Bug#1081033: Please consider switching to the com.github.mwiede:jsch fork

[tony mancill]

Hi Pierre,

On Sat, Sep 07, 2024 at 12:12:28PM +0200, Pierre Gruet wrote:
> Source: jsch
> Severity: wishlist
> 
> Dear Maintainer,
> 
> When working on a rdep of jsch, I stumbled upon
>     https://github.com/apache/mina-sshd/pull/475
> which is an (accepted) pull request of this rdep to switch from the historical,
> motionless jsch to an active fork com.github.mwiede:jsch.
> Should we in Debian to that move too?
> 
> The rdep libmina-sshd-java of jsch began relying on the fork and I patched its
> code to have it build against the historical jsch.

I think we should migrate to the maintained fork, particuarly since it
is a relatively popular package.  Thank you for filing the bug!

Based on the number of rdeps, we might want to treat it as a transition
(of sorts) and start with an upload to experimental.  Do you think we
should provide the com.jcraft:jsch maven coordinates in the new package,
in addition to com.github.mwiede:jsch?  It would probably make the
transition easier.

There are potentially breaking changes in behavior at runtime [1]
related to use of deprecated crypto algorithms, so the sooner the better
if we are aiming to complete this for trixie.

Cheers,
tony

[1] https://github.com/mwiede/jsch?tab=readme-ov-file#is-this-fork-100-compatible-with-original-jsch-because-the-connection-to-my-server-does-not-work-any-more
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20240907/3c2f0311/attachment.sig>