Adding upstream version 1.8.1+ds.upstream/1.8.1+dsupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

12 files changed, 235 insertions, 92 deletions

diff --git a/ci/build.sh b/ci/build.sh
index 80e7a61..a9b66f6 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -61,6 +61,8 @@ if test -n "${CC}"; then
 	"${CC}" --version 2>&1 | indent
 fi
 echo "Environment:"
+echo "PATH=${BUILD_PATH}" | indent
+
 if test -n "${CC}"; then
 	echo "CC=${CC}" | indent
 fi
diff --git a/ci/docker/bionic b/ci/docker/bionic
index f1b69ed..f42c6d2 100644
--- a/ci/docker/bionic
+++ b/ci/docker/bionic
@@ -12,7 +12,6 @@ RUN apt-get update && \
         libcurl4-openssl-dev \
         libkrb5-dev \
         libpcre3-dev \
-        libssh2-1-dev \
         libssl-dev \
         libz-dev \
         ninja-build \
@@ -37,7 +36,16 @@ RUN cd /tmp && \
     cd .. && \
     rm -rf mbedtls-mbedtls-2.16.2
 
-FROM mbedtls AS adduser
+FROM mbedtls AS libssh2
+RUN cd /tmp && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
+    CFLAGS=-fPIC cmake -G Ninja -DBUILD_SHARED_LIBS=ON . && \
+    ninja install && \
+    cd .. && \
+    rm -rf libssh2-1.11.0
+
+FROM libssh2 AS adduser
 ARG UID=""
 ARG GID=""
 RUN if [ "${UID}" != "" ]; then USER_ARG="--uid ${UID}"; fi && \
diff --git a/ci/docker/centos7 b/ci/docker/centos7
index 28ed650..45c299d 100644
--- a/ci/docker/centos7
+++ b/ci/docker/centos7
@@ -18,13 +18,13 @@ RUN yum install -y \
 
 FROM yum AS libssh2
 RUN cd /tmp && \
-    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.8.0.tar.gz | tar -xz && \
-    cd libssh2-1.8.0 && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
     ./configure && \
     make && \
     make install && \
     cd .. && \
-    rm -rf libssh-1.8.0
+    rm -rf libssh-1.11.0
 
 FROM libssh2 AS valgrind
 RUN cd /tmp && \
diff --git a/ci/docker/centos8 b/ci/docker/centos8
index 81f0c3c..c2ac5f0 100644
--- a/ci/docker/centos8
+++ b/ci/docker/centos8
@@ -24,13 +24,13 @@ RUN yum install -y \
 
 FROM yum AS libssh2
 RUN cd /tmp && \
-    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.8.0.tar.gz | tar -xz && \
-    cd libssh2-1.8.0 && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
     ./configure && \
     make && \
     make install && \
     cd .. && \
-    rm -rf libssh2-1.8.0
+    rm -rf libssh2-1.11.0
 
