SSHScript 5.0.0

SSHScript 5.0.0 changes the default host-key trust source for nested connections while preserving the 4.0 command execution contract. Python 3.11 or newer is required.

Migration from 4.0.2

host1.connect("host2") now reads host1's known_hosts over SFTP, matching the host ownership of pkey_path. Provision that trust file before connecting. To use localhost's records instead, set local.set(known_hosts="local") before creating child Sessions.

All selected trust files must be readable and valid, including localhost's default ~/.ssh/known_hosts. Missing files and permission/parse errors stop the connection. An explicit empty file lets the configured missing-key policy handle unknown hosts.

Changes

• Add known_hosts="parent" (default), "local", and "chain" strategies, plus per-Session known_hosts_path.
• Chain lookup checks the calling Session first, then its ancestors through localhost. The nearest target hostname/port record is authoritative; changed keys and file errors never fall back to a more distant source.
• Authentication and host-key verification still run locally. pkey_path stays on the calling host for every strategy. AutoAddPolicy accepts unknown keys into client memory without writing these trust files.
• Document trust sources, supported file formats and migration in the package API and AI skill.
• Isolate the timeout regression from runner HOME and verify connection cleanup after a timeout.
• Include SSH key-ownership documentation and a stderr-drain scheduling regression.

The release workflow builds and attests the wheel and sdist, verifies their recorded hashes, tests the installed wheel against OpenSSH and native su/sudo, then publishes the same verified artifacts to PyPI.

API and migration guide · Version policy · PyPI