[zcsizmadia]

Fixes #834.

set_sig_algorithm changes the keypair object it is called on, and those objects are shared:

• Server: listen() prepares one SSHServerConnectionOptions and hands it to every connection from conn_factory(), so all connections on a listener share options.server_host_keys. The rsa-sha2-256, rsa-sha2-512 and ssh-rsa entries are one keypair object. choose_server_host_key sets the negotiated algorithm on it, so a connection that negotiated one RSA algorithm can sign its exchange hash with the algorithm another connection negotiated in the meantime, and its client rejects the signature.
• Client: _choose_signature_alg does the same to client keys and client host keys, which can be shared through a reused SSHClientConnectionOptions or passed in as SSHKeyPair objects.

Copying in load_keypairs() gives one copy per options object, which is still shared by every connection on a listener, so this copies per connection instead:

• the server copies the host keypair in choose_server_host_key when it has to change the signature algorithm (a key used with its default algorithm is never changed, so it can stay shared);
• the client copies each key as it takes it from its key lists for public key and host-based auth.

set_sig_algorithm only sets instance attributes, so a shallow copy is enough.

Tests: test_server_host_key_signature_alg_per_connection holds a rsa-sha2-256 connection open while a rsa-sha2-512 connection is made on the same listener and checks each connection's host key; without the fix both report rsa-sha2-512. test_shared_client_key_signature_alg and test_shared_client_host_key_signature_alg check that a shared client keypair is unchanged after signing. All three fail without the fix and pass with it.

I'm OK with releasing this code under the Eclipse Public License v2.0. Please list me as Zoltan Csizmadia in the contributors list.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.87%. Comparing base (fab96ac) to head (8462df8).
⚠️ Report is 242 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #835      +/-   ##
===========================================
+ Coverage    99.85%   99.87%   +0.02%     
===========================================
  Files           95      102       +7     
  Lines        27784    32576    +4792     
  Branches      2908     3125     +217     
===========================================
+ Hits         27743    32535    +4792     
  Misses          38       38              
  Partials         3        3              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ronf]

Thanks very much for the analysis and fix! This change will be part of the next AsyncSSH release.