Bug#1081033: Please consider switching to the com.github.mwiede:jsch fork

[Pierre Gruet]

Hi tony,

Le 07/09/2024 à 19:19, tony mancill a écrit :
> Hi Pierre,
> 
> On Sat, Sep 07, 2024 at 12:12:28PM +0200, Pierre Gruet wrote:
>> Source: jsch
>> Severity: wishlist
>>
>> Dear Maintainer,
>>
>> When working on a rdep of jsch, I stumbled upon
>>      https://github.com/apache/mina-sshd/pull/475
>> which is an (accepted) pull request of this rdep to switch from the historical,
>> motionless jsch to an active fork com.github.mwiede:jsch.
>> Should we in Debian to that move too?
>>
>> The rdep libmina-sshd-java of jsch began relying on the fork and I patched its
>> code to have it build against the historical jsch.
> 
> I think we should migrate to the maintained fork, particuarly since it
> is a relatively popular package.  Thank you for filing the bug!

And thanks for your comments! :)

> 
> Based on the number of rdeps, we might want to treat it as a transition
> (of sorts) and start with an upload to experimental.  Do you think we
> should provide the com.jcraft:jsch maven coordinates in the new package,
> in addition to com.github.mwiede:jsch?  It would probably make the
> transition easier.

I agree, both for the passage through experimental and the former Maven 
coordinates in the package.

> 
> There are potentially breaking changes in behavior at runtime [1]
> related to use of deprecated crypto algorithms, so the sooner the better
> if we are aiming to complete this for trixie.

I offer to make the package and send it to experimental (no epoch 
needed!) so that we can check the rdeps. I will do so within a few days 
if you also find it convenient!

> 
> Cheers,
> tony
> 
> [1] https://github.com/mwiede/jsch?tab=readme-ov-file#is-this-fork-100-compatible-with-original-jsch-because-the-connection-to-my-server-does-not-work-any-more

All the best,

-- 
Pierre
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20240907/8b3a4923/attachment.sig>