 FROM libssh2 AS valgrind
 RUN cd /tmp && \
diff --git a/ci/docker/fedora b/ci/docker/fedora
new file mode 100644
index 0000000..1db3ceb
--- /dev/null
+++ b/ci/docker/fedora
@@ -0,0 +1,52 @@
+ARG BASE=fedora:rawhide
+
+FROM ${BASE} AS stream
+RUN dnf -y distro-sync
+
+FROM stream AS yum
+RUN yum install -y \
+	which \
+	bzip2 \
+	git \
+	libarchive \
+	cmake \
+	gcc \
+	make \
+	openssl-devel \
+	openssh-server \
+	git-daemon \
+	java-1.8.0-openjdk-headless \
+	sudo \
+	python3 \
+	valgrind \
+	krb5-workstation \
+	krb5-libs \
+	krb5-devel \
+	pcre2-devel \
+	zlib-devel \
+	ninja-build \
+	llhttp-devel
+
+FROM yum AS libssh2
+RUN cd /tmp && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
+    ./configure && \
+    make && \
+    make install && \
+    cd .. && \
+    rm -rf libssh2-1.11.0
+
+FROM libssh2 AS adduser
+ARG UID=""
+ARG GID=""
+RUN if [ "${UID}" != "" ]; then USER_ARG="--uid ${UID}"; fi && \
+    if [ "${GID}" != "" ]; then GROUP_ARG="--gid ${GID}"; fi && \
+    groupadd ${GROUP_ARG} libgit2 && \
+    useradd ${USER_ARG} --gid libgit2 --shell /bin/bash --create-home libgit2
+
+FROM adduser AS configure
+ENV PKG_CONFIG_PATH /usr/local/lib/pkgconfig
+RUN mkdir /var/run/sshd
+RUN echo "/usr/local/lib" > /etc/ld.so.conf.d/local && \
+    ldconfig
diff --git a/ci/docker/focal b/ci/docker/focal
index b3a402c..62f5b63 100644
--- a/ci/docker/focal
+++ b/ci/docker/focal
@@ -53,7 +53,7 @@ RUN cd /tmp && \
     cd libssh2-1.9.0 && \
     mkdir build build-msan && \
     cd build && \
-    CC=clang-10 CFLAGS="-fPIC" cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCRYPTO_BACKEND=Libgcrypt -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local .. && \
+    CC=clang-10 CFLAGS="-fPIC" cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local .. && \
     ninja install && \
     cd ../build-msan && \
     CC=clang-10 CFLAGS="-fPIC -fsanitize=memory -fno-optimize-sibling-calls -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer" LDFLAGS="-fsanitize=memory" cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCRYPTO_BACKEND=mbedTLS -DCMAKE_PREFIX_PATH=/usr/local/msan -DCMAKE_INSTALL_PREFIX=/usr/local/msan .. && \
diff --git a/ci/docker/noble b/ci/docker/noble
new file mode 100644
index 0000000..05cd276
--- /dev/null
+++ b/ci/docker/noble
@@ -0,0 +1,88 @@
+ARG BASE=ubuntu:noble
+
+FROM ${BASE} AS apt
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        bzip2 \
+        clang \
+        cmake \
+        curl \
+        gcc \
+        git \
+        krb5-user \
+        libclang-rt-17-dev \
+        libcurl4-gnutls-dev \
+        libgcrypt20-dev \
+        libkrb5-dev \
+        libpcre3-dev \
+        libssl-dev \
+        libz-dev \
+        llvm-17 \
+        make \
+        ninja-build \
