)]}'
{
  "commit": "a1ce0fee129597fdea8dfd58d71b6b607de6bdce",
  "tree": "f9da4efb4e1270e5cb838bfdb494a99bbeb93c0c",
  "parents": [
    "a749d17980b8eb54b34872d8d8f2c90d69442cc5"
  ],
  "author": {
    "name": "Nicola",
    "email": "nicola.murino@gmail.com",
    "time": "Tue Jan 27 12:15:18 2026 +0100"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu May 21 10:43:27 2026 -0700"
  },
  "message": "ssh/agent: preserve constraint extensions when adding keys\n\nThe client Add method only serialized the lifetime and confirm\nconstraints and silently dropped AddedKey.ConstraintExtensions before\nsending the SSH_AGENTC_ADD_IDENTITY request. As a result the remote\nagent always received the key with no extension constraints, regardless\nof what the caller requested.\n\nApplications that add a key believing custom constraint extensions\n(such as restrict-destination-v00@openssh.com) would be enforced\ninstead loaded a completely unrestricted key into the agent. For\nexample, an administrator forwarding their agent into an untrusted jump\nhost and trying to limit the forwarded key with restrict-destination\nnever had that restriction reach the agent: any user or compromised\nprocess on that host could make the agent sign arbitrary challenges.\n\nSerialize each entry in key.ConstraintExtensions as an\nagentConstrainExtension constraint so the constraints reach the agent,\nand add a round-trip regression test that verifies the extensions\nsurvive client serialization and server parsing.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nUpdates CVE-2026-39832\nUpdates golang/go#79435\n\nChange-Id: I14c5583b106cbf0d282d2ba01e000e0f586f08c7\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/778640\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Keith Randall \u003ckhr@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b357e18b0a15d20b927691abfb9c8146a2146af0",
      "old_mode": 33188,
      "old_path": "ssh/agent/client.go",
      "new_id": "2fc2aa90433dcfb5147dfed0d5a7d612d1303603",
      "new_mode": 33188,
      "new_path": "ssh/agent/client.go"
    },
    {
      "type": "modify",
      "old_id": "2ca92a48e17de302d7757a4346b417a54b611882",
      "old_mode": 33188,
      "old_path": "ssh/agent/client_test.go",
      "new_id": "567c0d9cd27198b916a623b09a45f448c2ba24a3",
      "new_mode": 33188,
      "new_path": "ssh/agent/client_test.go"
    }
  ]
}