search

eclipse-jgit / jgit

JGit, the Java implementation of git
https://www.eclipse.org/jgit/
Other
92 stars 31 forks source link

Add possible configuration of ServerKeyVerifier for SshdSessionFactory #56

Closed olamy closed 1 month ago

olamy commented 1 month ago

Signed-off-by: Olivier Lamy olamy@apache.org

Thank you for contributing to JGit!

JGit uses GerritHub for code changes and review, therefore pull requests in this repository cannot be merged.

Please make sure you have read the section on contributing patches of the Contributor Guide.

olamy commented 1 month ago

@davido well I have been to Gerrit but when I want to create a change. nothing proposed my fork or whatever so I'm really stuck... how can I propose a change?

Screenshot from 2024-05-24 17-36-32

msohn commented 1 month ago

Gerrit doesn't use forks but automatically generated refs under refs/changes to track changes in review.

Changes are created by pushing to refs/for/<branch name>, most commonly git push origin HEAD:refs/for/master.

Ensure that the commits you are pushing have a Change-Id trailer in the commit message which are generated by the commit-msg hook. If you push without a Change-Id Gerrit will respond with instructions how to install the hook and amend the commit. The "Clone with commit-msg hook" command given here https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit,general automatically installs the commit-msg hook.

Find more instructions in the contributor guide.

tomaswolf commented 1 month ago

@olamy: we would not be able to merge this anyway. SshdSessionFactory or any other public API of bundle org.eclipse.jgit.ssh.apache must not expose any upstream classes or interfaces from Apache MINA SSHD.

What is the use case that prompted this change? To plug in a different host key storage, you could configure your own ServerKeyDatabase.

olamy commented 1 month ago

@olamy: we would not be able to merge this anyway. SshdSessionFactory or any other public API of bundle org.eclipse.jgit.ssh.apache must not expose any upstream classes or interfaces from Apache MINA SSHD.

Agree, this makes sense.

What is the use case that prompted this change? To plug in a different host key storage, you could configure your own ServerKeyDatabase.

Currently, the Jenkins git plugin is under modification to use Mina as ssh transport layer for JGit (https://github.com/jenkinsci/git-client-plugin/pull/1127) and Jenkins have a configurable way of validating host. There is a solution in place but I don't like it much :). The idea is to be able to re use all the convenient sub classes of org.apache.sshd.client.keyverifier.ServerKeyVerifier to have a more simple code. Having our own ServerKeyDatabase means managing by ourself knowhost files I will look at this but not sure whitout reinventing the wheel :) but looking at this again there is maybe something possible.

olamy commented 1 month ago

found something with tricking ServerKeyDatabase. Thanks for the hint!