Eclipse Paho 1.3.0 (Oxygen) Release Review

End Date of the Review Period

Reviews run for a minimum of one week. The outcome of the review is decided on this date. This is the last day to make comments or ask questions about this review.


1.3.0 (Oxygen)


This release will be the first official release for some new and also older Paho clients and tools:

Service releases and updates to existing clients:

API Certification

The project leadership certifies that the APIs in this release are "Eclipse Quality".

Architectural Issues

Unlike most other Eclipse projects, Paho is made up of a number of separate components that have no relation to each other apart from their focus on MQTT. The majourity of components in Paho are APIs for specific languages or runtime environments, however they are all goverend by the MQTT specification which defines the protocol between clients and servers, but not the APIs that implement it. In the case of the Paho client libraries, we are faced with two options; We could design the APIs to be very similar across all languages and platforms, or we could tailor them to the individual language they are written in so that consumers of the library feel more comforatable using them.

With Paho, we have chosen to follow the API styles set out by the individual languages that each component is written in / for. 

In this release we will have 3 new components, one client library targeted at GoLang, and an MQTT monitorying utility; mqtt-spy. The GoLang library is band new code written in Go and mqtt-spy is written in Java and uses the Paho MQTT library.

Security Issues

MQTT uses TCP as its underlying transport.  Each of the APIs allows the TCP connection to be secured with TLS/SSL using the facilities available on that  platform.  For example:

  • Java - JDK standard TLS/SSL libraries
  • .Net framework standard TLS/SSL libraries
  • Python built-in TLS/SSL libraries
  • C - OpenSSL
  • Embedded C - no TLS support included, but supports the use of any TLS library
  • GoLang - built-in TLS/SSL library: crypto/tls
  • JavaScript - Web Browser built-in TLS/SSL library

No TLS/SSL support is directly included in the Paho components, they use what is available in the external environment.  That external environment needs to be updated with recent TLS software to ensure TLS vulnerability fixes are included.


Non-Code Aspects

The Paho web pages have a separate getting started page for each component:

All of the APIs have samples demonstrating the use of the API and reference documentation in a form suitable for that language (JavaDoc, Doxygen, etc). There are plans to improve the documentation and example code though as well as a snippets page that allows developers to quickly find short examples for common MQTT tasks using the language / client of their choice.

The community wiki has been updated with links to all the Paho components (


Usability Details

Each of the APIs in any of the languages has a similar capability, with one operation for each of the MQTT commands, connect, subscribe, unsubscribe, publish and disconnect.   The success or failure of these operations is reported either synchronously via a return code, or asynchronously in a callback, depending on the API.  

The basic styles of API have been developed over 8 years or more, from before Paho's existence, and continued within Paho, so we are confident of their basic usability. 

We continue to get feedback and improve where necessary, for instance with the new embedded APIs, which were designed in consultation with experienced developers.

We have also looked to improve areas of functionality within the clients to make using Paho easier for developers. One such example is the introduction of Automatic Reconnect & Offline buffering functionality that is now in the Java, Android and C clients. This means that developers no longer have to write their own code to handle lost connections in their applications or the buffering of messages whilst the client attempts to reconnect. We are always looking for new ways to reduce the amount of 'boilerplate code' that developers have to write especially if multiple developers have to write the same code in their applications.


Each of the MQTT components supports the MQTT v3.1.1 standard version of the protocol (  Some may also support the older 3.1 specification.

The MQTT-SN components implement version 1.2 of the MQTT-SN specification (



Last year, Paho migrated from the Eclipse Git / Gerrit / Bugzilla infrastructure to GitHub. With this there has been an increase in issues (bugs) being raised as well as an increase in code contributions in the form of Pull Requests. At the time of writing, the Paho components have been starred 1766 times in total and users have forked the code 967 times.

There are currently more than 780 closed issues and 217 unresolved for released Paho components. Issue, PR and mailing list activity has consistentl external contributions and interest.  The number of committers has increased by 3 over the year, and the number of code authors is at least 50.

As of November 2016, the last month I could find metrics for, Paho still has the second highest website traffic of any Eclipse IoT project behind Mosquitto.    This means that the MQTT projects have over 50% of all Eclipse IoT measured website traffic.  Paho had the highest measured downloads of any Eclipse IoT project in November 2016 with over 20,000 in that month. This statistic omits many downloads of Paho which can be obtained in other ways (external package repositories or source, for instance). 

These figures show continuing increase in activity and interest around Paho and MQTT year on year.  They are only a rough guide, but show that there is consistent interest in MQTT and Paho.

We are collaborating with the mbed ( community on embedded MQTT clients: The master source resides in the Paho project.

This release is part of Eclipse Oxygen