motiejus
/
jgit
1
Fork 0
Code Releases Activity
jgit/org.eclipse.jgit.ssh.jsch
History
Matthias Sohn 6007371e3a Enable Maven reproducible builds 
- configure Maven to run build reproducibly [1]
- use UTC timestamp of checked out commit as build timestamp
- add git-describe, git-commit-id, git-commit-id, git-tags,
  git-remote-origin-url to MANIFEST.MF files
- configure cyclonedx-maven-plugin to also use UTC timestamp of
  checked out commit
- for packaging build use tycho-buildtimestamp-jgit [2] to ensure
  version uses the timestamp of the last commit
- SBOMs are not reproducible by design [3] they should have a build
  timestamp matching the time when the build was executed and a serial
  number which is a unique UUID per build run. Hence exclude them from
  comparison [4].
- Use gmavenplus-plugin to format build timestamps. Maven expects
  build timestamp in ISO-8601 format, to replace the qualifier in
  versions the timestamp format must be compatible with rules for OSGi
  version numbers. Didn't find a way to read the properties set by the
  git-commit-id-maven-plugin from another plugin. Hence use JGit in a
  groovy script to get the commit time of the current HEAD and provide
  it in these two formats.

TODO: packaging build (features and p2 repository) is not yet binary
reproducible since that's not yet supported by Tycho [5], artefacts have
reproducible version numbers but file lastModified timestamps are not
yet reproducible.

Test plan for Maven build:
- build using
  mvn clean install"
- verify second build is reproducible:
  mvn -T1 clean verify artifact:compare
  verification seems not to be thread-safe, hence run it with a single
  thread using option -T1

For packaging build (still fails due to non-reproducible file
timestamps):
- build using
  mvn -f org.eclipse.jgit.packaging/pom.xml clean install
- verify second build is reproducible:
  mvn -T1 -f org.eclipse.jgit.packaging/pom.xml clean verify artifact:compare

[1] https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[2] https://wiki.eclipse.org/Tycho/Reproducible_Version_Qualifiers
[3] https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/84
[4] https://maven.apache.org/plugins/maven-artifact-plugin/compare-mojo.html
[5] https://github.com/eclipse-tycho/tycho/issues/233

Change-Id: I0202f55a1b6ae0edd922cfef638beb39d2ce9417
 		2023-11-09 00:08:42 +01:00
..
.settings Fix all Javadoc warnings and fail on them 2023-06-16 01:08:13 +02:00
META-INF OSGi: move plugin localization to subdirectory 2023-09-12 20:27:59 +02:00
OSGI-INF/l10n OSGi: move plugin localization to subdirectory 2023-09-12 20:27:59 +02:00
resources Fix the path for JSchText.properties 2022-11-07 09:20:49 -05:00
src/org/eclipse/jgit [errorprone] Add missing javadoc summary 2023-09-25 22:06:13 +02:00
.classpath Bump minimum required Java version to 11 2021-09-29 17:12:12 +02:00
.fbprefs Decouple JSch from JGit Core 2020-06-01 01:46:59 +02:00
.gitignore Decouple JSch from JGit Core 2020-06-01 01:46:59 +02:00
.project Decouple JSch from JGit Core 2020-06-01 01:46:59 +02:00
BUILD Decouple JSch from JGit Core 2020-06-01 01:46:59 +02:00
README.md Typo fix in o.e.j.ssh.{jsch,apache}/README.md 2021-11-15 22:26:21 +01:00
about.html Decouple JSch from JGit Core 2020-06-01 01:46:59 +02:00
build.properties OSGi: move plugin localization to subdirectory 2023-09-12 20:27:59 +02:00
pom.xml Enable Maven reproducible builds 2023-11-09 00:08:42 +01:00

README.md

JGit SSH support via JSch

This bundle provides an implementation of git transport over SSH implemented via JSch.

This bundle should be considered deprecated. It is essentially unmaintained, and the JGit project may decide anytime to remove it completely without further ado.

The officially supported SSH transport is in bundle org.eclipse.jgit.ssh.apache and is built upon Apache MINA sshd.

Service registration

This bundle declares a service for the java.util.ServiceLoader for interface org.eclipse.jgit.transport.ssh.SshSessionFactory. The core JGit bundle uses the service loader to pick up an implementation of that interface. The bundle in an OSGi fragment to ensure that the service loader works in an OSGi environment without the need to install a service loader bridge.

Note that JGit simply uses the first SshSessionFactory provided by the ServiceLoader.

Using a different SSH implementation

To use a different SSH implementation:

  • Do not include this bundle in your product.
  • Include the bundle of the alternate implementation.
    • If the service loader finds the alternate implementation, nothing more is needed.
    • Otherwise ensure the service declaration from the other bundle is on the Classpath of bundle org.eclipse.jgit,
    • or set the SshSessionFactory for JGit explicitly (see below).

Configuring an SSH implementation for JGit

The simplest way to set an SSH implementation for JGit is to install it globally via SshSessionFactory.setInstance(). This instance will be used by JGit for all SSH connections by default.

It is also possible to set the SSH implementation individually for any git command that needs a transport (TransportCommand) via a org.eclipse.jgit.api.TransportConfigCallback.

To do so, set the wanted SshSessionFactory on the SSH transport, like:

SshSessionFactory customFactory = ...; // Get it from wherever
FetchCommand fetch = git.fetch()
  .setTransportConfigCallback(transport -> {
    if (transport instanceof SshTransport) {
      ((SshTransport) transport).setSshSessionFactory(customFactory);
    }
  })
  ...
  .call();

Using an external SSH executable

JGit has built-in support for not using any Java SSH implementation but an external SSH executable. To use an external SSH executable, set environment variable GIT_SSH to the path of the executable. JGit will create a sub-process to run the executable and communicate with this sub-process to perform the git operation.