[
https://issues.apache.org/jira/browse/TOMEE-4701?focusedWorklogId=1040015&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1040015
]
ASF GitHub Bot logged work on TOMEE-4701:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 07/Sep/26 19:00
Start Date: 07/Sep/26 19:00
Worklog Time Spent: 10m
Work Description: rzo1 opened a new pull request, #2934:
URL: https://github.com/apache/tomee/pull/2934
Fixes [TOMEE-4701](https://issues.apache.org/jira/browse/TOMEE-4701).
`openejb-ssh` is a leaf module with no consumers: outside its own directory
it is only
referenced by the `<module>` line in `server/pom.xml`. It is not part of any
BOM, not
part of `apache-tomee` and not part of the `openejb-standalone` assembly —
it is only
published as a standalone jar/zip that a user would have to drop into `lib/`
by hand,
as `docs/ssh.adoc` describes.
It exposes a JAAS-authenticated remote shell with `deploy`, `undeploy`, `jmx
invoke`,
`cat`, `ls` and JSR-223 `script` commands. That is a large, unmaintained
attack surface
for a feature that is opt-in, undocumented outside a single legacy page, and
effectively
unused.
### Changes
- removed `server/openejb-ssh`
- removed the `openejb-ssh` module from `server/pom.xml`
- removed the `org.apache.sshd:sshd-core` entry from the root `pom.xml`
`dependencyManagement` (`openejb-ssh` was its only consumer)
- removed the now-obsolete `rat.xml` exclude for
`server/openejb-ssh/src/test/key/ssh-key.ser`
- removed `docs/ssh.adoc`
`jline:jline` is kept in `dependencyManagement` — it is still used by
`openejb-common-cli`, `tomee/apache-tomee` and the `polling-parent` example.
### Follow-up
This leaves `server/openejb-common-cli` without any consumer — `openejb-ssh`
was its
only dependent. Tracked separately as
[TOMEE-4702](https://issues.apache.org/jira/browse/TOMEE-4702).
`mvn validate` passes on the full reactor.
Issue Time Tracking
-------------------
Worklog Id: (was: 1040015)
Time Spent: 20m (was: 10m)
> Drop openejb-ssh
> ----------------
>
> Key: TOMEE-4701
> URL: https://issues.apache.org/jira/browse/TOMEE-4701
> Project: TomEE
> Issue Type: Task
> Reporter: Richard Zowalla
> Assignee: Richard Zowalla
> Priority: Major
> Fix For: 11.0.0, 10.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
