Support net-ssh 8

.github/workflows/ci.yml

@@ -58,6 +58,9 @@ jobs:
         exclude:
           - ruby-version: "3.2"
             gemfile: gemfiles/rails_edge.gemfile
+        include:
+          - ruby-version: "3.4"
+            gemfile: gemfiles/net_ssh_7.gemfile
     name: ${{ format('Tests (Ruby {0})', matrix.ruby-version) }}
     runs-on: ubuntu-latest
     env:

Gemfile.lock

@@ -8,7 +8,9 @@ PATH
       concurrent-ruby (~> 1.2)
       dotenv (~> 3.1)
       ed25519 (~> 1.4)
-      net-ssh (~> 7.3)
+      net-scp (>= 4.1, < 5.0)
+      net-sftp (>= 4.0, < 5.0)
+      net-ssh (>= 7.3, < 9.0)
       sshkit (>= 1.23.0, < 2.0)
       thor (~> 1.3)
       zeitwerk (>= 2.6.18, < 3.0)
@@ -79,11 +81,13 @@ GEM
     minitest (5.27.0)
     mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
-    net-scp (4.1.0)
-      net-ssh (>= 2.6.5, < 8.0.0)
-    net-sftp (4.0.0)
-      net-ssh (>= 5.0.0, < 8.0.0)
-    net-ssh (7.3.3)
+    net-scp (4.1.1)
+      net-ssh (>= 2.6.5, < 9.0.0)
+    net-sftp (4.0.1)
+      net-ssh (>= 5.0.0, < 9.0.0)
+    net-ssh (8.0.2)
+      logger
+      openssl (>= 3.2.0)
     nokogiri (1.19.4-aarch64-linux-musl)
       racc (~> 1.4)
     nokogiri (1.19.4-arm64-darwin)
@@ -94,6 +98,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-linux-musl)
       racc (~> 1.4)
+    openssl (4.0.2)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)

gemfiles/net_ssh_7.gemfile

@@ -0,0 +1,7 @@
+# Kamal still supports net-ssh 7, and only this Gemfile exercises its code paths
+source "https://rubygems.org"
+git_source(:github) { |repo| "https://github.com/#{repo}.git" }
+
+gem "net-ssh", "~> 7.3"
+
+gemspec path: "../"

kamal.gemspec

@@ -13,11 +13,14 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "activesupport", ">= 7.0"
   spec.add_dependency "sshkit", ">= 1.23.0", "< 2.0"
-  spec.add_dependency "net-ssh", "~> 7.3"
+  spec.add_dependency "net-ssh", ">= 7.3", "< 9.0"
+  # Floors, so Bundler can't satisfy net-ssh 8 by downgrading these to ancient releases without an upper bound
+  spec.add_dependency "net-scp", ">= 4.1", "< 5.0"
+  spec.add_dependency "net-sftp", ">= 4.0", "< 5.0"
   spec.add_dependency "thor", "~> 1.3"
   spec.add_dependency "dotenv", "~> 3.1"
   spec.add_dependency "zeitwerk", ">= 2.6.18", "< 3.0"
-  spec.add_dependency "ed25519", "~> 1.4"
+  spec.add_dependency "ed25519", "~> 1.4" # Only needed by net-ssh 7, drop with the net-ssh < 8 support
   spec.add_dependency "bcrypt_pbkdf", "~> 1.0"
   spec.add_dependency "concurrent-ruby", "~> 1.2"
   spec.add_dependency "base64", "~> 0.2"

lib/kamal/sshkit_with_ext.rb

@@ -209,13 +209,13 @@ def execute
   prepend CompleteAll
 end
 
-# Avoid net-ssh debug, until https://github.com/net-ssh/net-ssh/pull/953 is merged
 module NetSshForwardingNoPuts
   def puts(*)
   end
 end
 
-Net::SSH::Service::Forward.prepend NetSshForwardingNoPuts
+# net-ssh 7 prints remote forwarding diagnostics to stdout, fixed in 8 by net-ssh/net-ssh#953
+Net::SSH::Service::Forward.prepend NetSshForwardingNoPuts if Net::SSH::Version::MAJOR < 8
 
 module SSHKitDslRoles
   # Execute on hosts grouped by role.