[ Reason ]
OpenSSH 8.8 disables RSA signatures using the SHA-1 hash algorithm, and
that breaks clients that do not support stronger algorithms, which is
the case of the ruby-net-ssh version in bullseye.
[ Impact ]
Users of vagrant and capistrano, for example, are not able to connect
to hosts running OpenSSH 8.8, which includes Debian bookworm but also
other distributions where OpenSSH 8.8. is already available.
[ Tests ]
All the included unit tests, includind the new ones added by the
included patches, pass both during the package build and autopkgtest.
This updates was also tested manually on stable by Lucas Nussbaum (see
#1008541), who confirmed the fix works.
[ Risks ]
I don't see much risk in this update.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
The patches are backports of the relevant upstream patches. The first
adds support for client authentication with RSA + SHA-2. The second adds
support for RSA+SHA-2 in host keys.
[ Other info ]
I'm also attaching the patches themselves, because they are easier to
read than the diff-in-diff in the debdiff.