Skip to content

Commit 8a86e32

Browse files
committed
Post-release documentation updates
1 parent c2e9fa3 commit 8a86e32

2 files changed

Lines changed: 66 additions & 51 deletions

File tree

CHANGES.md

Lines changed: 18 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,3 @@
1-
# Apache MINA SSHD 2.19.0
2-
3-
* Changes since [version 2.18.0](./docs/changes/2.18.0.md):
4-
5-
## Bug Fixes
6-
7-
* [GH-899](https://github.com/apache/mina-sshd/issues/899) Fix `ProcessShellFactory` on Linux
8-
* [GH-902](https://github.com/apache/mina-sshd/pull/902) Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
9-
* Limit size of decompressed SSH packets
10-
* Improve checking SSH user certificates in public-key authentication
11-
* Improve handling of repository paths in `sshd-git` on Windows
12-
* Validate file names in SCP
13-
* Escape newlines in filenames in the SCP protocol
14-
* Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git`
15-
16-
## New Features
17-
18-
None.
19-
20-
## Potential Compatibility Issues
21-
22-
### Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git`
23-
24-
Bundle `sshd-git` contains a `GitPgmCommandFactory` that can be configured for an Apache MINA SSHD server.
25-
It enables remote execution of git commands via JGit.
26-
27-
However, running arbitrary git commands remotely is an exotic use case, and some commands (like
28-
`git archive --format zip --output somefile.zip` or also `git clone` or `git checkout`) could even create
29-
files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA
30-
SSHD does not and cannot provide.
31-
32-
We have therefore limited the available commands to a small set of whitelisted git commands that might
33-
be useful as maintenance commands for authorized power users on a git server implemented based on `sshd-git`.
34-
The command are: `archive`, `blame`, `branch`, `describe`, `diff`, `gc`, `log`, `reflog`, `show`, and `status`.
35-
All these commands can be executed from an client via `git --git-dir <repo> <command> <args>`, where `<repo>`
36-
is the server-side name of the git repository (its local path on the server relative to the configured
37-
root), `<command>` is the command name (e.g., `archive`) and `<args>` are the command arguments. Results are
38-
sent back via the command output streams (output or error streams) and are thus sent back to the client.
39-
For the `archive`command, the `--output` (or `-o`) argument is ignored; the archive is always returned via
40-
the command's output stream and this is also sent to the client.
41-
42-
Applications that might have relied on the ability to run other JGit command remotely may no longer work.
43-
Either implement your own dedicated command factory to enable accesss to certain commands, or set the
44-
property `GitModuleProperties.RESTRICT_COMMANDS` to `false` on the server-side `SshServer` (for all sessions)
45-
or on particular `ServerSession`s (for particular individual sessions) to re-enable access to _all_ commands
46-
supported by JGit.
47-
48-
## Major Code Re-factoring
49-
50-
None.
51-
521
# Previous Versions
532

543
* [Version 2.1.0 to 2.2.0](./docs/changes/2.2.0.md)
@@ -75,3 +24,21 @@ None.
7524
* [Version 2.16.0 to 2.17.0](./docs/changes/2.17.0.md)
7625
* [Version 2.17.0 to 2.17.1](./docs/changes/2.17.1.md)
7726
* [Version 2.17.1 to 2.18.0](./docs/changes/2.18.0.md)
27+
28+
# Latest Version
29+
30+
* **[Version 2.18.0 to 2.19.0](./docs/changes/2.19.0.md)**
31+
32+
# Planned for Next Version
33+
34+
## Bug Fixes
35+
36+
37+
## New Features
38+
39+
40+
## Potential Compatibility Issues
41+
42+
43+
## Major Code Re-factoring
44+

docs/changes/2.19.0.md

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Introduced in 2.19.0
2+
3+
## Bug Fixes
4+
5+
* [GH-899](https://github.com/apache/mina-sshd/issues/899) Fix `ProcessShellFactory` on Linux
6+
* [GH-902](https://github.com/apache/mina-sshd/pull/902) Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
7+
* Limit size of decompressed SSH packets
8+
* Improve checking SSH user certificates in public-key authentication
9+
* Improve handling of repository paths in `sshd-git` on Windows
10+
* Validate file names in SCP
11+
* Escape newlines in filenames in the SCP protocol
12+
* Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git`
13+
14+
## New Features
15+
16+
None.
17+
18+
## Potential Compatibility Issues
19+
20+
### Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git`
21+
22+
Bundle `sshd-git` contains a `GitPgmCommandFactory` that can be configured for an Apache MINA SSHD server.
23+
It enables remote execution of git commands via JGit.
24+
25+
However, running arbitrary git commands remotely is an exotic use case, and some commands (like
26+
`git archive --format zip --output somefile.zip` or also `git clone` or `git checkout`) could even create
27+
files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA
28+
SSHD does not and cannot provide.
29+
30+
We have therefore limited the available commands to a small set of whitelisted git commands that might
31+
be useful as maintenance commands for authorized power users on a git server implemented based on `sshd-git`.
32+
The command are: `archive`, `blame`, `branch`, `describe`, `diff`, `gc`, `log`, `reflog`, `show`, and `status`.
33+
All these commands can be executed from an client via `git --git-dir <repo> <command> <args>`, where `<repo>`
34+
is the server-side name of the git repository (its local path on the server relative to the configured
35+
root), `<command>` is the command name (e.g., `archive`) and `<args>` are the command arguments. Results are
36+
sent back via the command output streams (output or error streams) and are thus sent back to the client.
37+
For the `archive`command, the `--output` (or `-o`) argument is ignored; the archive is always returned via
38+
the command's output stream and this is also sent to the client.
39+
40+
Applications that might have relied on the ability to run other JGit command remotely may no longer work.
41+
Either implement your own dedicated command factory to enable accesss to certain commands, or set the
42+
property `GitModuleProperties.RESTRICT_COMMANDS` to `false` on the server-side `SshServer` (for all sessions)
43+
or on particular `ServerSession`s (for particular individual sessions) to re-enable access to _all_ commands
44+
supported by JGit.
45+
46+
## Major Code Re-factoring
47+
48+
None.

0 commit comments

Comments
 (0)