+        openjdk-8-jre-headless \
+        openssh-server \
+        openssl \
+        pkgconf \
+        python3 \
+        sudo \
+        valgrind \
+        && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir /usr/local/msan
+
+FROM apt AS mbedtls
+RUN cd /tmp && \
+    curl --location --silent --show-error https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/mbedtls-2.28.6.tar.gz | \
+        tar -xz && \
+    cd mbedtls-mbedtls-2.28.6 && \
+    scripts/config.pl unset MBEDTLS_AESNI_C && \
+    scripts/config.pl set MBEDTLS_MD4_C 1 && \
+    mkdir build build-msan && \
+    cd build && \
+    CC=clang-17 CFLAGS="-fPIC" cmake -G Ninja -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF -DCMAKE_BUILD_TYPE=Debug -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local .. && \
+    ninja install && \
+    cd ../build-msan && \
+    CC=clang-17 CFLAGS="-fPIC" cmake -G Ninja -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF -DCMAKE_BUILD_TYPE=MemSanDbg -DCMAKE_INSTALL_PREFIX=/usr/local/msan .. && \
+    ninja install && \
+    cd .. && \
+    rm -rf mbedtls-mbedtls-2.28.6
+
+FROM mbedtls AS libssh2
+RUN cd /tmp && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
+    mkdir build build-msan && \
+    cd build && \
+    CC=clang-17 CFLAGS="-fPIC" cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local .. && \
+    ninja install && \
+    cd ../build-msan && \
+    CC=clang-17 CFLAGS="-fPIC -fsanitize=memory -fno-optimize-sibling-calls -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer" LDFLAGS="-fsanitize=memory" cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCRYPTO_BACKEND=mbedTLS -DCMAKE_PREFIX_PATH=/usr/local/msan -DCMAKE_INSTALL_PREFIX=/usr/local/msan .. && \
+    ninja install && \
+    cd .. && \
+    rm -rf libssh2-1.11.0
+
+FROM libssh2 AS valgrind
+RUN cd /tmp && \
+    curl --insecure --location --silent --show-error https://sourceware.org/pub/valgrind/valgrind-3.22.0.tar.bz2 | \
+        tar -xj && \
+    cd valgrind-3.22.0 && \
+    CC=clang-17 ./configure && \
+    make MAKEFLAGS="-j -l$(grep -c ^processor /proc/cpuinfo)" && \
+    make install && \
+    cd .. && \
+    rm -rf valgrind-3.22.0
+
+FROM valgrind AS adduser
+ARG UID=""
+ARG GID=""
+RUN if [ "${UID}" != "" ]; then USER_ARG="--uid ${UID}"; fi && \
+    if [ "${GID}" != "" ]; then GROUP_ARG="--gid ${GID}"; fi && \
+    groupadd ${GROUP_ARG} libgit2 && \
+    useradd ${USER_ARG} --gid libgit2 --shell /bin/bash --create-home libgit2
+
+FROM adduser AS ldconfig
+RUN ldconfig
+
+FROM ldconfig AS configure
+RUN mkdir /var/run/sshd
diff --git a/ci/docker/xenial b/ci/docker/xenial
index 578f0a9..793df4b 100644
--- a/ci/docker/xenial
+++ b/ci/docker/xenial
@@ -53,12 +53,12 @@ RUN cd /tmp && \
 
