* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 5:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-15 5:12 UTC (permalink / raw
To: gentoo-commits
commit: c598a6776c5596293eaa5250d0be305c61597ba2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 05:11:38 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 05:11:38 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c598a677
net-misc/openssh: Stabilize 9.2_p1-r2 amd64, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index f228e1636c82..cb0dc79e72e9 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-30 18:39 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-10-30 18:39 UTC (permalink / raw
To: gentoo-commits
commit: aed2f54db7d13229bf80a8b728a7ae62d601ff4f
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 30 18:38:54 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Oct 30 18:38:54 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aed2f54d
net-misc/openssh: Stabilize 9.8_p1-r3 arm, #940876
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index a4f43c01212a..129f86bd6eb7 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-30 15:46 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-10-30 15:46 UTC (permalink / raw
To: gentoo-commits
commit: 251189613ad77ed8b17f3137d395bd3f5892ca16
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 30 15:45:26 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Oct 30 15:46:13 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=25118961
net-misc/openssh: Stabilize 9.8_p1-r3 arm64, #940876
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index 771c209d6170..a4f43c01212a 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-29 13:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-29 13:12 UTC (permalink / raw
To: gentoo-commits
commit: ce6090e92baf8eb5e87eee51c885df175adfc83d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 13:12:08 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 13:12:08 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce6090e9
net-misc/openssh: Stabilize 9.8_p1-r3 x86, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index dec1645a6b1f..771c209d6170 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-29 2:45 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-29 2:45 UTC (permalink / raw
To: gentoo-commits
commit: 818a1120f257aed5bf52749b424ca523541e9b2d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 02:44:20 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 02:44:20 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=818a1120
net-misc/openssh: Stabilize 9.8_p1-r3 amd64, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index 1429c62be2c2..dec1645a6b1f 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-29 2:10 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-29 2:10 UTC (permalink / raw
To: gentoo-commits
commit: e1b6c11ef116aaa2378e1d3539db74d14479f7f2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 02:09:48 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 02:09:48 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e1b6c11e
net-misc/openssh: Stabilize 9.8_p1-r3 ppc, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index 425dcd06d2e1..1429c62be2c2 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-29 2:10 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-29 2:10 UTC (permalink / raw
To: gentoo-commits
commit: 01933f629fb7f6ed8863332ee06f7a2990698e37
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 02:09:47 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 02:09:47 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=01933f62
net-misc/openssh: Stabilize 9.8_p1-r3 ppc64, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index bc370ec93022..425dcd06d2e1 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-29 1:08 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-29 1:08 UTC (permalink / raw
To: gentoo-commits
commit: bc6963031680ce2ceae0e2c66e47fcf3b380e938
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 01:08:06 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 01:08:06 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc696303
net-misc/openssh: backport USE=legacy-ciphers for DSA to 9.8_p1-r3
Closes: https://bugs.gentoo.org/941255
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r3.ebuild | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r3.ebuild b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
index 85ee1df6efcb..bc370ec93022 100644
--- a/net-misc/openssh/openssh-9.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r3.ebuild
@@ -22,7 +22,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
RESTRICT="!test? ( test )"
@@ -199,6 +199,7 @@ src_configure() {
$(use_with audit audit linux)
$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
$(use_with ldns)
+ $(use_enable legacy-ciphers dsa-keys)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-13 20:40 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-13 20:40 UTC (permalink / raw
To: gentoo-commits
commit: 5f5d82ea176ac84e4674a19fc4420e9259611cd8
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Oct 13 20:40:05 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Oct 13 20:40:05 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5f5d82ea
net-misc/openssh: Stabilize 9.8_p1-r2 sparc, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index 6bcce850deff..be1dd9e136e5 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-08 21:50 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2024-10-08 21:50 UTC (permalink / raw
To: gentoo-commits
commit: 0656f136f41f171f6685cd001aac64b421c352f5
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 8 21:49:29 2024 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Tue Oct 8 21:49:29 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0656f136
net-misc/openssh: Stabilize 9.8_p1-r2 ppc, #940876
