oscerd commented on PR #29094: URL: https://github.com/apache/camel/pull/29094#issuecomment-6637636374
Pushed `CAMEL-26549: Address review feedback - which hybrid group each server negotiates, the [email protected] name, the jsch.kex property for scp, and the Bouncy Castle provider registration of sshd` (3df6c5f6655e) on top of 4944b24dd5f3. Documentation only, catalog copies included: - Upgrade guide: Apache MINA SSHD registers Bouncy Castle as the security provider of all its cryptography in camel-mina-sftp (key factories, key pair generation, key agreement, signatures and digests), with `-Dorg.apache.sshd.security.provider.BC.enabled=false` as the opt-out. - Upgrade guide: `scp` (camel-jsch) has no `keyExchangeProtocols`; the proposal is pinned for the JVM with the `jsch.kex` system property, with an example. - Upgrade guide, mina-sftp and ssh pages: sshd proposes `sntrup761x25519-sha512` first, under both its names, so OpenSSH 9.9 and later negotiates that rather than ML-KEM, and `mlkem768x25519-sha256` has to go first in the option to prefer ML-KEM. Checked against the default proposal order of sshd-core 2.20.0. - The examples that require a post-quantum exchange on the mina-sftp, sftp and ssh pages now include `[email protected]`, the only hybrid group an OpenSSH server before 9.9 offers, and the sftp page says that jsch does not propose it by default (jsch 2.28.8 defaults `kex` to `mlkem768x25519-sha256,curve25519-sha256,...` and supports the `@openssh.com` group when it is listed). - bcprov in camel-ftp: deliberate. camel-ftp is one module for ftp, ftps and sftp, and an optional dependency would keep the silent classical fallback for the sftp users this change is for. For plain FTP and FTPS it is 8 MB on disk and nothing loads it, since only jsch uses it. The description still offers the optional dependency if you prefer it. Review re-requested. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
