Merge pull request #11010 from Mikaka27/michal/ssh/deprecate-and-schedule-removal-zlib/OTP-20099

michal/ssh/deprecate-and-schedule-removal-zlib/OTP-20099

Author: Mikaka27

lib/ssh/doc/guides/configure_algos.md

@@ -80,8 +80,8 @@ The lists are (named as in the SSH application's options):
   This list is also divided into two for the both directions
 
 - **`compression`** - If and how to compress the message. Examples are `none`,
-  that is, no compression,
-  `zlib` for pre-authentication compression (disabled by default),
+  that is, no compression, `zlib` for pre-authentication compression
+  (deprecated in SSH and it's usage is scheduled for removal in OTP 30.0),
   and `'zlib@openssh.com'` for post-authentication compression.
 
   This list is also divided into two for the both directions

lib/ssh/doc/guides/hardening.md

@@ -126,8 +126,9 @@ See [Counters and parallelism](#counters-and-parallelism).
 The `'zlib@openssh.com'` algorithm is recommended because it only activates
 after successful authentication.
 
-The `'zlib'` algorithm is not recommended because it activates before
-authentication completes, allowing unauthenticated clients to expose potential
+The `'zlib'` algorithm (deprecated in SSH and it's usage is scheduled for removal in OTP 30.0)
+is not recommended because it activates before authentication completes,
+allowing unauthenticated clients to expose potential
 vulnerabilities in compression libraries, and increases attack surface of
 compression-based side-channel and traffic-analysis attacks.
 

lib/ssh/doc/ssh_app.md

@@ -235,7 +235,7 @@ cipher aes256-gcm@openssh.com is negotiated.
   - none
   - zlib@openssh.com
 
-The following compression algorithm is disabled by default:
+The following compression algorithm is deprecated in SSH and disabled by default:
 
 - (zlib)
 

lib/ssh/src/ssh.hrl

@@ -317,10 +317,17 @@ ssh:daemon(Port, [{subsystems, [ssh_sftpd:subsystem_spec([])]} | Options])
 
 -doc(#{group => <<"Common Options">>}).
 -type compression_alg()  :: 'none' |
-                            'zlib' |
-                            'zlib@openssh.com'
+                            'zlib@openssh.com' |
+                            legacy_compression_alg()
                             .
 
+-doc """
+Deprecated: the use of `zlib` compression in SSH will be
+removed in OTP 30.0. Use `none` or `zlib@openssh.com` instead.
+""".
+-doc(#{group => <<"Legacy Algorithms">>, deprecated => "use 'none' or 'zlib@openssh.com' instead"}).
+-type legacy_compression_alg() :: 'zlib'.
+
 -doc """
 List of algorithms to use in the algorithm negotiation. The default
 `t:algs_list/0` can be obtained from `default_algorithms/0`.

scripts/license-header.es

@@ -493,7 +493,7 @@ check_license([], _Template, #{ lines_after_license := LinesAfterLicense,
         NeedsNoLicense -> ok;
         IsShort, NeedsNoLicenseIfShort -> ok;
         NeedsNoLicenseIfShort ->
-            throw({warn, "is longer than 10 lines, needs license in header.", []});
+            throw({warn, "is longer than 20 lines, needs license in header.", []});
         true ->
             throw({warn, "needs license in header.", []})
     end;

system/doc/general_info/deprecations_29.md

@@ -6,6 +6,18 @@ SPDX-License-Identifier: Apache-2.0
 SPDX-FileCopyrightText: Copyright (C) 2025 Richard Carlsson <carlsson.richard@gmail.com>
 Copyright Ericsson AB 2026. All Rights Reserved.
 
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
 %CopyrightEnd%
 -->
 
@@ -24,3 +36,10 @@ the format `{ssl_dist_opt, Value}`.  After OTP 20 only the
 `ssl_dist_optfile` flag should be used to configure TLS for Erlang
 distribution and most options can only be configured that way anyway.
 
+### SSH zlib Compression Algorithm
+
+The use of the `zlib` compression algorithm in the SSH application is
+deprecated. Use `none` or `zlib@openssh.com` instead. The `zlib`
+algorithm has not been included in the default SSH algorithms for some
+time and support for it in SSH is scheduled for removal in OTP 30.0.
+

system/doc/general_info/scheduled_for_removal_30.md

@@ -77,3 +77,10 @@ All TLS options specified for Erlang distribution as `ERL_FLAGS` on
 the format `{ssl_dist_opt, Value}`.  After OTP 20 only the
 `ssl_dist_optfile` flag should be used to configure TLS for Erlang
 distribution and most options can only be configured that way anyway.
+
+### SSH zlib Compression Algorithm
+
+The use of the `zlib` compression algorithm in the SSH application is
+deprecated. Use `none` or `zlib@openssh.com` instead. The `zlib`
+algorithm has not been included in the default SSH algorithms for some
+time and support for it in SSH is scheduled for removal in OTP 30.0.