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index a736800b38b1..37ef9364cf83 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-05 14:30 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-10-05 14:30 UTC (permalink / raw
To: gentoo-commits
commit: 9b30917f4fc71aab4842f08a949be43b5c4e7dde
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 5 14:29:47 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sat Oct 5 14:29:47 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9b30917f
net-misc/openssh: Stabilize 9.8_p1-r2 arm, #940876
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index f61e3028eab0..a736800b38b1 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-05 13:58 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-10-05 13:58 UTC (permalink / raw
To: gentoo-commits
commit: 1c9b93d754a121e042a4a0c81db563d9e49217f4
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 5 13:58:07 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sat Oct 5 13:58:07 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1c9b93d7
net-misc/openssh: Stabilize 9.8_p1-r2 x86, #940876
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index 24e99f5407e8..f61e3028eab0 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-05 12:10 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-10-05 12:10 UTC (permalink / raw
To: gentoo-commits
commit: 9a5aa30b2ff0c7919b509c1545eb68fcdc4ca201
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 5 12:10:21 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sat Oct 5 12:10:21 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9a5aa30b
net-misc/openssh: Stabilize 9.8_p1-r2 amd64, #940876
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index eb9d2b5810a6..24e99f5407e8 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-10-05 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-10-05 11:12 UTC (permalink / raw
To: gentoo-commits
commit: 77446a7e3c6a0f13acdb718483a1fbb6fa862e8c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 5 11:11:10 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Oct 5 11:11:10 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=77446a7e
net-misc/openssh: Stabilize 9.8_p1-r2 ppc64, #940876
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
index 5bd73e0cec60..eb9d2b5810a6 100644
--- a/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r2.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-08 10:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-08 10:12 UTC (permalink / raw
To: gentoo-commits
commit: f4b8907daabaff433a837ca6356bf1fb6649e551
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Thu Jul 4 08:40:40 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 8 10:11:42 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f4b8907d
net-misc/openssh: stable 9.7_p1-r6 for hppa, bug #935275
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index dfe20d9c2272..af5db8a1a650 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:18 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:18 UTC (permalink / raw
To: gentoo-commits
commit: a5ae97f6c11e8b646e5510bdf780338fc1e2efa4
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:17:55 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:17:55 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a5ae97f6
net-misc/openssh: Stabilize 9.7_p1-r6 ppc64, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index 8e0c2d1eb2ae..dfe20d9c2272 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:18 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:18 UTC (permalink / raw
To: gentoo-commits
commit: aa7ac202ac43270a513f2f83ac9e67aa500db0f8
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:17:53 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:17:53 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aa7ac202
net-misc/openssh: Stabilize 9.7_p1-r6 sparc, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index a4d9e297e137..d03e00276fe8 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:18 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:18 UTC (permalink / raw
To: gentoo-commits
commit: ce37d2e6bd5aef4a5d6016d8650710632f24b368
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:17:54 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:17:54 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce37d2e6
net-misc/openssh: Stabilize 9.7_p1-r6 ppc, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index d03e00276fe8..8e0c2d1eb2ae 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:12 UTC (permalink / raw
To: gentoo-commits
commit: 64d74f5a026f5ad9d552c1540d0cd4d1ce7472f9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:12:14 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:12:14 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=64d74f5a
net-misc/openssh: Stabilize 9.7_p1-r6 amd64, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index f04ed8203e3c..a4d9e297e137 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:12 UTC (permalink / raw
To: gentoo-commits
commit: da4d673c8709506f7aaaa5316f7fc3ccf2178b17
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:11:56 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:11:56 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=da4d673c
net-misc/openssh: drop 9.6_p1-r4, 9.7_p1-r2, 9.7_p1-r3, 9.7_p1-r5
Bug: https://bugs.gentoo.org/935271
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r4.ebuild | 390 ----------------------------
net-misc/openssh/openssh-9.7_p1-r2.ebuild | 403 -----------------------------
net-misc/openssh/openssh-9.7_p1-r3.ebuild | 404 ------------------------------
net-misc/openssh/openssh-9.7_p1-r5.ebuild | 398 -----------------------------
4 files changed, 1595 deletions(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r4.ebuild b/net-misc/openssh/openssh-9.6_p1-r4.ebuild
deleted file mode 100644