 FROM mbedtls AS libssh2
 RUN cd /tmp && \
-    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.8.2.tar.gz | tar -xz && \
-    cd libssh2-1.8.2 && \
-    CFLAGS=-fPIC cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCRYPTO_BACKEND=Libgcrypt . && \
+    curl --location --silent --show-error https://www.libssh2.org/download/libssh2-1.11.0.tar.gz | tar -xz && \
+    cd libssh2-1.11.0 && \
+    CFLAGS=-fPIC cmake -G Ninja -DBUILD_SHARED_LIBS=ON . && \
     ninja install && \
     cd .. && \
-    rm -rf libssh2-1.8.2
+    rm -rf libssh2-1.11.0
 
 FROM libssh2 AS valgrind
 RUN cd /tmp && \
diff --git a/ci/getcontainer.sh b/ci/getcontainer.sh
deleted file mode 100755
index 81d0c1d..0000000
--- a/ci/getcontainer.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash
-
-set -e
-
-IMAGE_NAME=$1
-DOCKERFILE_PATH=$2
-
-if [ "${IMAGE_NAME}" = "" ]; then
-	echo "usage: $0 image_name [dockerfile]"
-	exit 1
-fi
-
-if [ "${DOCKERFILE_PATH}" = "" ]; then
-	DOCKERFILE_PATH="${IMAGE_NAME}"
-fi
-
-if [ "${DOCKER_REGISTRY}" = "" ]; then
-	echo "DOCKER_REGISTRY environment variable is unset."
-	echo "Not running inside GitHub Actions or misconfigured?"
-	exit 1
-fi
-
-DOCKER_CONTAINER="${GITHUB_REPOSITORY}/${IMAGE_NAME}"
-DOCKER_REGISTRY_CONTAINER="${DOCKER_REGISTRY}/${DOCKER_CONTAINER}"
-
-echo "dockerfile=${DOCKERFILE_PATH}" >> $GITHUB_ENV
-echo "docker-container=${DOCKER_CONTAINER}" >> $GITHUB_ENV
-echo "docker-registry-container=${DOCKER_REGISTRY_CONTAINER}" >> $GITHUB_ENV
-
-# Identify the last git commit that touched the Dockerfiles
-# Use this as a hash to identify the resulting docker containers
-DOCKER_SHA=$(git log -1 --pretty=format:"%h" -- "${DOCKERFILE_PATH}")
-echo "docker-sha=${DOCKER_SHA}" >> $GITHUB_ENV
-
-DOCKER_REGISTRY_CONTAINER_SHA="${DOCKER_REGISTRY_CONTAINER}:${DOCKER_SHA}"
-
-echo "docker-registry-container-sha=${DOCKER_REGISTRY_CONTAINER_SHA}" >> $GITHUB_ENV
-echo "docker-registry-container-latest=${DOCKER_REGISTRY_CONTAINER}:latest" >> $GITHUB_ENV
-
-echo "::: logging in to ${DOCKER_REGISTRY} as ${GITHUB_ACTOR}"
-
-exists="true"
-docker login https://${DOCKER_REGISTRY} -u ${GITHUB_ACTOR} -p ${GITHUB_TOKEN} || exists="false"
-
-echo "::: pulling ${DOCKER_REGISTRY_CONTAINER_SHA}"
-
-if [ "${exists}" != "false" ]; then
-	docker pull ${DOCKER_REGISTRY_CONTAINER_SHA} || exists="false"
-fi
-
-if [ "${exists}" = "true" ]; then
-	echo "docker-container-exists=true" >> $GITHUB_ENV
-else
-	echo "docker-container-exists=false" >> $GITHUB_ENV
-fi
diff --git a/ci/setup-osx-build.sh b/ci/setup-osx-build.sh
index 0b95e76..511d886 100755
--- a/ci/setup-osx-build.sh
+++ b/ci/setup-osx-build.sh
@@ -3,6 +3,6 @@
 set -ex
 
 brew update
-brew install pkgconfig zlib curl openssl libssh2 ninja
+brew install pkgconfig libssh2 ninja
 
 ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/ci/setup-sanitizer-build.sh b/ci/setup-sanitizer-build.sh
new file mode 100755
index 0000000..e4591f8
--- /dev/null
+++ b/ci/setup-sanitizer-build.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -ex
+
+# Linux updated its ASLR randomization in a way that is incompatible with
+# TSAN. See https://github.com/google/sanitizers/issues/1716
+sudo sysctl vm.mmap_rnd_bits=28
diff --git a/ci/test.sh b/ci/test.sh
index ee6801a..98093c6 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -3,7 +3,14 @@
 set -e
 
 if [ -n "$SKIP_TESTS" ]; then
-	exit 0
+	if [ -z "$SKIP_OFFLINE_TESTS" ]; then SKIP_OFFLINE_TESTS=1; fi
+	if [ -z "$SKIP_ONLINE_TESTS" ]; then SKIP_ONLINE_TESTS=1; fi
+	if [ -z "$SKIP_GITDAEMON_TESTS" ]; then SKIP_GITDAEMON_TESTS=1; fi
+	if [ -z "$SKIP_PROXY_TESTS" ]; then SKIP_PROXY_TESTS=1; fi
+	if [ -z "$SKIP_NTLM_TESTS" ]; then SKIP_NTLM_TESTS=1; fi
+	if [ -z "$SKIP_NEGOTIATE_TESTS" ]; then SKIP_NEGOTIATE_TESTS=1; fi
+	if [ -z "$SKIP_SSH_TESTS" ]; then SKIP_SSH_TESTS=1; fi
+	if [ -z "$SKIP_FUZZERS" ]; then SKIP_FUZZERS=1; fi
 fi
 
