DevHeads.net

F28 System Wide Change: Switch libcurl to use libssh instead of libssh2

= System Wide Change:Switch libcurl to use libssh instead of libssh2 =
<a href="https://fedoraproject.org/wiki/Changes/libssh-in-libcurl" title="https://fedoraproject.org/wiki/Changes/libssh-in-libcurl">https://fedoraproject.org/wiki/Changes/libssh-in-libcurl</a>

Change owner(s):
* Kamil Dudka <kdudka AT redhat DOT com>

libcurl currently uses libssh2 to implement the SSH layer of SCP and
SFTP protocols. After implementing this change, libcurl will use the
libssh library instead.

== Detailed Description ==
libcurl currently uses libssh2 to implement the SSH layer of SCP and
SFTP protocols. The libssh2 library uses outdated crypto algorithms
and lacks important features like GSS-API authentication. After
implementing this change, libcurl will use the libssh library instead,
which is now more secure, feature-complete, and with more active
upstream community.

== Scope ==
* Proposal owners:
kdudka (will switch the SSH library in the curl package once it is
supported upstream)

* Other developers:
nmav (currently working on the related pull-request with curl upstream)

* Release engineering:
No action from release engineering is needed for this change (libcurl
ABI is kept), releng review requested at
<a href="https://pagure.io/releng/issue/7193" title="https://pagure.io/releng/issue/7193">https://pagure.io/releng/issue/7193</a>

* Policies and guidelines:
unaffected

* Trademark approval:
not needed

Comments

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Richard W.M. Jones at 12/05/2017 - 10:36

Tangentially related to this, we're trying to change qemu to use
libssh instead of libssh2. Upstream reviewers welcome!

<a href="https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02843.html" title="https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02843.html">https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02843.html</a>

Rich.

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Michael Cronenworth at 12/04/2017 - 10:31

On 12/04/2017 07:47 AM, Jan Kurik wrote:
They are both equally active. If you were worried about ECDSA support, guess what?
Libssh2 now supports it:

<a href="https://github.com/libssh2/libssh2/issues/41" title="https://github.com/libssh2/libssh2/issues/41">https://github.com/libssh2/libssh2/issues/41</a>

I'm not sure this change is really warranted.

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Kamil Dudka at 12/04/2017 - 10:58

On Monday, December 4, 2017 3:31:32 PM CET Michael Cronenworth wrote:
How are you backing up your statement?

If we count upstream commits in 2017, I see 93 commits in libssh whereas
only 13 commits in libssh2 (including two commits authored by me).

You are not referring to any upstream commit. The link above points to a
Github issue, which is open since September 2015 and without any progress
since September 2017.

Kamil

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Michael Cronenworth at 12/04/2017 - 11:05

On 12/04/2017 08:58 AM, Kamil Dudka wrote:
The commit is in the issue, which you will find a PR for it.

<a href="https://github.com/libssh2/libssh2/pull/206" title="https://github.com/libssh2/libssh2/pull/206">https://github.com/libssh2/libssh2/pull/206</a>

The libssh2 upstream may not be as "fast" as the libssh upstream, but there is still
active involvement from the maintainers on both sides.

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Kamil Dudka at 12/04/2017 - 11:32

On Monday, December 4, 2017 4:05:49 PM CET Michael Cronenworth wrote:
You are still not referring to an _upstream_ commit. Someone needs to review
the pull request and merge it. Are you volunteering to help with that?

This is an official statement of the upstream maintainer from November 2016:

<a href="https://libssh2.org/mail/libssh2-devel-archive-2016-11/0006.shtml" title="https://libssh2.org/mail/libssh2-devel-archive-2016-11/0006.shtml">https://libssh2.org/mail/libssh2-devel-archive-2016-11/0006.shtml</a>

Kamil

Re: F28 System Wide Change: Switch libcurl to use libssh instead

By Kevin Kofler at 12/04/2017 - 14:41

Kamil Dudka wrote:
And even by the comparison on libssh2.org:
<a href="https://www.libssh2.org/libssh2-vs-libssh.html" title="https://www.libssh2.org/libssh2-vs-libssh.html">https://www.libssh2.org/libssh2-vs-libssh.html</a>
libssh is the more powerful library.

Kevin Kofler