Skip to content

Commit 8880d1f

Browse files
stanhustanhu
committed
Remove hard-coded SSH supported algorithms
`x/crypto/ssh` now supports a list of default supported algorithms, and LabKit provides a mechanism to configure gitlab-shell to use FIPS-compliant algorithms. Use these as defaults instead of the hard-coded values. On a default configuration where no algorithms are configured, an `ssh-audit` shows: Removed weak algorithms: - `diffie-hellman-group14-sha1` was removed (this was flagged as using a weak hashing algorithm) Added stronger key exchange algorithms: - `mlkem768x25519-sha256` - A new post-quantum cryptographic algorithm - `diffie-hellman-group16-sha512` - Stronger than the group14 variants - `diffie-hellman-group-exchange-sha256 (2048-bit)` - Provides additional flexibility The changes represent a security improvement over the defaults. What stayed the same: - Host-key algorithms (still has the same security issues with weak elliptic curves) - Encryption algorithms (ciphers) - Message authentication codes - The problematic NIST curves (nistp256, nistp384, nistp521) remain - Same fingerprints, indicating the same server identity Both audits still flag the same core problems: - Weak elliptic curves (NIST P-curves) - Weak ECDSA host key - Encrypt-and-MAC mode usage - Legacy ssh-rsa algorithm For FIPS, the changes are much more restrictive. The following key exchanges have been dropped by default: * curve25519-sha256 * curve25519-sha256@libssh.org * ecdh-sha2-nistp521 - The 521-bit NIST curve * diffie-hellman-group14-sha256 * diffie-hellman-group14-sha1 Encryption algorithms Lost: * chacha20-poly1305@openssh.com MAC algorithms dropped: * hmac-sha1 Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/821 Changelog: changed
1 parent 7bd86f3 commit 8880d1f

File tree

5 files changed

+49
-60
lines changed

5 files changed

+49
-60
lines changed

‎go.mod

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ require (
2323
// Please do not override. Once v16.11.1 is released, this comment
2424
// can be removed.
2525
gitlab.com/gitlab-org/gitaly/v16 v16.11.0-rc1.0.20250408053233-c6d43513e93c
26-
gitlab.com/gitlab-org/labkit v1.24.1
27-
golang.org/x/crypto v0.39.0
26+
gitlab.com/gitlab-org/labkit v1.25.0
27+
golang.org/x/crypto v0.41.0
2828
golang.org/x/sync v0.16.0
2929
google.golang.org/grpc v1.72.0
3030
google.golang.org/protobuf v1.36.6
@@ -106,10 +106,10 @@ require (
106106
go.opentelemetry.io/otel/metric v1.34.0 // indirect
107107
go.opentelemetry.io/otel/trace v1.34.0 // indirect
108108
go.uber.org/atomic v1.11.0 // indirect
109-
golang.org/x/net v0.39.0 // indirect
109+
golang.org/x/net v0.42.0 // indirect
110110
golang.org/x/oauth2 v0.26.0 // indirect
111-
golang.org/x/sys v0.33.0 // indirect
112-
golang.org/x/text v0.26.0 // indirect
111+
golang.org/x/sys v0.35.0 // indirect
112+
golang.org/x/text v0.28.0 // indirect
113113
golang.org/x/time v0.11.0 // indirect
114114
golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
115115
google.golang.org/api v0.197.0 // indirect

