- Long docstring and command lines are wrapped; recorded device output in
tests/ keeps its lines (E501 is off there).
- host_firewall: the negation token is the named constant _NEGATION. bandit
read token == "!" as a hardcoded password.
- ssh_host_keys: _known_hosts_file takes the expected key as an argument
instead of asserting it; both callers had already returned when it is None.
- ssh_server: the staged path is on the device, not a local temp file
(nosec B108).
- tests: raise ... from exc, zip(strict=True).
christianmanivong
b7350a9b2c