Hi tony, Le 07/09/2024 à 19:19, tony mancill a écrit :
Hi Pierre,On Sat, Sep 07, 2024 at 12:12:28PM +0200, Pierre Gruet wrote:Source: jsch Severity: wishlist Dear Maintainer, When working on a rdep of jsch, I stumbled upon https://github.com/apache/mina-sshd/pull/475 which is an (accepted) pull request of this rdep to switch from the historical, motionless jsch to an active fork com.github.mwiede:jsch. Should we in Debian to that move too? The rdep libmina-sshd-java of jsch began relying on the fork and I patched its code to have it build against the historical jsch.I think we should migrate to the maintained fork, particuarly since it is a relatively popular package. Thank you for filing the bug!
And thanks for your comments! :)
Based on the number of rdeps, we might want to treat it as a transition (of sorts) and start with an upload to experimental. Do you think we should provide the com.jcraft:jsch maven coordinates in the new package, in addition to com.github.mwiede:jsch? It would probably make the transition easier.
I agree, both for the passage through experimental and the former Maven coordinates in the package.
There are potentially breaking changes in behavior at runtime [1] related to use of deprecated crypto algorithms, so the sooner the better if we are aiming to complete this for trixie.
I offer to make the package and send it to experimental (no epoch needed!) so that we can check the rdeps. I will do so within a few days if you also find it convenient!
Cheers, tony [1] https://github.com/mwiede/jsch?tab=readme-ov-file#is-this-fork-100-compatible-with-original-jsch-because-the-connection-to-my-server-does-not-work-any-more
All the best, -- Pierre
OpenPGP_signature.asc
Description: OpenPGP digital signature
