slachiewicz opened a new issue, #901:
URL: https://github.com/apache/maven-wagon/issues/901

   ### Affected version
   
   3.5.3 and every earlier release, plus `master`.
   
   ### Description
   
   `wagon-ssh` depends on `com.jcraft:jsch:0.1.55`, last released on 
2018-11-26, and on `com.jcraft:jsch.agentproxy.*:0.0.9` from 2014. Neither has 
a maintainer. This is not only a hygiene problem — the provider is already 
broken against current servers and current keys:
   
   - 0.1.55 implements neither `rsa-sha2-256` nor `rsa-sha2-512`, so RSA public 
key authentication fails against OpenSSH 8.8 and later, which stopped accepting 
`ssh-rsa` (SHA-1) signatures by default in 2021.
   - 0.1.55 cannot read the OpenSSH-v1 private key format, which `ssh-keygen` 
has emitted by default since OpenSSH 7.8 in 2018.
   
   So a user generating a key today, on a server released any time in the last 
four years, cannot authenticate with it.
   
   ### Proposal
   
   Move to `com.github.mwiede:jsch`, the maintained fork, currently **2.28.6** 
(2026-07-29). This is what #680 asked for in 2021, from the fork's own author. 
Recording the evaluation here so the decision has the details in one place.
   
   **Why the fork rather than a different library**
   
   - It keeps the `com.jcraft.jsch` package and the same API. Every type this 
provider uses is present: `JSch`, `Session`, `ChannelExec`, `ChannelSftp`, 
`SftpATTRS`, `UserInfo`, `UIKeyboardInteractive`, `HostKey`, 
`HostKeyRepository`, `IdentityRepository`, `ProxyHTTP`, `ProxySOCKS5`.
   - Its base bytecode is Java 8, so it fits the 3.x baseline.
   - The JSch coupling here is 7 files and about 1565 lines, all under 
`wagon-ssh/.../providers/ssh/jsch/`. `wagon-ssh-common` refers to 
`com.jcraft.jsch.UserInfo` only in a javadoc `@see`, so the shared module has 
no compile dependency on it.
   
   **Apache MINA SSHD was considered and does not fit today.** It would be the 
natural choice inside the foundation, and it is already a test dependency of 
`wagon-ssh-common-test`. But `AbstractJschWagon` supports connecting *through* 
HTTP and SOCKS5 proxies, and MINA SSHD 2.x has no client-side 
connect-through-proxy — apache/mina-sshd#481, with a fix deferred to the 3.0 
filter chain. Porting onto 2.x would silently drop that for the corporate users 
most likely to still be deploying over scp. Worth revisiting when 3.0 lands.
   
   `sshj` was not pursued: it costs a full port like MINA and adds a mandatory 
BouncyCastle dependency.
   
   **Licensing** is not a concern: the fork keeps JSch's BSD/ISC terms, which 
are ASF Category A. Apache Camel (CAMEL-17835) and Apache Commons VFS (VFS-837) 
have both already made this switch.
   
   ### What the change involves
   
   Not quite a coordinate swap. The `com.jcraft.jsch.agentproxy.*` types the 
provider imports — `ConnectorFactory`, `Connector`, `RemoteIdentityRepository` 
— have no counterpart in the fork, which integrates the agent as 
`SSHAgentConnector`, `AgentConnector` and `AgentIdentityRepository`. That is 
roughly fifteen lines in `AbstractJschWagon`, and the two `jsch.agentproxy` 
artifacts go away.
   
   ### Behaviour changes to put in the release notes
   
   - The fork disables `ssh-rsa` (SHA-1) by default. Deploying to an old server 
or appliance that offers nothing newer needs `-Djsch.server_host_key=+ssh-rsa 
-Djsch.client_pubkey=+ssh-rsa`.
   - Ed25519 keys need Java 15+ at runtime, or BouncyCastle on the classpath.
   - Reaching the SSH agent uses a Unix domain socket, which the JDK provides 
from Java 16. Below that it depends on a helper library being present.
   - Host key type negotiation order differs, so a host whose `known_hosts` 
entry is an old `ssh-rsa` key may need re-accepting.
   
   ### Related
   
   - #680 — the original request from the fork's author, which this carries 
forward.
   - #503 — SSH agent authentication not working. Worth doing in the same 
release, but it is a **separate bug in wagon's own logic** and this change does 
not fix it.
   
   ### Verification before release
   
   The `-Dssh-tests` profile is excluded by default and should be run for this. 
Those tests use the embedded MINA server and exercise the host key error paths, 
which match on JSch's exception *message text* — the one place a library swap 
could break something quietly.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to