Dependency pysftp is unmaintained

[musicinmybrain]

The dependency pysftp is unmaintained:

• It was last updated in 2016, both in terms of releases and in terms of upstream development.
• There are languishing open PR’s for basic modernization features like ED25519 keys.
• Testing is broken in several layers: first, the tox configuration no longer works, then pytest-pep8 doesn’t work with currently-supported Python releases, then if I patch out pep8/pytest-pep8, I get FAILED tests/test_remote_server_key.py::test_cnopts_bad_knownhosts - paramiko.hostkeys.InvalidHostKey: ('commands = py.test -x', Error('Incorrect padding',)); and the test dependency pytest-sftpserver is also no longer developed.

These issues make it difficult (although probably not impossible) to package pysftp confidently in a Linux distribution, and are likely to proliferate and affect pip users over time assuming the package remains unmaintained upstream. The lack of ED25519 key support alone is concerning, as this is the default key type for ssh-keygen since OpenSSH 9.5.

I’m not currently able to offer a good suggestion for an alternative to relying on pysftp or a PR to remove the dependency on it, but it does look like this plugin will need to consider such a change.

[dhait]

I have created a PR to switch from pysftp to plain old paramiko. Please let me know if this works for you.

[musicinmybrain]

Forgive me if I misunderstand the nature of #7, but to me it appears that:

• it is a total rewrite of this plugin
• it was authored almost entirely by one or more AI/LLM systems

Considering those points, as a distribution packager who is waiting for feedback on this issue before possibly adding a python-snakemake-storage-plugin-sftp package to Fedora, I will not be spending my time reviewing or testing the PR. I will just continue to monitor this issue.

[dhait]

I'm just trying to solve a real problem with available technology. But do as you wish.

[pgierz]

I find the SFTP storage plugin in its current state unusable.

Switching to paramiko would solve this problem, and as a snakemake user (not developer) I don't care what is used in the background, and pulling out a dependency would imply a large rewrite.

What is preventing reviewing a new solution with paramiko?