Version 3.4 does not work with Gerrit 3.4.x

[hanson76]

We upgraded Gerrit from 3.2.10 to 3.4.0 and this plugin stopped working.
We have been able to get some kind of error by executing "Test Config" from
"Manage Apps"/"Gerrit Settings" in Jira

`
Connection Failed!
An error occurred while testing the connection to Gerrit.

com.jcraft.jsch.JSchException: verify: false

`

It might be that the jsch version is too old and that it does not support the host key that Gerrit it using.
Gerrit changed ssh host key during the upgrade.

[gtjoseph]

I'm having the same issue after upgrading to Gerrit 3.4.0. It looks like the plugin's version of jsch only supports the diffie-hellman-group1-sha1 and diffie-hellman-group-exchange-sha1 kex algorithms but neither are supported by the new Gerrit ssh engine.

I do believe this issue belongs to Gerrit. At the very least, the release notes for 3.4.0 should have been more explicit than...

Deprecated JCraft JSch client library is replaced with MINA SSHD client library per default. There is still option to switch to using JCraft JSch client library. Support for JCraft JSch will be removed in the next gerrit release.

I'll take that up with them though.

In the mean time, I'm going to see if just rebuilding the plugin with a later jsch (assuming there is one) will help.

[hanson76]

Looks like Gerrit 3.4.1 will have an option to enable the old insecure algorithm again.
This is only a temporary solution, these weak algorithms have security risks [1] [2]

[1] https://issues.apache.org/jira/browse/SSHD-1004
[2] https://www.zdnet.com/article/openssh-to-deprecate-sha-1-logins-due-to-security-risk

[gtjoseph]

Yeah that was me that got them to add the option to allow the older kex algorithms but you're right, it's just a temporary solution. It's odd though... the jenkins gerrit-trigger-plugin also uses gerrit-events/jsch and it's not having issues. I may try to upgrade this plugin to use the same version of gerrit-events and see what that does.

@hanson76 What Jira version are you using?

[hanson76]

We are using Jira v8.13.6

[vlotorev]

Following versions are running without errors: Jira 8.17.0, Gerrit 3.4.0, and jira-gerrit-plugin 3.4.

[gtjoseph]

Following versions are running without errors: Jira 8.17.0, Gerrit 3.4.0, and jira-gerrit-plugin 3.4.

Yeah we're running 6.x and it's way too old to support the newer ssh algorithms.

[ak-slongchamps]

Noting to this thread that our fork uses an up-to-date jsch and it does solve the issue.

See https://github.com/audiokinetic/jira-gerrit-plugin