oscerd opened a new pull request, #25263:
URL: https://github.com/apache/camel/pull/25263
## What
Aligns the SSH-based components' host-key-checking option metadata with the
SFTP `strictHostKeyChecking` policy introduced in CAMEL-23404, and tidies a
contradictory global/session setting in camel-jsch.
### Metadata parity (`security="insecure:ssl"`)
- **camel-jsch** — `ScpConfiguration.strictHostKeyChecking` (default `no`)
is now tagged `security="insecure:ssl"` with a description, matching SFTP.
- **camel-ssh** — `SshConfiguration.knownHostsResource` and
`failOnUnknownHost` are now tagged `security="insecure:ssl"`.
- `failOnUnknownHost` additionally carries `insecureValue="false"`: it is
a boolean that is insecure when **false** (unknown host keys accepted), so
without this the generated `SecurityUtils` enforcement map would default to
`"true"` — the inverted value. This mirrors how `netty-http` tags
`hostnameVerification`.
### SCP global/session tidy
`ScpComponent.initJsch()` set the JVM-global
`JSch.setConfig("StrictHostKeyChecking", "yes")`, but
`ScpOperations.createSession()` always re-applies the per-session value from
`ScpConfiguration` (default `no`), so the global was dead and contradictory. It
has been removed (the `JSch.setLogger` setup is kept); the per-session value
governs behaviour.
## Behaviour
Non-behavioural aside from removing the dead global (the session value
already won). **Default values are unchanged** — flipping the insecure defaults
would be a separate behavioural change for a future major release with an
upgrade-guide entry.
## Tests / build
- camel-jsch + camel-ssh module test suites pass (the SCP tests exercise the
changed `initJsch` / `createSession` path).
- Full-reactor `mvn clean install -DskipTests` regenerates catalog/docs/DSL
and the `SecurityUtils` enforcement map with no drift.
## Backport
**main only** — the `insecure:ssl` security-profile enforcement framework
(`SecurityUtils`) does not exist on `camel-4.18.x` / `camel-4.14.x`, so the
tags would have nothing to enforce there.
Closes CAMEL-24291.
---
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
