-v01@openssh.com`, `ssh-dsa-cert-v01@openssh.com`
+   `pkcs5`, `pkcs8`, `openssh-key-v1` (including FIDO/U2F `sk-ecdsa-sha2-nistp256@openssh.com` and `sk-ssh-ed25519@openssh.com` keys), `ssh-rsa-cert-v01@openssh.com`, `ssh-dsa-cert-v01@openssh.com`
 
 If you need something that is not included, it shouldn't be too hard to add (do contribute it!)
 
@@ -113,6 +115,10 @@ Issue tracker: https://github.com/hierynomus/sshj/issues
 Fork away!
 
 == Release history
+Starting from version 0.40.0, release notes are published as https://github.com/hierynomus/sshj/releases[GitHub Releases].
+
+The history below covers releases up to and including 0.39.0.
+
 SSHJ 0.39.0 (2024-02-20)::
 * Upgraded dependencies
 * Remove hard dependencies on BouncyCastle, making it optional.

src/main/java/com/hierynomus/sshj/key/KeyAlgorithms.java

@@ -16,6 +16,8 @@
 package com.hierynomus.sshj.key;
 
 import com.hierynomus.sshj.signature.SignatureEdDSA;
+import com.hierynomus.sshj.signature.SignatureSkEcdsa;
+import com.hierynomus.sshj.signature.SignatureSkEd25519;
 import net.schmizz.sshj.common.KeyType;
 import net.schmizz.sshj.signature.Signature;
 import net.schmizz.sshj.signature.SignatureDSA;
@@ -38,6 +40,8 @@ public class KeyAlgorithms {
     public static Factory ECDSASHANistp521CertV01() { return new Factory(KeyType.ECDSA521_CERT.toString(), new SignatureECDSA.Factory521(), KeyType.ECDSA521_CERT); }
     public static Factory EdDSA25519() { return new Factory(KeyType.ED25519.toString(), new SignatureEdDSA.Factory(), KeyType.ED25519); }
     public static Factory EdDSA25519CertV01() { return new Factory(KeyType.ED25519_CERT.toString(), new SignatureEdDSA.Factory(), KeyType.ED25519_CERT); }
+    public static Factory SkSSHEd25519() { return new Factory(KeyType.SK_ED25519.toString(), new SignatureSkEd25519.Factory(), KeyType.SK_ED25519); }
+    public static Factory SkECDSANistp256() { return new Factory(KeyType.SK_ECDSA.toString(), new SignatureSkEcdsa.Factory(), KeyType.SK_ECDSA); }
 
     public static class Factory implements net.schmizz.sshj.common.Factory.Named<KeyAlgorithm> {