index 8d611b8b20b5..000000000000
--- a/net-misc/openssh/openssh-9.6_p1-r4.ebuild
+++ /dev/null
@@ -1,390 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
-"
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
- "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- # optional at runtime; guarantee a known path
- --with-xauth="${EPREFIX}"/usr/bin/xauth
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- # bug #139235
- optfeature "x11 forwarding" x11-apps/xauth
-
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.7_p1-r2.ebuild b/net-misc/openssh/openssh-9.7_p1-r2.ebuild
deleted file mode 100644
index ce9e1d1a47c2..000000000000
--- a/net-misc/openssh/openssh-9.7_p1-r2.ebuild
+++ /dev/null
@@ -1,403 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
-"
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- # optional at runtime; guarantee a known path
- --with-xauth="${EPREFIX}"/usr/bin/xauth
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-tweak_ssh_configs() {
- cat <<-EOF >> ssh_config.out || die
-
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> sshd_config.out || die
-
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-}
-
-create_config_dropins() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_compile() {
- default
- tweak_ssh_configs
- create_config_dropins
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-
- # Install dropins with explicit mode, bug 906638, 915840
- diropts -m0755
- insopts -m0644
- insinto /etc/ssh
- doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
- doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
- diropts -m0700
- insopts -m0600
- doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- # bug #139235
- optfeature "x11 forwarding" x11-apps/xauth
-
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.7_p1-r3.ebuild b/net-misc/openssh/openssh-9.7_p1-r3.ebuild
deleted file mode 100644
index 9bb9c924093a..000000000000
--- a/net-misc/openssh/openssh-9.7_p1-r3.ebuild
+++ /dev/null
@@ -1,404 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
-"
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
- "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- # optional at runtime; guarantee a known path
- --with-xauth="${EPREFIX}"/usr/bin/xauth
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-tweak_ssh_configs() {
- cat <<-EOF >> ssh_config.out || die
-
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> sshd_config.out || die
-
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-}
-
-create_config_dropins() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_compile() {
- default
- tweak_ssh_configs
- create_config_dropins
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-
- # Install dropins with explicit mode, bug 906638, 915840
- diropts -m0755
- insopts -m0644
- insinto /etc/ssh
- doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
- doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
- diropts -m0700
- insopts -m0600
- doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- # bug #139235
- optfeature "x11 forwarding" x11-apps/xauth
-
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.7_p1-r5.ebuild b/net-misc/openssh/openssh-9.7_p1-r5.ebuild
deleted file mode 100644
index 4d382b9b6ac6..000000000000
--- a/net-misc/openssh/openssh-9.7_p1-r5.ebuild
+++ /dev/null
@@ -1,398 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
-"
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
- "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
- "${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- # optional at runtime; guarantee a known path
- --with-xauth="${EPREFIX}"/usr/bin/xauth
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-create_config_dropins() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
- # override default of no subsystems
- Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server
- EOF
-
- if use pam ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_compile() {
- default
- create_config_dropins
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-
- # Install dropins with explicit mode, bug 906638, 915840
- diropts -m0755
- insopts -m0644
- insinto /etc/ssh
- doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
- doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
- diropts -m0700
- insopts -m0600
- doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- # bug #139235
- optfeature "x11 forwarding" x11-apps/xauth
-
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:12 UTC (permalink / raw
To: gentoo-commits
commit: abbf7957c4645eff11f786d8b06752e134e8d267
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:12:13 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:12:13 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=abbf7957
net-misc/openssh: Stabilize 9.7_p1-r6 x86, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index 77f61c2c4b97..f04ed8203e3c 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:12 UTC (permalink / raw
To: gentoo-commits
commit: e6c4fde0b31a441e96e8e71c40521aa4e9aee000
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:12:11 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:12:11 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e6c4fde0
net-misc/openssh: Stabilize 9.7_p1-r6 arm64, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index d9671bb68de5..333d3990fcf1 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 11:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 11:12 UTC (permalink / raw
To: gentoo-commits
commit: d96caf8bacea5a3faefd68678942e3ed79a8936c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 11:12:12 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 11:12:12 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d96caf8b
net-misc/openssh: Stabilize 9.7_p1-r6 arm, #935275
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
