F28 System Wide Change: Switch libcurl to use libssh instead of libssh2

[Jan Kurik]

= System Wide Change:Switch libcurl to use libssh instead of libssh2 =
https://fedoraproject.org/wiki/Changes/libssh-in-libcurl

Change owner(s):
* Kamil Dudka <kdudka AT redhat DOT com>

libcurl currently uses libssh2 to implement the SSH layer of SCP and
SFTP protocols. After implementing this change, libcurl will use the
libssh library instead.


== Detailed Description ==
libcurl currently uses libssh2 to implement the SSH layer of SCP and
SFTP protocols. The libssh2 library uses outdated crypto algorithms
and lacks important features like GSS-API authentication. After
implementing this change, libcurl will use the libssh library instead,
which is now more secure, feature-complete, and with more active
upstream community.


== Scope ==
* Proposal owners:
kdudka (will switch the SSH library in the curl package once it is
supported upstream)

* Other developers:
nmav (currently working on the related pull-request with curl upstream)

* Release engineering:
No action from release engineering is needed for this change (libcurl
ABI is kept), releng review requested at
https://pagure.io/releng/issue/7193

* Policies and guidelines:
unaffected

* Trademark approval:
not needed
-- 
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

[Michael Cronenworth]

On 12/04/2017 07:47 AM, Jan Kurik wrote:
>  libcurl currently uses libssh2 to implement the SSH layer of SCP and
>  SFTP protocols. The libssh2 library uses outdated crypto algorithms
>  and lacks important features like GSS-API authentication. After
>  implementing this change, libcurl will use the libssh library instead,
>  which is now more secure, feature-complete, and with more active
>  upstream community. 
They are both equally active. If you were worried about ECDSA support, guess what? 
Libssh2 now supports it:

https://github.com/libssh2/libssh2/issues/41

I'm not sure this change is really warranted.

[Kamil Dudka]

On Monday, December 4, 2017 3:31:32 PM CET Michael Cronenworth wrote:
>  On 12/04/2017 07:47 AM, Jan Kurik wrote:
>  
>  > libcurl currently uses libssh2 to implement the SSH layer of SCP and
>  > SFTP protocols. The libssh2 library uses outdated crypto algorithms
>  > and lacks important features like GSS-API authentication. After
>  > implementing this change, libcurl will use the libssh library instead,
>  > which is now more secure, feature-complete, and with more active
>  > upstream community.
>  
>  
>  They are both equally active. 
How are you backing up your statement?

If we count upstream commits in 2017, I see 93 commits in libssh whereas
only 13 commits in libssh2 (including two commits authored by me).

>  If you were worried about ECDSA support, guess what?
>  Libssh2 now supports it:
>  
>  https://github.com/libssh2/libssh2/issues/41 
You are not referring to any upstream commit.  The link above points to a 
Github issue, which is open since September 2015 and without any progress 
since September 2017.

Kamil

[Michael Cronenworth]

On 12/04/2017 08:58 AM, Kamil Dudka wrote:
> > If you were worried about ECDSA support, guess what?
> > Libssh2 now supports it:
> >
> > https://github.com/libssh2/libssh2/issues/41
>  You are not referring to any upstream commit.  The link above points to a
>  Github issue, which is open since September 2015 and without any progress
>  since September 2017. 
The commit is in the issue, which you will find a PR for it.

https://github.com/libssh2/libssh2/pull/206

The libssh2 upstream may not be as "fast" as the libssh upstream, but there is
still 
active involvement from the maintainers on both sides.

[Kamil Dudka]

On Monday, December 4, 2017 4:05:49 PM CET Michael Cronenworth wrote:
>  On 12/04/2017 08:58 AM, Kamil Dudka wrote:
>  
>  >> If you were worried about ECDSA support, guess what?
>  >> Libssh2 now supports it:
>  >>
>  >>
>  >>
>  >> https://github.com/libssh2/libssh2/issues/41
>  > 
>  > You are not referring to any upstream commit.  The link above points to a
>  > Github issue, which is open since September 2015 and without any progress
>  > since September 2017.
>  
>  
>  The commit is in the issue, which you will find a PR for it.
>  
>  https://github.com/libssh2/libssh2/pull/206 
You are still not referring to an _upstream_ commit.  Someone needs to review 
the pull request and merge it.  Are you volunteering to help with that?

This is an official statement of the upstream maintainer from November 2016:

https://libssh2.org/mail/libssh2-devel-archive-2016-11/0006.shtml

Kamil

[Kevin Kofler]

Kamil Dudka wrote:
>  This is an official statement of the upstream maintainer from
> November
>  2016:
>  
>  https://libssh2.org/mail/libssh2-devel-archive-2016-11/0006.shtml 
And even by the comparison on libssh2.org:
https://www.libssh2.org/libssh2-vs-libssh.html
libssh is the more powerful library.

        Kevin Kofler

[Richard W.M. Jones]

Tangentially related to this, we're trying to change qemu to use
libssh instead of libssh2.  Upstream reviewers welcome!

https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02843.html

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html