 # Windows doesn't run the NTLM tests properly (yet)
@@ -11,6 +18,11 @@ if [[ "$(uname -s)" == MINGW* ]]; then
         SKIP_NTLM_TESTS=1
 fi
 
+# older versions of git don't support push options
+if [ -z "$SKIP_PUSHOPTIONS_TESTS" ]; then
+	export GITTEST_PUSH_OPTIONS=true
+fi
+
 SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
 BUILD_DIR=$(pwd)
 BUILD_PATH=${BUILD_PATH:=$PATH}
@@ -18,12 +30,24 @@ CTEST=$(which ctest)
 TMPDIR=${TMPDIR:-/tmp}
 USER=${USER:-$(whoami)}
 
+GITTEST_SSH_KEYTYPE=${GITTEST_SSH_KEYTYPE:="ecdsa"}
+
 HOME=`mktemp -d ${TMPDIR}/home.XXXXXXXX`
 export CLAR_HOMEDIR=${HOME}
 
 SUCCESS=1
 CONTINUE_ON_FAILURE=0
 
+should_run() {
+	eval "skip=\${SKIP_${1}}"
+	[ -z "$skip" \
+	  -o "$skip" == "no" -o "$skip" == "NO" \
+	  -o "$skip" == "n" -o "$skip" == "N" \
+	  -o "$skip" == "false" -o "$skip" == "FALSE" \
+	  -o "$skip" == "f" -o "$skip" == "F" \
+	  -o "$skip" == "0" ]
+}
+
 cleanup() {
 	echo "Cleaning up..."
 
@@ -78,6 +102,8 @@ run_test() {
 			echo ""
 			echo "Re-running flaky ${1} tests..."
 			echo ""
+
+			sleep 2
 		fi
 
 		RETURN_CODE=0
@@ -138,11 +164,12 @@ echo "##########################################################################
 
 echo ""
 
-if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+if should_run "GITDAEMON_TESTS"; then
 	echo "Starting git daemon (standard)..."
 	GIT_STANDARD_DIR=`mktemp -d ${TMPDIR}/git_standard.XXXXXXXX`
-	git init --bare "${GIT_STANDARD_DIR}/test.git" >/dev/null
+	cp -R "${SOURCE_DIR}/tests/resources/pushoptions.git" "${GIT_STANDARD_DIR}/test.git"
 	git daemon --listen=localhost --export-all --enable=receive-pack --base-path="${GIT_STANDARD_DIR}" "${GIT_STANDARD_DIR}" 2>/dev/null &
+
 	GIT_STANDARD_PID=$!
 
 	echo "Starting git daemon (namespace)..."
@@ -158,7 +185,7 @@ if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
 	GIT_SHA256_PID=$!
 fi
 
-if [ -z "$SKIP_PROXY_TESTS" ]; then
+if should_run "PROXY_TESTS"; then
 	curl --location --silent --show-error https://github.com/ethomson/poxyproxy/releases/download/v0.7.0/poxyproxy-0.7.0.jar >poxyproxy.jar
 
 	echo "Starting HTTP proxy (Basic)..."
@@ -170,25 +197,27 @@ if [ -z "$SKIP_PROXY_TESTS" ]; then
 	PROXY_NTLM_PID=$!
 fi
 
-if [ -z "$SKIP_NTLM_TESTS" -o -z "$SKIP_ONLINE_TESTS" ]; then
+if should_run "NTLM_TESTS" || should_run "ONLINE_TESTS"; then
 	curl --location --silent --show-error https://github.com/ethomson/poxygit/releases/download/v0.6.0/poxygit-0.6.0.jar >poxygit.jar
 
 	echo "Starting HTTP server..."
 	HTTP_DIR=`mktemp -d ${TMPDIR}/http.XXXXXXXX`
-	git init --bare "${HTTP_DIR}/test.git"
+	cp -R "${SOURCE_DIR}/tests/resources/pushoptions.git" "${HTTP_DIR}/test.git"
+
 	java -jar poxygit.jar --address 127.0.0.1 --port 9000 --credentials foo:baz --quiet "${HTTP_DIR}" &
 	HTTP_PID=$!
 fi
 
