Handle optional SSH warnings compatibly and lower minimum Unraid to 6.12.5

[borg-codex-bot]

Problem

A user running Unraid 6.12.15 reported that a backup through an SSH storage profile to a Debian 13 host fails with:

Remote: command-line: line 0: Bad configuration option: warnweakcrypto

Removing WarnWeakCrypto from api/borg_ssh.py worked around the failure. The option was introduced in OpenSSH 10.1; the older SSH client on Unraid rejects it before establishing the connection.

Issue #448 raised the minimum Unraid version to 7.2.0 solely because of this SSH option. The maintainer has approved addressing the compatibility problem directly and setting the minimum supported Unraid version to 6.12.5.

Requested change

• Add IgnoreUnknown=WarnWeakCrypto before WarnWeakCrypto=no in the shared Borg SSH command.
• Keep WarnWeakCrypto=no: suppressing this warning is intentional because the warning interferes with the plugin's SSH handling on newer clients.
• Older clients should ignore this specific unsupported option; newer clients should continue applying it.
• Set the Community Apps minimum version in plugins/borg-backup-ui.xml to 6.12.5 and update the corresponding tests and German/English requirement documentation.
• Add a user-facing release note explaining the SSH compatibility fix and the minimum-version change.

The intended option order is:

-o IgnoreUnknown=WarnWeakCrypto -o WarnWeakCrypto=no

Scope boundaries

• No Unraid-version-specific SSH branches or new settings.
• Do not remove warning suppression from newer SSH clients.
• Ignore only WarnWeakCrypto, not all unknown SSH options.
• Preserve the other managed transport options, SSH identity handling, and user-supplied SSH configuration.
• This is a separately tracked SSH compatibility fix. At the maintainer's explicit request on 2026-09-09, it is implemented on codex/issue-486-job-ids in PR Use permanent job IDs, explicit settings and compatible SSH with fewer idle writes (#486, #495, #496, #497) #494, with its own Handle optional SSH warnings compatibly and lower minimum Unraid to 6.12.5 #496 commit and release-note fragment.

Acceptance criteria and validation

• The generated shared SSH command places the narrow IgnoreUnknown option before WarnWeakCrypto=no, including when normalizing an existing command.
• An older OpenSSH client accepts the generated options without the reported configuration error.
• A newer client still receives and applies WarnWeakCrypto=no.
• Existing SSH transport tests pass, with focused coverage for option order and repeated command normalization.
• Verify an SSH-profile backup on the affected older Unraid setup and on a current supported setup; record the Unraid and OpenSSH versions used.
• Metadata, documentation, and minimum-version tests consistently specify 6.12.5.
• Publish and verify a test-channel candidate before stable release, following the repository workflow.

References

• Previous minimum-version decision: Require Unraid 7.2.0 for managed SSH transport options #448.
• OpenSSH 10.1 release notes: introduction of WarnWeakCrypto.
• OpenSSH IgnoreUnknown documentation: ignore named unsupported options; ordering matters.

Implementation and test candidate (2026-09-09)

• Implemented in commit ef52219c74eb72b702aef0d4e5b07fb3579c234a on codex/issue-486-job-ids, included in PR Use permanent job IDs, explicit settings and compatible SSH with fewer idle writes (#486, #495, #496, #497) #494 at the maintainer's request.
• Shared transport adds the narrow ignore exemption before warning suppression. Existing command-line ignore lists keep their position and entries; repeated normalization remains stable. No separate version branch or cipher/host-key-policy change was added.
• Community Apps metadata and both user manuals now specify Unraid 6.12.5. The separate Python plugin with Python 3.10 or newer remains required. The Handle optional SSH warnings compatibly and lower minimum Unraid to 6.12.5 #496 release-note fragment is included in the tested package.
• Focused validation: 49 tests passed. Coverage includes option order, split/combined/space-separated forms, custom ignore lists, identity replacement, repeated normalization and rejection of unrelated unknown options.
• Actual local client: OpenSSH_9.6p1 Ubuntu-3ubuntu13.19. Using ssh -F /dev/null -G 127.0.0.1 (configuration parsing only, no connection), the previous command reproduced Bad configuration option: warnweakcrypto with exit 255; the generated fixed command returned exit 0 with no stderr. A second check retained an existing custom optional setting.
• A client supporting WarnWeakCrypto was not available for local execution. The generated command retains WarnWeakCrypto=no; full backup verification on older and current Unraid remains pending.
• Full preflight ran once for the final pushed commit: 928 passed, none skipped, in 36.83 seconds, plus Python syntax checks. Real Borg 1.4.5 and Node were available.
• Local HTTP smoke check: application page/assets and setup/restore GETs returned HTTP 200 with isolated data and stubbed Borg responses. No production repository was accessed.
• Verified test version: 2026.09.09.1010 (test-channel manifest).
• Published snapshot: ebd2b6c804f55cc33cd5f4a68b289462c51b50ee; exactly one manifest and one package. Independently downloaded and checked version, URLs, MD5 (fab8bbbc86a0a7588d372ddf1e0e607b), package permissions, source provenance, source-file bytes, release notes and commit-pinned Community Apps metadata.

Remaining manual acceptance

Test an SSH-profile backup on the affected older Unraid installation and on a current supported installation. Record cat /etc/unraid-version and ssh -V, confirm that the connection and backup succeed, and confirm that the unwanted warning remains suppressed where the client supports it. Keep this issue open until accepted and merged. No stable release has been approved or created.