[eirikb]

Hi there

Thanks for ssh2! After updating my arch I could no longer log in with my RSA key to a server we run on top of ssh2:

input_userauth_pk_ok: server replied to PK_OK with signature type ssh-rsa not in PubkeyAcceptedAlgorithms
ssh_dispatch_run_fatal: Connection to <host> port 22: signature algorithm not supported

ssh -vv also showed something odd in the server's server-sig-algs, two names glued together:

server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss>

My ed25519 key still works, so it seems to be RSA keys only. I bet more people will hit this as distros move to OpenSSH 10 (which I think happened to me). Claude helped me track it down, details below. Split into 3 commits in case you only want some of it.

Note; the change is done by Opus 5.5 on max with claude, codex, vibe and antigravity as reviewers.

---

From Claude, what is in this PR:

• PK_OK echoes the requested algorithm. lib/protocol/handlers.misc.js maps rsa-sha2-256/rsa-sha2-512 to ssh-rsa, and PKAuthContext.accept() in lib/server.js sent that mapped name in USERAUTH_PK_OK. RFC 4252 section 7 requires the algorithm name from the request, and OpenSSH 10.6 now enforces it. The requested name is carried separately as _requestedKeyAlgo, so ctx.key.algo is still 'ssh-rsa' and existing authentication handlers are unaffected. Clients that request ssh-rsa get ssh-rsa back as before.
• Missing comma in server-sig-algs. sendExtInfo() in lib/protocol/Protocol.js joined ecdsa-sha2-nistp521 and rsa-sha2-512 into one invalid name, so neither was advertised. One side effect: OpenSSH clients will now pick rsa-sha2-512 against ssh2 servers. The server already verifies that through hashAlgo.
• OpenSSH integration tests on OpenSSH 10. OpenSSH 10.0 removed DSA, and the +ssh-dss options made every case in test/test-integration-openssh.js exit with 255. DSA support is now detected with ssh -Q key (also covers 9.x builds without DSA), and the two DSA cases are skipped when it is missing. With OpenSSH 10.6 this test fails without the fix and passes with it.
• Unit tests in test/test-userauth.js. They wrap client._protocol._handlers to check USERAUTH_PK_OK and server-sig-algs as received by the client, since the client ignores the PK_OK algorithm otherwise. Cases: rsa-sha2-256, rsa-sha2-512, ssh-rsa and ECDSA. Each fix makes them fail when reverted on its own.
• npm test and npm run lint pass on Node 26.13 with OpenSSH 10.6.