Version 0.005 - Official CPAN release

0.005 2026-10-21T19:27:03Z
 [A failed connect adds the "host key checking is on: add the host to known_hosts ... or opt out" hint only when the error is a host key refusal; a refused or unreachable port (a host still rebooting) carries no host key hint.]
 [Rex::Interface::File::LibSSH reports failure. open returns false when the exec request fails or, reading, when cat exits non-zero, so a missing file does not read as an empty one; write dies on a failed write; close dies when the remote cat exited non-zero, so a write into a missing directory or onto a full disk is not reported as changed.]
 [Rex::Interface::Fs::LibSSH::glob returns an empty list when a pattern matches nothing; file names are not split at whitespace and a blank in the pattern stays part of one word.]
SHA256 hash of CPAN release

bb097ffdc291b5032462cd99944ddf920d9d98fc7bbbfc3de2cbd86534251acc *Rex-LibSSH-0.005.tar.gz

Version 0.004 - Official CPAN release

0.004 2026-09-20T18:54:48Z
 [SECURITY: the server host key is now verified against known_hosts by default (CWE-322, reported privately via CPANSec). Previously Rex::Interface::Connection::LibSSH hardcoded strict_hostkeycheck => 0 and ignored the strict_hostkeycheck/knownhosts connect options, so the documented opt-in never did anything and any server -- including a man-in-the-middle -- was accepted. An unknown or changed key now fails the connection before authentication. Opt out per connection with strict_hostkeycheck => 0, or Rexfile-wide with -feature => ['disable_strict_host_key_checking'] (the same flag the OpenSSH backend honours); knownhosts => $file and Rex::Config->set_openssh_opt(UserKnownHostsFile => $file) select the file. Hosts that were never added to known_hosts (fresh Hetzner installs) must be ssh-keyscan'ed first or use the opt-out]
 [Requires Net::LibSSH 0.004, whose connect() performs the check]
SHA256 hash of CPAN release

e9b3f511b16a6293a435abd857fa5426497f2427e0a09a8ae64bc417b4112fec *Rex-LibSSH-0.004.tar.gz

Version 0.003 - Official CPAN release

0.003 2026-09-01T00:07:32Z
 [exec() now matches the 3-arg signature Rex::Commands::Run invokes ($cmd, $path, $option), so env hashes and shell options actually reach the SSH channel.]
 [Reject paths containing NUL bytes in _q() and shell metacharacters in glob() patterns; the latter closes an injection vector through the remote shell expansion step that other paths avoid by being quoted.]
 [Add t/04-no-sftp.t and t/lib/TestSSHDNoSFTP.pm to prove every Fs/File operation works against an sshd without a Subsystem sftp line — the environment this distribution was built for.]
 [Document that Fs::LibSSH never routes through Rex::Interface::Fs::Sudo (known limitation, not a bug) and that upload/download/read-mode open hold the whole file in memory on both ends.]
SHA256 hash of CPAN release

12cb37f3f20630917be9d3cbc08c69874def88f1de718984c4e7ce324c6f3945 *Rex-LibSSH-0.003.tar.gz