index 333d3990fcf1..77f61c2c4b97 100644
--- a/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r6.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:40 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-07-01 10:40 UTC (permalink / raw
To: gentoo-commits
commit: 86743732d64ce31b85e24ee9e3937931bc366cf2
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:40:22 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:40:22 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=86743732
net-misc/openssh: Stabilize 9.6_p1-r5 sparc, #935272
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index 44fe3f091dbb..eaae6cd6082f 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 10:39 UTC (permalink / raw
To: gentoo-commits
commit: 4d1cc37642bf39a66557991a9d85dcb2a5045e33
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:39:42 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:39:42 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4d1cc376
net-misc/openssh: Stabilize 9.6_p1-r5 x86, #935272
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index 4d09fc152d70..44fe3f091dbb 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 10:39 UTC (permalink / raw
To: gentoo-commits
commit: bcf25efd0f8ce54579dd7ff312c4fce5c7f82c5b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:39:41 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:39:41 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bcf25efd
net-misc/openssh: Stabilize 9.6_p1-r5 amd64, #935272
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index 6730bba6ad71..4d09fc152d70 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:39 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-07-01 10:39 UTC (permalink / raw
To: gentoo-commits
commit: 72e213af1e097246c841bfcd81d4a003252fc51a
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:39:17 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:39:17 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=72e213af
net-misc/openssh: Stabilize 9.6_p1-r5 ppc, #935272
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index bcca96b202a4..6730bba6ad71 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:38 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-07-01 10:38 UTC (permalink / raw
To: gentoo-commits
commit: 3ff0d813129dd39d452d0cedb4c4dd63f910cd1d
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:38:16 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:38:16 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3ff0d813
net-misc/openssh: Stabilize 9.6_p1-r5 arm64, #935272
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index 07965fe7bd2b..4346adcef7c5 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:38 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-07-01 10:38 UTC (permalink / raw
To: gentoo-commits
commit: d41fbe155040d9c00438437a4af7ca983454a71a
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:38:19 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:38:19 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d41fbe15
net-misc/openssh: Stabilize 9.6_p1-r5 ppc64, #935272
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index 4346adcef7c5..bcca96b202a4 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:38 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2024-07-01 10:38 UTC (permalink / raw
To: gentoo-commits
commit: a41c69db1349aeab4fc25d78feeab16a58fd2287
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:38:13 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:38:13 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a41c69db
net-misc/openssh: Stabilize 9.6_p1-r5 arm, #935272
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
index b9af0d030ca9..07965fe7bd2b 100644
--- a/net-misc/openssh/openssh-9.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r5.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:37 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 10:37 UTC (permalink / raw
To: gentoo-commits
commit: 1f9842efa122bc2fa6db472a42ef9772f290cf9c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 10:36:48 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:36:48 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1f9842ef
net-misc/openssh: explain why we don't need to do `sshd -t` for the OpenRC case
ago pointed out that it's confusing.
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.8_p1-r1.ebuild | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net-misc/openssh/openssh-9.8_p1-r1.ebuild b/net-misc/openssh/openssh-9.8_p1-r1.ebuild
index 9a15dd231570..6633e212c19c 100644
--- a/net-misc/openssh/openssh-9.8_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r1.ebuild
@@ -422,6 +422,9 @@ openssh_maybe_restart() {
systemctl try-restart sshd
eend $?
elif [[ -d /run/openrc ]]; then
+ # We don't check for sshd -t here because the OpenRC init script
+ # has a stop_pre() which does checkconfig, i.e. we defer to it
+ # to give nicer output for a failed sanity check.
ewarn "The ebuild will now attempt to restart OpenSSH to avoid"
ewarn "bricking the running instance. See bug #709748."
ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 10:22 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 10:22 UTC (permalink / raw
To: gentoo-commits
commit: b9aab3ef968b7a6d58fa215223d116b98af7d399
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 09:59:36 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 10:22:02 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b9aab3ef
net-misc/openssh: restart sshd on major version upgrades
openssh-9.8_p1 again breaks cross-version compatibility, meaning that
a running sshd with 9.7_p1 will no longer be able to accept connections
after upgrading to 9.8_p1.
We tried doing a news item on this in the past (bug #709748) and it ended
up being insufficient and poorly coordinated (as you really need it again
when stabling).
