What to do about (probably defunct) jsch library, which has now been forked?

[sleberknight]

The original Jsch library seems pretty much defunct, with no activity or releases since 0.1.55 was released on Nov 26, 2018.

It has been forked here and has made a bunch of changes. Some of the major changes are documented in the future of jsch without ssh-rsa.

From the blog, I found out about sshj - SSHv2 library for Java which is another option.

Should we migrate to the fork? Or should we remove the jsch package from kiwi, since we rarely ever use it anymore.

Since the new maintainer says it's a "Drop in replacement", and because we declare it as a provided dependency, anyone using kiwi can use the new one if they want, with the caveat that some things might break without changing configuration, e.g., using RSA/SHA1 which is disabled by default in the forked library. See Why do ssh-rsa type keys not work with this JSch fork and my server? which describes what you need to do if you need to still use RSA/SHA1.