Feat/ci/pyenv python tests

[zeroSteiner]

Description

Draft -- depends on #21746 (adds test/pyenv/Containerfile and the pyenv_image_publish.yml GHCR publish workflow). This branch is stacked on that one, so the diff below includes its commits until it merges -- the new work here starts at "Extend command shell handler-started regex...".

Expands command_shell_spec.rb acceptance coverage to non-SSL Python shell payloads that weren't previously tested: python/shell_reverse_tcp, python/shell_bind_tcp, and cmd/unix/reverse_python. python/shell_bind_tcp required extending the handler-started regex to recognize bind/UDP handler messages (it previously only matched reverse TCP/SSL).

Also merges spec/support/acceptance/command_shell/python_ssl.rb into python.rb so all Python command shell fixtures (SSL and non-SSL) live in one file instead of being split by SSL-support across two, and points the existing python_ssl_* tests at the GHCR image published by the sibling PR instead of the personal ECR image.

python/shell_reverse_sctp and python/shell_reverse_udp are intentionally not covered here. UDP in particular was attempted and dropped: post/test/unix consistently failed against it locally, traced to the payload's lock-step send/recv protocol having no retry on packet loss, which doesn't play well with the shell session's read-timeout budget. That looks like a pre-existing reliability gap in the payload/handler, not something introduced by this PR, but it's out of scope to fix here.

Related Issue:

Breaking Changes

None. python_ssl.rb is removed but every constant it exported (PYTHON_SSL_IMAGE, PYTHON_SSL_2_6, PYTHON_SSL_2_7, PYTHON_SSL_3_4, PYTHON_SSL_3_13) still exists, now in python.rb -- nothing external references the file path directly, only the auto-loaded constants.

Reviewer Notes

• This will stay a draft until the sibling image-publish PR merges and its workflow is run against master for real. The PYTHON_SSL_IMAGE constant currently points at ghcr.io/rapid7/metasploit-framework/pyenv@sha256:bc3398ad96f06ac4c9f2a371488b7b75c60eaaa37531da1dcf98ce47b5191fb7, which does not exist yet. I'll update that digest myself once the real image is published, and re-run the verification command below to confirm before marking this ready for review.
• I validated everything that can be validated pre-publish: the same digest above was built and pushed to my own fork (ghcr.io/zerosteiner/metasploit-framework/pyenv@...) as part of proving the sibling PR's publish workflow end-to-end, and all eight python_ssl_* examples pass locally against that fork-hosted copy. Only the final rapid7-owned digest is unverified, and only because it doesn't exist yet.
• Caught a real version-pin drift while validating: PYTHON_SSL_3_13 was pinned to PYENV_VERSION=3.13.7, but the Containerfile (sibling PR, copied from a private source unchanged) only installs 3.13.13. The old ECR image apparently predates that patch bump. Updated the pin to match -- otherwise every python_ssl_3_13 job would fail against the new image.
• The python_ssl.rb -> python.rb merge is its own commit with zero behavior change (pure git mv + constant consolidation) -- worth reviewing separately from the commit that adds the new non-SSL payloads, if that's easier to follow.

Verification Steps

Requires docker or podman. The rapid7-hosted image isn't published yet, so temporarily point PYTHON_SSL_IMAGE in spec/support/acceptance/command_shell/python.rb at ghcr.io/zerosteiner/metasploit-framework/pyenv@sha256:bc3398ad96f06ac4c9f2a371488b7b75c60eaaa37531da1dcf98ce47b5191fb7 (the fork-hosted copy I validated this against) before running:

SPEC_OPTS='--tag acceptance' SPEC_HELPER_LOAD_METASPLOIT=false bundle exec rspec spec/acceptance/command_shell_spec.rb

Expected: all linux, python, and python_ssl_* examples pass. (Once the sibling PR's image is published for real, that temporary edit won't be needed -- the committed rapid7 reference will just work.)

Test Evidence

Environment

Field	Details
Operating System	Linux (local dev) / ubuntu-latest (GitHub Actions runner)
Target Software/Hardware	Python 2.6-3.13 command shell payloads
Docker Image / Vagrant Setup	test/pyenv/Containerfile (from the sibling image-publish PR)

AI Usage Disclosure

Claude Code was used throughout this branch: the file consolidation, the new acceptance test fixtures, the regex/datastore changes, and running/iterating on local acceptance test validation before each commit.

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above (pending sibling PR's real image publish)
• Included RSpec tests for library changes (encouraged for lib/ changes)
• Read the CONTRIBUTING.md and module acceptance guidelines

Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.

[adfoster-r7]

Replaced this workflow with internal jenkins and dockerhub