‎go.sum

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -554,8 +554,8 @@ gitlab.com/gitlab-org/gitaly/v16 v16.11.0-rc1.0.20250408053233-c6d43513e93c h1:x
554554
gitlab.com/gitlab-org/gitaly/v16 v16.11.0-rc1.0.20250408053233-c6d43513e93c/go.mod h1:/rkj6992VsNymUeG6N3VnLZ8Pvb1Y9ZUo00Yy35t8WQ=
555555
gitlab.com/gitlab-org/go/reopen v1.0.0 h1:6BujZ0lkkjGIejTUJdNO1w56mN1SI10qcVQyQlOPM+8=
556556
gitlab.com/gitlab-org/go/reopen v1.0.0/go.mod h1:D6OID8YJDzEVZNYW02R/Pkj0v8gYFSIhXFTArAsBQw8=
557-
gitlab.com/gitlab-org/labkit v1.24.1 h1:/Rw5ZyTyORNPHTgKSUmykhI4lSWjQdGZcm+r4ASFVkU=
558-
gitlab.com/gitlab-org/labkit v1.24.1/go.mod h1:vnGUmGdIjTs1PLDbLPduQMHgky77l26MESy2jGR1aw8=
557+
gitlab.com/gitlab-org/labkit v1.25.0 h1:ON+pf8hk5nmrFLwT4CVLniBf1kSYvBujyGp1+jW9++g=
558+
gitlab.com/gitlab-org/labkit v1.25.0/go.mod h1:ZHOQIOVQKeOEKvQ/GhGBjUNbV3zWsx8nty6D/SRCyd4=
559559
go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
560560
go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
561561
go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -601,8 +601,8 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
601601
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
602602
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
603603
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
604-
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
605-
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
604+
golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
605+
golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
606606
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
607607
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
608608
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -640,8 +640,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
640640
golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
641641
golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
642642
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
643-
golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
644-
golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
643+
golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
644+
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
645645
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
646646
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
647647
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -679,8 +679,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
679679
golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
680680
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
681681
golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
682-
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
683-
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
682+
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
683+
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
684684
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
685685
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
686686
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -766,11 +766,11 @@ golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBc
766766
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
767767
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
768768
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
769-
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
770-
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
769+
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
770+
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
771771
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
772-
golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
773-
golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
772+
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
773+
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
774774
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
775775
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
776776
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -779,8 +779,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
779779
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
780780
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
781781
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
782-
golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
783-
golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
782+
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
783+
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
784784
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
785785
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
786786
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -841,8 +841,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
841841
golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
842842
golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
843843
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
844-
golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
845-
golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
844+
golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
845+
golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
846846
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
847847
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
848848
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎internal/sshd/server_config.go

Lines changed: 9 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -17,29 +17,10 @@ import (
1717
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/gitlabnet/authorizedcerts"
1818
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/gitlabnet/authorizedkeys"
1919

20+
"gitlab.com/gitlab-org/labkit/fips"
2021
"gitlab.com/gitlab-org/labkit/log"
2122
)
2223

23-
var (
24-
supportedMACs = []string{
25-
"hmac-sha2-256-etm@openssh.com",
26-
"hmac-sha2-512-etm@openssh.com",
27-
"hmac-sha2-256",
28-
"hmac-sha2-512",
29-
"hmac-sha1",
30-
}
31-
32-
supportedKeyExchanges = []string{
33-
"curve25519-sha256",
34-
"curve25519-sha256@libssh.org",
35-
"ecdh-sha2-nistp256",
36-
"ecdh-sha2-nistp384",
37-
"ecdh-sha2-nistp521",
38-
"diffie-hellman-group14-sha256",
39-
"diffie-hellman-group14-sha1",
40-
}
41-
)
42-
4324
type serverConfig struct {
4425
cfg *config.Config
4526
hostKeys []ssh.Signer
@@ -252,6 +233,14 @@ func (s *serverConfig) get(parentCtx context.Context) *ssh.ServerConfig {
252233
ServerVersion: "SSH-2.0-GitLab-SSHD",
253234
}
254235

236+
// This can be dropped once https://github.com/golang-fips/go/issues/316 is supported.
237+
// We need to constrain the list of supported algorithms for FIPS.
238+
algorithms := fips.SupportedAlgorithms()
239+
sshCfg.PublicKeyAuthAlgorithms = algorithms.PublicKeyAuths
240+
sshCfg.Ciphers = algorithms.Ciphers
241+
sshCfg.KeyExchanges = algorithms.KeyExchanges
242+
sshCfg.MACs = algorithms.MACs
243+
255244
s.configureMACs(sshCfg)
256245
s.configureKeyExchanges(sshCfg)
257246
s.configureCiphers(sshCfg)
@@ -279,15 +268,11 @@ func (s *serverConfig) configureCiphers(sshCfg *ssh.ServerConfig) {
279268
func (s *serverConfig) configureKeyExchanges(sshCfg *ssh.ServerConfig) {
280269
if len(s.cfg.Server.KexAlgorithms) > 0 {
281270
sshCfg.KeyExchanges = s.cfg.Server.KexAlgorithms
282-
} else {
283-
sshCfg.KeyExchanges = supportedKeyExchanges
284271
}
285272
}
286273

287274
func (s *serverConfig) configureMACs(sshCfg *ssh.ServerConfig) {
288275
if len(s.cfg.Server.MACs) > 0 {
289276
sshCfg.MACs = s.cfg.Server.MACs
290-
} else {
291-
sshCfg.MACs = supportedMACs
292277
}
293278
}

