#2539·paramiko

[BUG] - Return value for sign_ssh_data in PKey is incorrect in subclasses

Author: bitbierCreated Aug 8, 2025Updated Aug 15, 2026
LabelsBug

Are you using paramiko as a client or server?

Client

What feature(s) aren't working right?

Keys/auth

What version(s) of paramiko are you using?

3.5.1

What version(s) of Python are you using?

3.12.11

What operating system and version are you using?

MacOS, Linux

If you're connecting as a client, which SSH server are you connecting to?

No response

If you're using paramiko as part of another tool, which tool/version?

No response

Expected/desired behavior

The documentation and typing information for PKey.sign_ssh_data is not correct for all subclasses.

The documentation states that the return type is:

Returns an SSH signature message.

https://docs.paramiko.org/en/stable/api/keys.html#paramiko.pkey.PKey.sign_ssh_data

However, for some subclasses of PKey, this is not correct. For instance, AgentKey, the return type is bytes.

https://docs.paramiko.org/en/stable/api/agent.html?highlight=agentkey#paramiko.agent.AgentKey

https://github.com/paramiko/paramiko/blob/d9ab89a0f8ae37a25d44565d5eb03a5d93fed5b9/paramiko/agent.py#L484

Actual behavior

Actual behavior is that depending on the key that does the signing, you might need to handle both Message and bytes return values.

How to reproduce

No response

Anything else?

This is probably already known and handled by users of this package, but trying to build a generic signing part of my application. I ran into this issue when I expected things to be a Message but in fact there were two types other than handle here.

Most likely the fix here is to just update the documentation and return types for types-paramiko.