pylibssh: Python bindings to client functionality of libssh specific to Ansible use case

Nightlies @ Dumb PyPI @ GitHub Pages

We publish nightlies on tags and pushes to devel. They are hosted on a GitHub Pages based index generated by dumb-pypi.

The web view is @ .

$ pip install \
    --extra-index-url=https://ansible.github.io/pylibssh/simple/ \
    --pre \
    ansible-pylibssh

Requirements

You need Python 3.6+

pylibssh requires libssh to be installed in particular:

• libssh version 0.9.0 and later.

  To install libssh refer to its Downloads page.

Building the module

In the local env, assumes there's a libssh shared library on the system, build toolchain is present and env vars are set properly:

$ git clone https://github.com/ansible/pylibssh.git
$ cd pylibssh
$ pip install tox
$ tox -e build-dists

manylinux-compatible wheels:

$ git clone https://github.com/ansible/pylibssh.git
$ cd pylibssh
$ pip install tox
$ tox -e build-dists-manylinux1-x86_64  # with Docker

# or with Podman
$ DOCKER_EXECUTABLE=podman tox -e build-dists-manylinux1-x86_64

# to enable shell script debug mode use
$ tox -e build-dists-manylinux1-x86_64 -- -e DEBUG=1

License

This library is distributed under the terms of LGPL 2 or higher, see file LICENSE.rst in this repository.

Changelog

v1.2.2

(2024-06-27)

Bug fixes

• Downloading files larger than 64kB over SCP no longer fails -- by @Jakuje.

  Related issues and pull requests on GitHub: #621.

---

v1.2.1

(2024-06-27)

Bug fixes

• Downloading non-existent remote files via SCP no longer crashes the program -- by @Jakuje.

  Related issues and pull requests on GitHub: #208, #325, #620.

Packaging updates and notes for downstreams

• The RPM specification now opts out of demanding that the compiled C-extensions have a Build ID present under EL -- by @webknjaz.

  Related commits on GitHub: 9053c1008bb169c8e362a92782d46c7c0d3b1c06, aaa12159b5cdda763a83dcf4ee920510cad83463.

• The RPM specification has been updated to pre-build the vendored copy of setuptools-scm with the isolation disabled, addressing the build problem in EL 9 -- by @webknjaz.

  Related commits on GitHub: dd85ddefafde8f22ab0239add18a1db9ef789b50.

• The RPM definition now runs import self-checks when it is built for Fedora Linux -- by @webknjaz.

  Related issues and pull requests on GitHub: #615.

Contributor-facing changes

• RPM builds are now also tested against UBI 9.4 in CI -- by @webknjaz.

  Related commits on GitHub: e9ad0a7d456c99cc848b30b48569235366273672.

---

v1.2.0.post4

(2024-06-09)

Packaging updates and notes for downstreams

• Substituting the gh role in source distribution long description has been simplify to stop attempting to make URLs to arbitrary GitHub addresses -- by @webknjaz.

  Related commits on GitHub: f4ad1b76.

• The in-tree PEP 517 build backend's regular expression has been hotfixed to replace the "project" substitution correctly -- by @webknjaz.

  Previously, it was generating a lot of noise instead of a nice description. But not anymore.

  Related issues and pull requests on GitHub: #92752210.

---

v1.2.0.post2

(2024-06-08)

Packaging updates and notes for downstreams

• The automation now replaces the "project" RST substitution in the long description and GitHub Discussions/Releases -- by @webknjaz.

  Related commits on GitHub: 13374a71.

• The CI/CD automation has been fixed to include changelog updates into source distribution tarballs -- by @webknjaz.

  Related commits on GitHub: 627f718d.

---

v1.2.0

(2024-06-07)

Bug fixes

• ansible-pylibssh no longer crashes when received EOF or when channel is not explicitly closed -- by @pbrezina.

  Previously, ansible-pylibssh crashed if channel.recv was called and libssh returned SSH_EOF error. It also crashed on some special occasions where channel was not explicitly closed and the session object was garbage-collected first.

  Related issues and pull requests on GitHub: #576.

Features

• Started exposing the SSH_OPTIONS_PUBLICKEY_ACCEPTED_TYPES and SSH_OPTIONS_HOSTKEYS options publicly -- by @Qalthos.

  Related issues and pull requests on GitHub: #527.

• The request_exec() method was added to the Channel class. It exposes an interface for calling the respective low-level C-API of the underlying libssh library -- by @pbrezina.

  Additionally, the following calls to libssh are now available in the same class: request_exec(), send_eof(), request_send_signal() and is_eof which is exposed as a property.