Nobody is going to thank us for leaving their sshd broken, so pick
the lesser evil and attempt to restart sshd on major version upgrades.
This is especially important as people may be racing to upgrade to 9.8_p1
for the CVE-2024-6387 fix (although we have backported a fix to older versions).
I also note there's precedent here with e.g. the systemd rebuild where
it's done to avoid immediate breakage of user sessions.
Thanks to kerframil who proposed a snippet for this some time ago whose
work I've lifted here.
Bug: https://bugs.gentoo.org/709748
Bug: https://bugs.gentoo.org/935271
Signed-off-by: Sam James <sam <AT> gentoo.org>
...nssh-9.8_p1.ebuild => openssh-9.8_p1-r1.ebuild} | 33 ++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/net-misc/openssh/openssh-9.8_p1.ebuild b/net-misc/openssh/openssh-9.8_p1-r1.ebuild
similarity index 93%
rename from net-misc/openssh/openssh-9.8_p1.ebuild
rename to net-misc/openssh/openssh-9.8_p1-r1.ebuild
index 4d382b9b6ac6..9a15dd231570 100644
--- a/net-misc/openssh/openssh-9.8_p1.ebuild
+++ b/net-misc/openssh/openssh-9.8_p1-r1.ebuild
@@ -395,4 +395,37 @@ pkg_postinst() {
elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
elog "and update all clients/servers that utilize them."
fi
+
+ openssh_maybe_restart
+}
+
+openssh_maybe_restart() {
+ local ver
+ declare -a versions
+ read -ra versions <<<"${REPLACING_VERSIONS}"
+ for ver in "${versions[@]}"; do
+ # Exclude 9.8_p1 because it didn't have the safety check
+ [[ ${ver} == 9.8_p1 ]] && break
+
+ if [[ ${ver%_*} == "${PV%_*}" ]]; then
+ # No major version change has occurred
+ return
+ fi
+ done
+
+ if [[ ${ROOT} ]]; then
+ return
+ elif [[ -d /run/systemd/system ]] && sshd -t >/dev/null 2>&1; then
+ ewarn "The ebuild will now attempt to restart OpenSSH to avoid"
+ ewarn "bricking the running instance. See bug #709748."
+ ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'"
+ systemctl try-restart sshd
+ eend $?
+ elif [[ -d /run/openrc ]]; then
+ ewarn "The ebuild will now attempt to restart OpenSSH to avoid"
+ ewarn "bricking the running instance. See bug #709748."
+ ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'"
+ rc-service -q --ifstarted --nodeps sshd restart
+ eend $?
+ fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-07-01 8:41 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-07-01 8:41 UTC (permalink / raw
To: gentoo-commits
commit: 083d7d12832b91073f5cac94df2ba067495857a7
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 1 08:40:45 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Jul 1 08:40:45 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=083d7d12
net-misc/openssh: add 9.8_p1
This fixes CVE-2024-6387 but I'm going to backport a fix to 9.7 shortly
as 9.8_p1 isn't a good stable candidate given it's only just been released
and has many other changes.
