From acebfbc29ade096b8bb5526454d8413ee11faed4 Mon Sep 17 00:00:00 2001
From: David Obando <daobando@microsoft.com>
Date: Tue, 31 Mar 2026 13:35:07 -0700
Subject: [PATCH] Fix minor warnings

---
 src/cs/Ssh/Algorithms/ECDsa.cs            | 8 +++++---
 src/cs/Ssh/Algorithms/Rsa.cs              | 5 +++--
 src/cs/Ssh/IO/Buffer.cs                   | 4 ++--
 src/cs/Ssh/Services/KeyExchangeService.cs | 1 +
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/cs/Ssh/Algorithms/ECDsa.cs b/src/cs/Ssh/Algorithms/ECDsa.cs
index 4c6ead0..e296db0 100644
--- a/src/cs/Ssh/Algorithms/ECDsa.cs
+++ b/src/cs/Ssh/Algorithms/ECDsa.cs
@@ -130,9 +130,9 @@ public KeyPair(string keyAlgorithmName)
 		/// Use this constructor when the ECDSA private key is non-exportable
 		/// (for example, backed by CNG/KSP from a certificate imported by the
 		/// Azure Key Vault VM extension). The SSH library will call
-		/// <see cref="System.Security.Cryptography.ECDsa.SignData"/> and
-		/// <see cref="System.Security.Cryptography.ECDsa.VerifyData"/> on the
-		/// provided instance directly, without ever needing to export raw key material.
+		/// <see cref="System.Security.Cryptography.ECDsa.SignData(byte[], int, int, HashAlgorithmName)"/> and
+		/// <see cref="System.Security.Cryptography.ECDsa.VerifyData(byte[], int, int, byte[], HashAlgorithmName)"/>
+		/// on the provided instance directly, without ever needing to export raw key material.
 		/// </remarks>
 		public KeyPair(System.Security.Cryptography.ECDsa algorithm)
 		{
@@ -143,7 +143,9 @@ public KeyPair(System.Security.Cryptography.ECDsa algorithm)
 
 			// Determine the curve from the public key parameters (always exportable).
 			var p = algorithm.ExportParameters(false);
+#pragma warning disable CA1308 // Normalize strings to uppercase
 			var curveName = p.Curve.Oid?.FriendlyName?.ToLowerInvariant() ?? string.Empty;
+#pragma warning restore CA1308 // Normalize strings to uppercase
 			if (curveName.StartsWith("ecdsa_p", StringComparison.Ordinal))
 			{
 				curveName = "nistp" + curveName.Substring(7);
diff --git a/src/cs/Ssh/Algorithms/Rsa.cs b/src/cs/Ssh/Algorithms/Rsa.cs
index a7f93f0..e660e65 100644
--- a/src/cs/Ssh/Algorithms/Rsa.cs
+++ b/src/cs/Ssh/Algorithms/Rsa.cs
@@ -87,8 +87,9 @@ public KeyPair(int? keySizeInBits = null)
 		/// Use this constructor when the RSA private key is non-exportable
 		/// (for example, backed by CNG/KSP from a certificate imported by the
 		/// Azure Key Vault VM extension). The SSH library will call
-		/// <see cref="RSA.SignData"/> and <see cref="RSA.VerifyData"/> on the
-		/// provided instance directly, without ever needing to export raw key material.
+		/// <see cref="RSA.SignData(byte[], int, int, HashAlgorithmName, RSASignaturePadding)"/> and
+		/// <see cref="RSA.VerifyData(byte[], int, int, byte[], HashAlgorithmName, RSASignaturePadding)"/>
+		/// on the provided instance directly, without ever needing to export raw key material.
 		/// </remarks>
 		public KeyPair(RSA algorithm)
 		{
diff --git a/src/cs/Ssh/IO/Buffer.cs b/src/cs/Ssh/IO/Buffer.cs
index 2052aff..bf4b10e 100644
--- a/src/cs/Ssh/IO/Buffer.cs
+++ b/src/cs/Ssh/IO/Buffer.cs
@@ -130,8 +130,8 @@ public byte[] ToArray()
 		return Copy().Array;
 	}
 
-#if SSH_ENABLE_SPAN
 #pragma warning disable CA2225 // Operator overloads have named alternates
+#if SSH_ENABLE_SPAN
 
 	public Span<byte> Span => new Span<byte>(Array, Offset, Count);
 
@@ -141,13 +141,13 @@ public byte[] ToArray()
 
 	public static implicit operator Memory<byte>(Buffer buffer) => buffer.Memory;
 
-#pragma warning restore CA2225 // Operator overloads have named alternates
 #endif
 
 	public static implicit operator Buffer(byte[] array)
 	{
 		return Buffer.From(array ?? System.Array.Empty<byte>());
 	}
+#pragma warning restore CA2225 // Operator overloads have named alternates
 
 	public override bool Equals(object? obj)
 	{
diff --git a/src/cs/Ssh/Services/KeyExchangeService.cs b/src/cs/Ssh/Services/KeyExchangeService.cs
index 91daec9..c4b0920 100644
--- a/src/cs/Ssh/Services/KeyExchangeService.cs
+++ b/src/cs/Ssh/Services/KeyExchangeService.cs
@@ -385,6 +385,7 @@ private async Task HandleMessageAsync(
 		var clientExchangeValue = message.E;
 		var serverExchangeValue = keyExchange.StartKeyExchange();
 		var sharedSecret = keyExchange.DecryptKeyExchange(clientExchangeValue);
+		
 		// RFC 8332 §3: Host key blob MUST use "ssh-rsa", not the signature algorithm name.
 		// PuTTY-based clients (FileZilla, WinSCP) reject host keys with wrong key type.
 		var hostKeyAndCerts = privateKey.GetPublicKeyBytes(publicKeyAlg.KeyAlgorithmName);