  Related issues and pull requests on GitHub: #576.

Improved documentation

• Fixed spelling of "Connect" in the Session.connect() docstring -- by @donnerhacke.

  Related issues and pull requests on GitHub: #474.

• Added a tip to the installation guide on how to set compiler flags when installing from source -- @webknjaz.

  Related issues and pull requests on GitHub: #499.

• Fixed the example of invoking remote commands by using Channel.exec_command() in snippets -- by @pbrezina.

  Its previously showcased version wasn't functional.

  Related issues and pull requests on GitHub: #576.

Packaging updates and notes for downstreams

• A flaw in the logic for copying the project directory into a temporary folder that led to infinite recursion when TMPDIR was set to a project subdirectory path. This was happening in Fedora and its downstream due to the use of pyproject-rpm-macros. It was only reproducible with pip wheel and was not affecting the pyproject-build users.

  -- by @hroncok and @webknjaz

  Related commits on GitHub: 89c9b3a.

• From now on, the published distribution package artifacts for the new releases are signed via Sigstore -- by @webknjaz.

  This is happening as a part of the GitHub Actions CI/CD workflow automation and the signatures are uploaded to the corresponding GitHub Release pages.

  Related commits on GitHub: 986988a.

• The platform-specific macOS wheels are now built using the Python interpreter from . They are tagged with macosx_10_9 -- by @webknjaz.

  Related issues and pull requests on GitHub: #333.

• The toml build time dependency has been replaced with tomli -- by @webknjaz.

  The tomli distribution is only pulled in under Python versions below 3.11. On 3.11 and higher, the standard library module tomllib is now used instead.

  Related issues and pull requests on GitHub: #501.

• Started using the built-in setuptools-scm Git archive support under Python 3.7 and higher -- @webknjaz.

  Related issues and pull requests on GitHub: #502.

• Added support for Python 3.12 -- by @Qalthos.

  It is now both tested in the CI and is advertised through the Trove classifiers.

  Related issues and pull requests on GitHub: #532.

• The Cython build time dependency now has the minimum version of 3.0 under Python 3.12 and higher -- by @webknjaz.

  The previous versions of Cython are still able to build the project under older Python versions.

  Related issues and pull requests on GitHub: #540.

• PEP 660 is now enabled -- @webknjaz.

  Previously, due to restrictive PEP 517 hook reimports, our in-tree build backend was losing non-PEP 517 hooks implemented in newer versions of setuptools but not the earlier ones. This is now addressed by reexporting everything that setuptools exposes with a wildcard.

  Related issues and pull requests on GitHub: #541.

• The setuptools-scm build dependency CI pin was updated to 8.1.0 — this version fixes a date parsing incompatibility introduced by Git 2.45.0 (GitHub: pypa/setuptools_scm#1038, GitHub: pypa/setuptools_scm#1039) -- by @webknjaz.

  Related issues and pull requests on GitHub: #601.

Contributor-facing changes

• The changelog page for the tagged release builds on Read The Docs does not attempt showing the draft section anymore -- by @webknjaz.

  Related commits on GitHub: 852d259.

• Adjusted the publishing workflow automation to pre-configure Git before attempting to create a tag when building a source distribution -- by @webknjaz.

  Related commits on GitHub: f07296f.

• The CI configuration for building the macOS platform-specific wheels switched to using cibuildwheel -- by @webknjaz.

  Related issues and pull requests on GitHub: #333.

• The OS-level tox package was upgraded to v3.28.0 in the UBI9 CI runtime -- by @Qalthos.

  Related issues and pull requests on GitHub: #461, #473.

• Fixed spelling of "Connect" in the Session.connect() docstring -- by @donnerhacke.

  Related issues and pull requests on GitHub: #474.

• The Packit CI access to the internet has been restored -- by @Qalthos.

  Related issues and pull requests on GitHub: #507.

• Started building manylinux_2_28 base images for testing and packaging in the CI/CD infrastructure -- by @Qalthos.

  Related issues and pull requests on GitHub: #533.

• Switched back to using Cython's native plugin for measuring code coverage -- by @webknjaz.

  Related issues and pull requests on GitHub: #538.

• Added separate changelog fragment types for contributor-and downstream-facing patches -- by @webknjaz.

  Their corresponding identifiers are contrib and packaging respectively. They are meant to be used for more accurate classification, where one would resort to using misc otherwise.

  Related issues and pull requests on GitHub: #539.

• PEP 660 is now enabled -- @webknjaz.

  This effectively means that the ecosystem-native editable install mode started working properly.

  Related issues and pull requests on GitHub: #541.

