[ANN] LibSSH.jl: a Julia wrapper for libssh

Package Announcements
1

Heyo heyo :wave:

So I’ve been working on writing a wrapper for the libssh library recently, and I think it’s ready-ish enough for others to use (if they dare :octopus:).

Source: GitHub - JuliaWeb/LibSSH.jl: A Julia wrapper for libssh.
Docs: https://juliaweb.github.io/LibSSH.jl

TL;DR: this lets you do SSH things programmatically. Here’s a peek of the API:

import LibSSH as ssh

session = ssh.Session("foo.com")
ssh.userauth_password(session, "password")
close(session)

And a bigger example here: Examples · LibSSH

Libssh (the C library) can work in both a blocking and non-blocking mode. LibSSH.jl sets everything to use the non-blocking mode by default and it’s fully compatible with Julia’s event loop, so you can safely call all of the high-level functions without needing to worry about them blocking. The low-level functions are pure wrappers to the C functions and may block or otherwise do strange things (check the excellent libssh docs before using them).

Disclaimer: the package is still young and there may be bugs and missing functionality :upside_down_face: (well ok, there’s definitely lots of missing functionality)
Having said that, the implementation of the SSH protocol itself is entirely delegated to libssh, which is a fairly trusted library, so I’m mildly confident that there’s at least no severe security issues.

2

v0.6.0 has been released, the big change for this one is SFTP support so you can do terrible things to remote files: SFTP · LibSSH

3

v1 has been released: Changelog · LibSSH
The main improvement is thread-safety, it should now be safe to use LibSSH.jl objects without caring about which thread/task is making calls.

4

v1.2.0 has been released, and I strongly recommend that folks update to it because it has some security fixes. See the changelog for details: Changelog · LibSSH

  • If you use LibSSH.jl at all you should update to at least v1.1.0 because that uses the upstream libssh 0.12.1, which has a bunch of security fixes compared to the previous version (0.11).
  • If you were using the SFTP features of LibSSH.jl then you really should update to v1.2.0 because that has some security fixes in LibSSH.jl itself.
5

That’s great! I’ve published the libssh_jll security advisories; you may consider authoring a JLSEC advisory for those SFTP issues in LibSSH.jl itself — let me know if you have any questions about doing so! The main advantage in doing this is that it really helps communicate the issue to people who are using a security scanning tool.