eclipse-platform / eclipse-platform/eclipse.platform

Replace or remove org.eclipse.jsch plugins?

Open
#958 29 comments 2 reactions 0 assignees View on GitHub
api dependencies
Dominant language
Java
Stars
165
Forks
174
Avg merge
2d 8h
Merged PRs (30d)
22

Description

## Suggestion

The JSch library seems to be abandoned, the last uploads to [source forge](https://sourceforge.net/projects/jsch/) and [Maven-Central](https://mvnrepository.com/artifact/com.jcraft/jsch) were in Nov 2018.
There is a fork available at https://github.com/mwiede/jsch, which regularly publishes updates.
Nevertheless I think it would be good to get rid of outdated dependencies especially in security sensitive areas (I'm surprised there is not CVE listed yet).

The only user in the Eclipse SDK seems to be `org.eclipse.jsch.core` and `org.eclipse.jsch.ui`, which seem to provide the ability to create password protected SSH connections, but I have not yet analyzed its full usage and capabilities.

Depending on the usages I see two options for
1. Deprecate this Plugin for removal without replacement
2. Replace it by an API not bound to a specific third party library and e.g. use MINA SSHD under the hood (which also has proper OSGi metadata so a simplification for SimRel-Orbit). This API would then probably be under another package name (in which ever plugin it is).

## Community

- [x] I understand suggesting an enhancement doesn't mandate anyone to implement it. Other contributors may consider this suggestion, or not, at their own convenience. The most efficient way to get it fixed is that I implement it myself and contribute it back as a good quality patch to the project.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.