Fix encrypted private keys in async SFTP hook - #70858
Conversation
The documented connection extra was ignored, causing authentication failures when encrypted private keys were used through asynchronous SFTP connections.
potiuk
left a comment
There was a problem hiding this comment.
Nice catch — ("passphrase" or "private_key_passphrase") in extra_options collapses to "passphrase" in extra_options before the membership test runs, so the documented private_key_passphrase extra was silently ignored and encrypted keys configured that way could not be imported.
Good call matching SSHHook._parse_extras, which already handles this exactly the same way (providers/ssh/.../ssh.py:613-615) — same precedence, same empty-string fallback. Reusing the proven shape rather than inventing a new one is the right move.
I checked that switching the fixture to private_key_passphrase doesn't drop coverage of the legacy key — it's still exercised in several other fixtures in that file.
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
|
Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions. |
The async SFTP hook only read the legacy
passphraseconnection extra because its condition always evaluated to that key. As a result, encrypted private keys configured with the documentedprivate_key_passphraseextra could not be imported.This accepts the documented extra while preserving the existing
passphrasebehavior and precedence, matching the async SSH hook. The regression test verifies that the configured passphrase is passed when importing a private key.Was generative AI tooling used to co-author this PR?