oscerd opened a new pull request, #2967:
URL: https://github.com/apache/camel-kamelets/pull/2967
Fixes #2955
### `strictHostKeyChecking` defaulted to `no`
`sftp-sink`, `sftp-source` and `scp-sink` declared:
```yaml
strictHostKeyChecking:
type: string
default: no
```
so the server host key was accepted without being checked against a
`known_hosts` entry.
Changed to `default: "yes"`, with an `enum` constraining the value to `yes`
/ `no` / `ask`, and a description that says what `no` actually means.
### `knownHostsUri` added
`useUserKnownHostsFile` was already declared on all three and defaults to
`true`, so with strict checking on the client falls back to
`$HOME/.ssh/known_hosts`. That file frequently does not exist in a container,
so a `knownHostsUri` property is added and bound, matching the existing
`privateKeyUri` shape and `pattern`.
### `ssh-sink` / `ssh-source` had no host-key option at all
`camel-ssh` only installs a host-key verifier when `knownHostsResource` is
set — *"When not set, the client does not verify the server host key against a
known_hosts file."* Neither Kamelet surfaced it, so host-key verification was
unreachable through the Kamelet interface even for an operator who wanted it.
Both now declare and bind `knownHostsResource`.
### Behaviour change
This is the disruptive one of the batch. Existing SFTP/SCP deployments that
relied on the permissive default will fail to connect until either the host key
is in a `known_hosts` file the process can read, `knownHostsUri` is pointed at
one, or `strictHostKeyChecking=no` is set explicitly. `camel-kamelets` has no
upgrade guide of its own, so the note belongs in the `apache/camel` upgrade
guide for the release that picks this up — flagging for a maintainer.
Worth a maintainer's judgement on whether the default flip should ship
together with the new property in one release, or whether the property should
land first and the default flip follow.
### Verification
- `script/validator` reports no errors
- `mvn verify` passes
- Option names and semantics taken from the Camel 4.22.0 catalog for `sftp`
and `ssh`; not exercised against a live SSH server
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
