-
Bug
-
Resolution: Unresolved
-
Critical
-
None
JGitAPIImpl.<init> starts off by calling SshSessionFactory.setInstance(new TrileadSessionFactory()). This sets the VM-wide factory, which could be quite dangerous: it means that any other usage of JGit will not be using the standard logic in JschConfigSessionFactory to use ~/.ssh and so on.
Instead it should only set a TrileadSessionFactory directly using SshTransport.setSshSessionFactory when it calls Transport.open (and the result is an SshTransport). In some cases that is called directly; for PushCommand and similar uses that call Transport.open for you, it need only call TransportCommand.setTransportConfigCallback to configure an SshTransport with our authentication.
I can submit a pull request if you like—probably only JGitAPIImpl needs to be touched—though I am unsure how to test it. (I presume test_push does not push to a public server.)
please provide a pull request, I'd then ask kohsuke to review