‎internal/sshd/server_config_test.go

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"gitlab.com/gitlab-org/gitlab-shell/v14/client/testserver"
2222
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
2323
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/testhelper"
24+
"gitlab.com/gitlab-org/labkit/fips"
2425
)
2526

2627
func TestNewServerConfigWithoutHosts(t *testing.T) {
@@ -250,25 +251,28 @@ func TestDefaultAlgorithms(t *testing.T) {
250251
srvCfg := &serverConfig{cfg: &config.Config{}}
251252
sshServerConfig := srvCfg.get(context.Background())
252253

253-
require.Equal(t, supportedMACs, sshServerConfig.MACs)
254-
require.Equal(t, supportedKeyExchanges, sshServerConfig.KeyExchanges)
255-
require.Nil(t, sshServerConfig.Ciphers)
254+
algorithms := fips.SupportedAlgorithms()
256255

257-
sshServerConfig.SetDefaults()
256+
require.Equal(t, algorithms.MACs, sshServerConfig.MACs)
257+
require.Equal(t, algorithms.KeyExchanges, sshServerConfig.KeyExchanges)
258+
require.Equal(t, algorithms.Ciphers, sshServerConfig.Ciphers)
258259

259-
require.Equal(t, supportedMACs, sshServerConfig.MACs)
260-
require.Equal(t, supportedKeyExchanges, sshServerConfig.KeyExchanges)
260+
sshServerConfig.SetDefaults()
261261

262-
defaultCiphers := []string{
263-
"aes128-gcm@openssh.com",
264-
"aes256-gcm@openssh.com",
265-
"chacha20-poly1305@openssh.com",
266-
"aes128-ctr",
267-
"aes192-ctr",
268-
"aes256-ctr",
262+
// Go automatically adds curve25519-sha256@libssh.org as alias for curve25519-sha256
263+
// if the latter exists for backwards compatibility:
264+
// https://github.com/golang/crypto/blob/ef5341b70697ceb55f904384bd982587224e8b0c/ssh/common.go#L512-L520
265+
var kexs []string
266+
for _, k := range algorithms.KeyExchanges {
267+
kexs = append(kexs, k)
268+
if k == ssh.KeyExchangeCurve25519 {
269+
kexs = append(kexs, "curve25519-sha256@libssh.org")
270+
}
269271
}
270272

271-
require.Equal(t, sshServerConfig.Ciphers, defaultCiphers)
273+
require.Equal(t, algorithms.MACs, sshServerConfig.MACs)
274+
require.Equal(t, kexs, sshServerConfig.KeyExchanges)
275+
require.Equal(t, algorithms.Ciphers, sshServerConfig.Ciphers)
272276
}
273277

274278
func TestCustomAlgorithms(t *testing.T) {

‎support/lint_last_known_acceptable.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,6 @@ internal/gitlabnet/client.go:27:1: exported: exported function ParseJSON should
9090
internal/gitlabnet/client.go:35:1: exported: exported function ParseIP should have comment or be unexported (revive)
9191
internal/gitlabnet/healthcheck/client_test.go:19:41: unused-parameter: parameter 'r' seems to be unused, consider removing or renaming it as _ (revive)
9292
internal/gitlabnet/lfstransfer/client.go:137:3: internal/gitlabnet/lfstransfer/client.go:137: Line contains TODO/BUG/FIXME/NOTE/OPTIMIZE/HACK: "FIXME: This causes tests to fail" (godox)
93-
internal/sshd/server_config.go:149:19: SA1019: ssh.KeyAlgoDSA is deprecated: DSA is only supported at insecure key sizes, and was removed from major implementations. (staticcheck)
93+
internal/sshd/server_config.go:130:19: SA1019: ssh.KeyAlgoDSA is deprecated: DSA is only supported at insecure key sizes, and was removed from major implementations. (staticcheck)
9494
internal/sshd/server_config_test.go:5:2: SA1019: "crypto/dsa" has been deprecated since Go 1.16 because it shouldn't be used: DSA is a legacy algorithm, and modern alternatives such as Ed25519 (implemented by package crypto/ed25519) should be used instead. Keys with 1024-bit moduli (L1024N160 parameters) are cryptographically weak, while bigger keys are not widely supported. Note that FIPS 186-5 no longer approves DSA for signature generation. (staticcheck)
9595
internal/sshd/sshd.go:268:6: func `extractDataFromContext` is unused (unused)

0 commit comments

Comments
 (0)