Bug: https://bugs.gentoo.org/935271
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.8_p1.ebuild | 398 +++++++++++++++++++++++++++++++++
2 files changed, 400 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 363bef164ad2..a99ea426fb91 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -2,3 +2,5 @@ DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf4
DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b SHA512 0cafc17d22851605a4a5495a1d82c2b3fbbe6643760aad226dbf2a25b5f49d4375c3172833706ea3cb6c05d5d02a40feb9a7e790eae5c4570dd344a43e94ca55
DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf
+DIST openssh-9.8p1.tar.gz 1910393 BLAKE2B 3bf983c4ef5358054ed0104cd51d3e0069fbc2b80d8522d0df644d5508ec1d26a67bf061b1b5698d1cdf0d2cbba16b4cdca12a4ce30da24429094576a075e192 SHA512 95dec2f18e58eb47994f3de4430253e0665e185564b65088ca5f4108870e05feddef8cda8d3c0a4b75f18b98cc2c024df0e27de53b48c1a16da8da483cb8292a
+DIST openssh-9.8p1.tar.gz.asc 833 BLAKE2B 5291e8c03ab9a75acb44285cd7fc010f4a33551f142499624165dac708fc05a6d077df81555aa41037b45f6301e4e5db3161a7a23404473f8a233a877fc55cc3 SHA512 4df1f1be2c6ab7f3aebaedd0a773b0e8c8929abb30cd3415873ad55d012cfa113f792e888e5e772dd468c394aeb7e35d62893a514dbc0ab1a03acd79918657f7
diff --git a/net-misc/openssh/openssh-9.8_p1.ebuild b/net-misc/openssh/openssh-9.8_p1.ebuild
new file mode 100644
index 000000000000..4d382b9b6ac6
--- /dev/null
+++ b/net-misc/openssh/openssh-9.8_p1.ebuild
@@ -0,0 +1,398 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+"
+BDEPEND="
+ dev-build/autoconf
+ virtual/pkgconfig
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+ "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
+ "${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ # optional at runtime; guarantee a known path
+ --with-xauth="${EPREFIX}"/usr/bin/xauth
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+create_config_dropins() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
+ # override default of no subsystems
+ Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server
+ EOF
+
+ if use pam ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_compile() {
+ default
+ create_config_dropins
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+
+ # Install dropins with explicit mode, bug 906638, 915840
+ diropts -m0755
+ insopts -m0644
+ insinto /etc/ssh
+ doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+ doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
+ diropts -m0700
+ insopts -m0600
+ doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ # bug #139235
+ optfeature "x11 forwarding" x11-apps/xauth
+
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-04-15 7:42 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-04-15 7:42 UTC (permalink / raw
To: gentoo-commits
commit: f15611bcae75a78d88cedb30a1eac5d2a7d0404d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 15 07:30:53 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Apr 15 07:38:03 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f15611bc
net-misc/openssh: drop 9.6_p1-r1, 9.6_p1-r2
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 396 -----------------------------
net-misc/openssh/openssh-9.6_p1-r2.ebuild | 397 ------------------------------
2 files changed, 793 deletions(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
deleted file mode 100644
index 9e122cab62d8..000000000000
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ /dev/null
@@ -1,396 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.6_p1-r2.ebuild b/net-misc/openssh/openssh-9.6_p1-r2.ebuild
deleted file mode 100644
index dbbcd778f79e..000000000000
--- a/net-misc/openssh/openssh-9.6_p1-r2.ebuild
+++ /dev/null
@@ -1,397 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="
- ${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
- ${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- dev-build/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
- default
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
-
- # --with-hardening adds the following in addition to flags we
- # already set in our toolchain:
- # * -ftrapv (which is broken with GCC anyway),
- # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
- # the world to not have)
- # * -fzero-call-used-regs=used (history of miscompilations with
- # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
- # gcc PR104820, gcc PR104817, gcc PR110934)).
- #
- # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
- # so we cannot just disable -fzero-call-used-regs=used.
- #
- # Therefore, just pass --without-hardening, given it doesn't negate
- # our already hardened toolchain defaults, and avoids adding flags
- # which are known-broken in both Clang and GCC and haven't been
- # proven reliable.