-if [ -z "$SKIP_SSH_TESTS" ]; then
+if should_run "SSH_TESTS"; then
 	echo "Starting SSH server..."
 	SSHD_DIR=`mktemp -d ${TMPDIR}/sshd.XXXXXXXX`
-	git init --bare "${SSHD_DIR}/test.git" >/dev/null
+	cp -R "${SOURCE_DIR}/tests/resources/pushoptions.git" "${SSHD_DIR}/test.git"
+
 	cat >"${SSHD_DIR}/sshd_config" <<-EOF
 	Port 2222
 	ListenAddress 0.0.0.0
 	Protocol 2
-	HostKey ${SSHD_DIR}/id_rsa
+	HostKey ${SSHD_DIR}/id_${GITTEST_SSH_KEYTYPE}
 	PidFile ${SSHD_DIR}/pid
 	AuthorizedKeysFile ${HOME}/.ssh/authorized_keys
 	LogLevel DEBUG
@@ -197,19 +226,21 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	PubkeyAuthentication yes
 	ChallengeResponseAuthentication no
 	StrictModes no
+	HostCertificate ${SSHD_DIR}/id_${GITTEST_SSH_KEYTYPE}.pub
+	HostKey ${SSHD_DIR}/id_${GITTEST_SSH_KEYTYPE}
 	# Required here as sshd will simply close connection otherwise
 	UsePAM no
 	EOF
-	ssh-keygen -t rsa -f "${SSHD_DIR}/id_rsa" -N "" -q
+	ssh-keygen -t "${GITTEST_SSH_KEYTYPE}" -f "${SSHD_DIR}/id_${GITTEST_SSH_KEYTYPE}" -N "" -q
 	/usr/sbin/sshd -f "${SSHD_DIR}/sshd_config" -E "${SSHD_DIR}/log"
 
 	# Set up keys
 	mkdir "${HOME}/.ssh"
-	ssh-keygen -t rsa -f "${HOME}/.ssh/id_rsa" -N "" -q
-	cat "${HOME}/.ssh/id_rsa.pub" >>"${HOME}/.ssh/authorized_keys"
+	ssh-keygen -t "${GITTEST_SSH_KEYTYPE}" -f "${HOME}/.ssh/id_${GITTEST_SSH_KEYTYPE}" -N "" -q
+	cat "${HOME}/.ssh/id_${GITTEST_SSH_KEYTYPE}.pub" >>"${HOME}/.ssh/authorized_keys"
 	while read algorithm key comment; do
 		echo "[localhost]:2222 $algorithm $key" >>"${HOME}/.ssh/known_hosts"
-	done <"${SSHD_DIR}/id_rsa.pub"
+	done <"${SSHD_DIR}/id_${GITTEST_SSH_KEYTYPE}.pub"
 
 	# Append the github.com keys for the tests that don't override checks.
 	# We ask for ssh-rsa to test that the selection based off of known_hosts
@@ -228,7 +259,7 @@ fi
 
 # Run the tests that do not require network connectivity.
 
-if [ -z "$SKIP_OFFLINE_TESTS" ]; then
+if should_run "OFFLINE_TESTS"; then
 	echo ""
 	echo "##############################################################################"
 	echo "## Running core tests"
@@ -259,7 +290,11 @@ if [ -n "$RUN_INVASIVE_TESTS" ]; then
 	unset GITTEST_INVASIVE_SPEED
 fi
 