• The duplicated jobs matrices for building manylinux wheels now reside in a single GitHub Actions CI/CD reusable workflow definition.

  -- @webknjaz

  Related issues and pull requests on GitHub: #559.

• The duplicated jobs matrices of the text jobs now reside in a single GitHub Actions CI/CD reusable workflow definition.

  -- @webknjaz

  Related issues and pull requests on GitHub: #560.

• Fixed the location of release workflow in the Release Guide document -- by @Qalthos.

  Related issues and pull requests on GitHub: #565.

• The setuptools-scm build dependency CI pin was updated to 8.1.0 — this version fixes a date parsing incompatibility introduced by Git 2.45.0 (GitHub: pypa/setuptools_scm#1039, GitHub: pypa/setuptools_scm#1038) -- by @webknjaz.

  Related issues and pull requests on GitHub: #601.

• The CI/CD configuration was fixed to allow publishing to PyPI and other targets disregarding the test stage outcome. This used to be a bug in the workflow definition that has now been fixed.

  -- by @pbrezina and @webknjaz

  Related issues and pull requests on GitHub: #602.

---

v1.1.0 (2022-12-05)

Features

• Started building manylinux wheels with libssh v0.9.6 -- by @webknjaz (#441)

Deprecations (removal in next major release)

• The project stopped being tested under Ubuntu 18.04 VM since GitHub is sunetting their CI images -- by @webknjaz (#379)

Documentation

• Added a Release Guide for making new releases -- by @webknjaz (#413)

Miscellaneous

• Started testing RPM packaging spec with Packit service -- by @webknjaz and @TomasTomecek (#227, #246)

• Removed the remains of Python 2 compatiblity code from the in-tree PEP 517 build backend -- by @webknjaz (#377)

• Fixed removing expandvars from pyproject.toml in an RPM spec -- by @webknjaz

  Before this patch, the sed invocation removed entire build-system.requires entry from there, in rare cases but this won't be happening anymore. (#378)

• Declared official support of CPython 3.11 -- by @Qalthos (#396)

• Started shipping sdists built with Cython v0.29.32 -- by @webknjaz (#399)

• Started building RPMs with Cython v0.29.32 -- by @webknjaz (#402)

• Added an SSH connection re-try helper to tests -- by @webknjaz (#405)

v1.0.0 (2022-09-14)

Features

• Added password_prompt argument to connect() to override the default prompt of "password:" when using keyboard-interactive authentication -- by @Qalthos (#331)
• Added support for :fd: socket option -- by @sabedevops (#343)

Miscellaneous

• Reworked build scripts to fix manylinux container generation -- by @Qalthos (#321)
• Reenable CI building on s390x -- by @Qalthos (#322)

v0.4.0 (2022-04-26)

Bugfixes

• Improved channel.exec_command to always use a newly created ssh_channel to avoid segfaults on repeated calls -- by @Qalthos (#280)
• Fixed password prompt match in pylibsshext.session.Session.authenticate_interactive() to strip whitespace, check that the prompt only ends with password:, and added a little extra logging -- by @dalrrard (#311)

Backward incompatible changes

• Dropped support for Python 2.7 and 3.5, and marked support for 3.10 -- by @Qalthos (#314)

v0.3.0 (2021-11-03)

Bugfixes

• Changed sftp.sftp_get to write files as bytes rather than assuming files are valid UTF8 -- by @Qalthos (#216)

Features

• Started building platform-specific manylinux2010, manylinux2014 and manylinux_2_24 wheels for AARCH64, ppc64le and s390x architectures as introduced by PEP 599 and PEP 600 -- @webknjaz (#187)
• Added gssapi-with-mic support for authentication -- by @Qalthos (#195)

Documentation

• Correct a link to the pip upgrade doc in our installation guide -- @webknjaz (#225)