- --without-hardening
-
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-25 17:28 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2024-03-25 17:28 UTC (permalink / raw
To: gentoo-commits
commit: ca472a48734faa1fe2431bfed39f642328bba7d7
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 25 17:27:42 2024 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 17:27:42 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ca472a48
net-misc/openssh: restore /etc/ssh/ssh_revoked_hosts
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/{openssh-9.7_p1-r1.ebuild => openssh-9.7_p1-r2.ebuild} | 1 +
1 file changed, 1 insertion(+)
diff --git a/net-misc/openssh/openssh-9.7_p1-r1.ebuild b/net-misc/openssh/openssh-9.7_p1-r2.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.7_p1-r1.ebuild
rename to net-misc/openssh/openssh-9.7_p1-r2.ebuild
index 9e06935f6fcd..3b0c7f2125a0 100644
--- a/net-misc/openssh/openssh-9.7_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r2.ebuild
@@ -332,6 +332,7 @@ src_install() {
insopts -m0644
insinto /etc/ssh
doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+ doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
diropts -m0700
insopts -m0600
doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-25 15:55 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2024-03-25 15:55 UTC (permalink / raw
To: gentoo-commits
commit: 354fa3a7f9bf93c9dd059380a1faa94522d81020
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 25 15:54:57 2024 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 15:54:57 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=354fa3a7
net-misc/openssh: simplify mkdir expression
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r1.ebuild b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
index 1271f7f5f29d..9e06935f6fcd 100644
--- a/net-misc/openssh/openssh-9.7_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
@@ -239,7 +239,7 @@ create_config_dropins() {
LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
)
- mkdir -p "${WORKDIR}"/etc/ssh/{ssh_config.d,sshd_config.d} || die
+ mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
# Send locale environment variables (bug #367017)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-25 15:50 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2024-03-25 15:50 UTC (permalink / raw
To: gentoo-commits
commit: 45cae2a8e7232df17ae461f2eacf3d991599b68a
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 25 15:49:58 2024 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 15:50:38 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=45cae2a8
net-misc/openssh: drop empty line
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r1.ebuild | 1 -
1 file changed, 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r1.ebuild b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
index d6e80b9337aa..1271f7f5f29d 100644
--- a/net-misc/openssh/openssh-9.7_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
@@ -307,7 +307,6 @@ src_test() {
emake -j1 "${tests[@]}" </dev/null
}
-
src_install() {
emake install-nokeys DESTDIR="${D}"
fperms 600 /etc/ssh/sshd_config
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-25 15:28 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2024-03-25 15:28 UTC (permalink / raw
To: gentoo-commits
commit: b6150ddac2b5cf1d8d1421afeaa1a9c3e9615d9e
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 25 15:26:12 2024 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 15:26:12 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b6150dda
net-misc/openssh: fix install mode for config dropins
Closes: https://bugs.gentoo.org/906639
Closes: https://bugs.gentoo.org/915840
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
...nssh-9.7_p1.ebuild => openssh-9.7_p1-r1.ebuild} | 78 +++++++++++++---------
1 file changed, 48 insertions(+), 30 deletions(-)
diff --git a/net-misc/openssh/openssh-9.7_p1.ebuild b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
similarity index 93%
rename from net-misc/openssh/openssh-9.7_p1.ebuild
rename to net-misc/openssh/openssh-9.7_p1-r1.ebuild
index 9508c8162da3..fdead7192a13 100644
--- a/net-misc/openssh/openssh-9.7_p1.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
@@ -217,24 +217,18 @@ src_configure() {
econf "${myconf[@]}"
}
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
+tweak_ssh_configs() {
+ cat <<-EOF >> ssh_config.out || die
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> sshd_config.out || die
+
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
}
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
+create_config_dropins() {
local locale_vars=(
# These are language variables that POSIX defines.
# http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
@@ -245,15 +239,9 @@ tweak_ssh_configs() {
LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
)
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
+ mkdir -p "${WORKDIR}"/etc/ssh/{ssh_config.d,sshd_config.d} || die
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
# Send locale environment variables (bug #367017)
SendEnv ${locale_vars[*]}
@@ -261,16 +249,16 @@ tweak_ssh_configs() {
SendEnv COLORTERM
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
# https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
# Allow client to pass locale environment variables (bug #367017)
AcceptEnv ${locale_vars[*]}
@@ -279,7 +267,7 @@ tweak_ssh_configs() {
EOF
if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
UsePAM yes
# This interferes with PAM.
PasswordAuthentication no
@@ -290,13 +278,36 @@ tweak_ssh_configs() {
fi
if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
# Allow root login with password on livecds.
PermitRootLogin Yes
EOF
fi
}
+src_compile() {
+ default
+ tweak_ssh_configs
+ create_config_dropins
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+
src_install() {
emake install-nokeys DESTDIR="${D}"
fperms 600 /etc/ssh/sshd_config
@@ -308,8 +319,6 @@ src_install() {
newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
fi
- tweak_ssh_configs
-
doman contrib/ssh-copy-id.1
dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
@@ -320,6 +329,15 @@ src_install() {
systemd_dounit "${FILESDIR}"/sshd.socket
systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+
+ # Install dropins with explicit mode, bug 906638, 915840
+ diropts -m0755
+ insopts -m0644
+ insinto /etc/ssh
+ doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+ diropts -m0700
+ insopts -m0600
+ doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
}
pkg_preinst() {
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-25 15:28 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2024-03-25 15:28 UTC (permalink / raw
To: gentoo-commits
commit: aba49bdba12513527a8fe97b6713a32ad13abfcc
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 25 15:27:17 2024 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 15:27:17 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aba49bdb
net-misc/openssh: do no create empty /etc/skel/.ssh
Portage refuses to install empty directories.
