Repository navigation
Conversation
The automation harness opened every system-object shell through systemobject.terminal.SSH / our SshRsa subclass, both backed by Ganymed SSH2 (ch.ethz.ssh2), a 2006-era client whose handshake crypto stops at diffie-hellman-group1/group14-sha1 KEX and CBC ciphers. OpenSSH 9.x builds drop those algorithms at compile time, and sshd's "+algo" modifier can only re-enable what was built in, so on el9 Ganymed shares no usable KEX or cipher with sshd and the L2 suite cannot connect to localhost:22. That is why the packaging smoke gates L2 (and its singlecluster umbrella) to el8. SshRsa now extends JSystem's Terminal directly and drives the shell with sshj 0.41.2 (Java 8 compatible): connect, authenticate, allocate a "dumb" PTY (same as Ganymed's requestDumbPTY(), so terminal-aware commands do not colour their output), start the shell, hand the channel streams to the Terminal. Password (password + keyboard-interactive) is tried when the SUT gives one, otherwise the SUT's privateKey file; sshj reads OpenSSH-format, PEM and PuTTY keys, so the OpenSSH-to-PEM conversion Ganymed needed goes away too. Host keys are not verified, the trust model Ganymed had. PxfCliConnectionImpl uses SshRsa for both the ssh and ssh-rsa protocols, so nothing in the tree references JSystem's Ganymed-backed SSH any more. pom: ganymed-ssh2 is dropped as a direct dependency and excluded from org.jsystemtest.systemobjects:cli (its only remaining path); sshj 0.41.2 is added. Two side effects of sshj's own dependencies are pinned back: slf4j-api stays on 1.7.36 (sshj declares 2.0.17, which would ignore the only binding on the classpath, hadoop-common's slf4j-reload4j 1.7.36, and silence every Hadoop/HBase client log line), and the Bouncy Castle 1.68 jdk15on jars that hive-shims pulls through yarn web-proxy are excluded so the classpath carries a single BC (sshj's jdk18on 1.84) rather than two copies of the same classes. automation/README.md: the "SSH Setup" section no longer tells people to append legacy KexAlgorithms/HostKeyAlgorithms to sshd_config or to make a PEM-format RSA key; any unencrypted OpenSSH key works. Verified locally (Java 8, the module compiles with `mvn compile`; `git grep ch.ethz.ssh2|ganymed automation/` only hits the exclusion) by driving SshRsa the way PxfCliConnectionImpl does against two sshd containers: Rocky Linux 9 (OpenSSH 8.7p1) and Fedora 42 (OpenSSH 9.9p1, the algorithm set el9 is moving to), each with an OpenSSH-format RSA key, an ed25519 key and a password; the shell starts with `env PS1='#' bash --norc`, the prompt matches and the command output comes back through the Terminal. CliConnectionImpl, which still references JSystem's SSH class, links fine with ganymed-ssh2 off the classpath. Companion change: EnterpriseDB/whpg-extensions-packaging drops the IS_PXF_EL8 gate so L2 runs on el9. (cherry picked from commit 0f5be4e)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of #95 (
0f5be4e1d, merged tomainon 2026-10-19) ontofeat/whpg19-port, applied withgit cherry-pick -x; no conflicts.Why
EnterpriseDB/whpg-extensions-packaging#151 drops the el8-only L2 gate now that the JSystem harness connects with sshj, so the WHPG19 lane (el9-only, packages this branch) starts running L2 without the Ganymed-era legacy sshd block. This branch's
automation/pom.xmlstill pulls Ganymed, which cannot negotiate with el9's OpenSSH, so L2 on 19 would fail until the port has #95. Until this merges, packaging#151 skips L2 on a source tree whose automation pom has no sshj dependency, so the 19 lane stays green either way; once this is in, that skip lifts by itself.What changes
Same four files as #95:
automation/pom.xml(sshj 0.41.2, Ganymed excluded from the jsystem cli artifact, slf4j-api pinned, BC jdk15on excluded),SshRsa.javarewritten on sshj, the one-linePxfCliConnectionImplchange, and the automation README's SSH section.