-if [ -z "$SKIP_ONLINE_TESTS" ]; then
+# the various network  tests can fail due to network connectivity problems;
+# allow them to retry up to 5 times
+export GITTEST_FLAKY_RETRY=5
+
+if should_run "ONLINE_TESTS"; then
 	# Run the online tests.  The "online" test suite only includes the
 	# default online tests that do not require additional configuration.
 	# The "proxy" and "ssh" test suites require further setup.
@@ -288,7 +323,7 @@ if [ -z "$SKIP_ONLINE_TESTS" ]; then
 	run_test online_customcert
 fi
 
-if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+if should_run "GITDAEMON_TESTS"; then
 	echo ""
 	echo "Running gitdaemon (standard) tests"
 	echo ""
@@ -316,7 +351,7 @@ if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
 	unset GITTEST_REMOTE_URL
 fi
 
-if [ -z "$SKIP_PROXY_TESTS" ]; then
+if should_run "PROXY_TESTS"; then
 	echo ""
 	echo "Running proxy tests (Basic authentication)"
 	echo ""
@@ -342,7 +377,7 @@ if [ -z "$SKIP_PROXY_TESTS" ]; then
 	unset GITTEST_REMOTE_PROXY_PASS
 fi
 
-if [ -z "$SKIP_NTLM_TESTS" ]; then
+if should_run "NTLM_TESTS"; then
 	echo ""
 	echo "Running NTLM tests (IIS emulation)"
 	echo ""
@@ -368,7 +403,7 @@ if [ -z "$SKIP_NTLM_TESTS" ]; then
 	unset GITTEST_REMOTE_PASS
 fi
 
-if [ -z "$SKIP_NEGOTIATE_TESTS" -a -n "$GITTEST_NEGOTIATE_PASSWORD" ]; then
+if should_run "NEGOTIATE_TESTS" && -n "$GITTEST_NEGOTIATE_PASSWORD" ; then
 	echo ""
 	echo "Running SPNEGO tests"
 	echo ""
@@ -401,13 +436,15 @@ if [ -z "$SKIP_NEGOTIATE_TESTS" -a -n "$GITTEST_NEGOTIATE_PASSWORD" ]; then
 	kdestroy -A
 fi
 
-if [ -z "$SKIP_SSH_TESTS" ]; then
+if should_run "SSH_TESTS"; then
 	export GITTEST_REMOTE_USER=$USER
-	export GITTEST_REMOTE_SSH_KEY="${HOME}/.ssh/id_rsa"
-	export GITTEST_REMOTE_SSH_PUBKEY="${HOME}/.ssh/id_rsa.pub"
+	export GITTEST_REMOTE_SSH_KEY="${HOME}/.ssh/id_${GITTEST_SSH_KEYTYPE}"
+	export GITTEST_REMOTE_SSH_PUBKEY="${HOME}/.ssh/id_${GITTEST_SSH_KEYTYPE}.pub"
 	export GITTEST_REMOTE_SSH_PASSPHRASE=""
 	export GITTEST_REMOTE_SSH_FINGERPRINT="${SSH_FINGERPRINT}"
 
+	export GITTEST_SSH_CMD="ssh -i ${HOME}/.ssh/id_${GITTEST_SSH_KEYTYPE} -o UserKnownHostsFile=${HOME}/.ssh/known_hosts"
+
 	echo ""
 	echo "Running ssh tests"
 	echo ""
@@ -424,6 +461,8 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	run_test ssh
 	unset GITTEST_REMOTE_URL
 
+	unset GITTEST_SSH_CMD
+
 	unset GITTEST_REMOTE_USER
 	unset GITTEST_REMOTE_SSH_KEY
 	unset GITTEST_REMOTE_SSH_PUBKEY
@@ -431,7 +470,9 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	unset GITTEST_REMOTE_SSH_FINGERPRINT
 fi
 
-if [ -z "$SKIP_FUZZERS" ]; then
+unset GITTEST_FLAKY_RETRY
+
+if should_run "FUZZERS"; then
 	echo ""
 	echo "##############################################################################"
 	echo "## Running fuzzers"