Re: [egit-dev] [jgit-dev] Bug 520927: moving away from JSch

[Matthias Sohn <matthias.sohn@xxxxxxxxx>]

On Sun, Nov 18, 2018 at 6:47 PM Randall S. Becker <rsbecker@xxxxxxxxxxxxx> wrote:

Thomas,

Apache Mina SSHD is not available on the HPE NonStop platform to my
knowledge. My team is generally responsible for ports, and I would have
heard about this one being done. So it's not a capability issue between the
two, it is an availability issue.

Why is Mina SSHD not available on HPE NonStop ? It's implemented in Java. And if this platform

doesn't support Java then JGit is useless anyway.

From a security point of view relying on a non maintained (and unmaintainable) security relevant library

like jsch is not a good idea. Since there is no known repository with the jsch source code history and

there are no automated tests it's also pretty unlikely that anyone will step up and take over maintenance

of jsch.

Hence I think we should completely get rid of jsch.

-Matthias

 

Randall

> -----Original Message-----
> From: Gunnar Wagenknecht <gunnar@xxxxxxxxxxxxxxx>
> Sent: November 18, 2018 12:43
> To: Randall S. Becker <rsbecker@xxxxxxxxxxxxx>
> Cc: Thomas Wolf <thomas.wolf@xxxxxxxxxx>; EGit developer discussion
> <egit-dev@xxxxxxxxxxx>; JGit Developers list <jgit-dev@xxxxxxxxxxx>
> Subject: Re: [egit-dev] Bug 520927: moving away from JSch
>
> Randall,
>
> > On Nov 18, 2018, at 18:32, Randall S. Becker <rsbecker@xxxxxxxxxxxxx>
> wrote:
> >
> > From a headless perspective, JGit is used on platforms that do not
> > support either EGit or the specific sshd implementation being integrated
> here.
>
> Can you clarify the specific limitations around Apache Mina SSHD in
> comparison to JSch?
>
> -Gunnar
>
> --
> Gunnar Wagenknecht
> gunnar@xxxxxxxxxxxxxxx, http://guw.io/


_______________________________________________
jgit-dev mailing list
jgit-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/jgit-dev