rzo1 opened a new pull request, #2933: URL: https://github.com/apache/tomee/pull/2933
Fixes [TOMEE-4701](https://issues.apache.org/jira/browse/TOMEE-4701). `openejb-ssh` is a leaf module with no consumers: outside its own directory it is only referenced by the `<module>` line in `server/pom.xml`. It is not part of any BOM, not part of `apache-tomee` and not part of the `openejb-standalone` assembly — it is only published as a standalone jar/zip that a user would have to drop into `lib/` by hand, as `docs/ssh.adoc` describes. It exposes a JAAS-authenticated remote shell with `deploy`, `undeploy`, `jmx invoke`, `cat`, `ls` and JSR-223 `script` commands. That is a large, unmaintained attack surface for a feature that is opt-in, undocumented outside a single legacy page, and effectively unused. ### Changes - removed `server/openejb-ssh` - removed the `openejb-ssh` module from `server/pom.xml` - removed the `org.apache.sshd:sshd-core` entry from the root `pom.xml` `dependencyManagement` (`openejb-ssh` was its only consumer) - removed the now-obsolete `rat.xml` exclude for `server/openejb-ssh/src/test/key/ssh-key.ser` - removed `docs/ssh.adoc` `jline:jline` is kept in `dependencyManagement` — it is still used by `openejb-common-cli`, `tomee/apache-tomee` and the `polling-parent` example. ### Follow-up This leaves `server/openejb-common-cli` without any consumer — `openejb-ssh` was its only dependent. Tracked separately as [TOMEE-4702](https://issues.apache.org/jira/browse/TOMEE-4702). `mvn validate` passes on the full reactor. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