Miscellaneous

• Started building AARCH64 base images with Buildah+Podman in GitHub Actions CI/CD -- @webknjaz (#181)
• Switched using pep517 lib to build CLI -- @webknjaz (#199)
• Restructured the in-tree PEP 517 build backend into multiple submodules moving the entry-point to pep517_backend.hooks that also facilitates extraction of user-defined config_settings passed by the end-user (packager) via the build CLI command -- @webknjaz (#200)
• Updated manylinux build script to build libssh with GSSAPI enabled -- @Qalthos (#203)
• Added an initial RPM spec continuously tested in the CI -- @webknjaz (#205)
• Added additional details when SFTP write errors are raised -- by @Qalthos (#216)
• Made auditwheel only keep one platform tag in the produced wheel names -- @webknjaz (#224)
• Improved manylinux build scripts to expect dual-aliased manylinux tags produced for versions 1/2010/2014 along with their PEP 600 counterparts after auditwheel repair -- @webknjaz (#226)
• Enabled self-test checks in the RPM spec for Fedora -- @webknjaz (#228)
• Enabled self-test checks in the RPM spec for CentOS -- @webknjaz (#235)
• Enabled self-test checks in the RPM spec for RHEL -- @webknjaz (#236)
• Added NAME = "VALUE" to flake8-eradicate whitelist to work around test false positive introduced in flake8-eradicate 1.1.0 -- by @Qalthos (#258)
• Stopped testing pylibssh binary wheels under Ubuntu 16.04 in GitHub Actions CI/CD because it is EOL now -- @webknjaz (#260)
• Fixed failing fast on problems with rpmbuild in GitHub Actions CI/CD under Fedora -- @webknjaz (#261)
• Declare python3-pip a build dependency under Fedora fixing the RPM creation job in GitHub Actions CI/CD under Fedora -- @webknjaz (#262)
• Replaced git protocols in pre-commit config with https now that GitHub has turned off git protocol access -- @Qalthos (#266)

v0.2.0 (2021-03-01)

Bugfixes

• Fixed undefined symbol: ssh_disconnect and related issues when building on certain distros -- by @Qalthos (#63, #153, #158)
• Fixed "Negative size passed to PyBytes_FromStringAndSize" when ssh_channel_read_nonblocking fails -- by @Qalthos (#168)

Features

• Added SCP support -- by @Qalthos (#151, #157)

Documentation

• Added the initial user guide to docs -- by @ganeshrn and @webknjaz (#141)
• Added the initial testing guide to docs -- by @ganeshrn and @webknjaz (#142)
• Added the initial installation guide to docs -- by @ganeshrn and @webknjaz (#145)

Miscellaneous

• Migrated the "draft changelog" plugin to the external sphinxcontrib-towncrier implementation -- by @webknjaz (#123)
• Declared official support of CPython 3.9 -- by @webknjaz (#152)

v0.1.0 (2020-08-12)

Bugfixes

• Enhanced sftp error handling code to match with libssh error messages -- by @ganeshrn (#27)
• Fixed session timeout issue, the data type of timeout is expected by ssh_options_set is of type long int -- by @ganeshrn (#46)
• Fixed sftp file get issue. On py2 The file write() method returns None on py2 if bytes are written to file successfully, whereas on py3 it returns total number of bytes written to file. Added a fix to check for the number of bytes written only in the case when write() does not return None -- by @ganeshrn (#58)
• Fixed double close issue, added logic to free the channel allocated memory within __dealloc__() -- by @ganeshrn (#113)

Features

• Added cython extension for libssh client API's initial commit -- by @ganeshrn (#1)
• Added proxycommand support for session and update session exeception to LibsshSessionException -- by @ganeshrn (#10)
• Added support for host key checking with authentication -- by @ganeshrn (#15)
• Changed pylibssh dir to pylibsshext to avoid ns collision -- by @ganeshrn (#25)
• Added sftp get functionality to fetch file from remote host -- by @amolkahat (#26)
• Added support to receive bulk response for remote shell -- by @ganeshrn (#40)
• Added the support for keyboard-authentication method -- by @Qalthos (#105)

Backward incompatible changes

• Updated the package name to ansible-pylibssh to reflect that the library only intends to implement a set of APIs that are necessary to implement an Ansible connection plugin -- by @ganeshrn (#1)

Documentation

• Documented how to compose Towncrier news fragments -- by @webknjaz (#124)
• Documented how to contribute to the docs -- by @webknjaz (#126)

Miscellaneous

• Updated requirements file to replace requirements.txt with requirements-build.in -- by @akasurde (#14)

• Made tox's main env pick up the in-tree PEP 517 build backend -- by @webknjaz (#72)

• Refactored sphinx RST parsing in towncrier extension -- by @ewjoachim (#119)

• Hotfixed the directive in the in-tree sphinx extension to always trigger the changelog document rebuilds so that it'd pick up any changelog fragments from disk -- by @webknjaz (#120)

• Turned the Townrier fragments README doc title into subtitle -- by @webknjaz

  The effect is that it doesn't show up in the side bar as an individual item anymore. (#125)

• Integrated Markdown support into docs via the MyST parser -- by @webknjaz (#126)

• Switched the builder on Read the Docs to dirhtml so it now generates a dir-based URL layout for the website -- by @webknjaz (#127)

• Enabled sphinx.ext.autosectionlabel Sphinx extension to automatically generate reference targets for document sections that can be linked against using :ref: -- by @webknjaz (#128)