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-9.7_p1-r1.ebuild | 2 --
1 file changed, 2 deletions(-)
diff --git a/net-misc/openssh/openssh-9.7_p1-r1.ebuild b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
index fdead7192a13..d6e80b9337aa 100644
--- a/net-misc/openssh/openssh-9.7_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.7_p1-r1.ebuild
@@ -322,8 +322,6 @@ src_install() {
doman contrib/ssh-copy-id.1
dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
- diropts -m 0700
- dodir /etc/skel/.ssh
rmdir "${ED}"/var/empty || die
systemd_dounit "${FILESDIR}"/sshd.socket
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-15 19:25 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-15 19:25 UTC (permalink / raw
To: gentoo-commits
commit: 6fc56ec893c7b291955dd16f8c810b1b130cf829
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Thu Mar 14 14:49:57 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Mar 15 19:24:47 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6fc56ec8
net-misc/openssh: stable 9.6_p1-r3 for sparc, bug #926795
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 601da1ec3197..7b90a635135b 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 8:05 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 8:05 UTC (permalink / raw
To: gentoo-commits
commit: 1a2528b416189a2d9701e0ee4c1bcc022a392fbc
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 08:05:22 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 08:05:22 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1a2528b4
net-misc/openssh: Stabilize 9.6_p1-r3 x86, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 4fd7758a146a..601da1ec3197 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 8:05 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 8:05 UTC (permalink / raw
To: gentoo-commits
commit: 313d8690c230c5f0ac992b123d8e118ab71f4549
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 08:05:21 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 08:05:21 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=313d8690
net-misc/openssh: Stabilize 9.6_p1-r3 amd64, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 6e6007085d34..4fd7758a146a 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 6:53 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 6:53 UTC (permalink / raw
To: gentoo-commits
commit: 08074a32991c8a7cb82f97793fcde5ab875e4d18
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 06:53:03 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 06:53:08 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=08074a32
net-misc/openssh: Stabilize 9.6_p1-r3 arm, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 268e55923115..1689d3e4ad4f 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 6:53 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 6:53 UTC (permalink / raw
To: gentoo-commits
commit: f67efe83e0a57c7aec29136213a386b739b35fd8
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 06:53:01 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 06:53:07 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f67efe83
net-misc/openssh: Stabilize 9.6_p1-r3 ppc, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index e336bd18281e..268e55923115 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 6:53 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 6:53 UTC (permalink / raw
To: gentoo-commits
commit: b4373a6855b387313751e36fe5de0233e068d769
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 06:53:04 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 06:53:09 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4373a68
net-misc/openssh: Stabilize 9.6_p1-r3 ppc64, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 1689d3e4ad4f..0f5037bc13ac 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 6:53 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 6:53 UTC (permalink / raw
To: gentoo-commits
commit: 617d2f2dfd26a7c56965422bdf0911460eb424d7
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 06:53:05 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 06:53:09 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=617d2f2d
net-misc/openssh: Stabilize 9.6_p1-r3 arm64, #926795
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 0f5037bc13ac..6e6007085d34 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-03-12 3:47 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-03-12 3:47 UTC (permalink / raw
To: gentoo-commits
commit: 98960014f9f93bbb7f696b3bd51c6ab119d0997a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 03:47:19 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 03:47:19 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=98960014
net-misc/openssh: add 9.7_p1
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.7_p1.ebuild | 388 +++++++++++++++++++++++++++++++++
2 files changed, 390 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index bbc5cf33ad57..363bef164ad2 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,2 +1,4 @@
DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509
DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
+DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b SHA512 0cafc17d22851605a4a5495a1d82c2b3fbbe6643760aad226dbf2a25b5f49d4375c3172833706ea3cb6c05d5d02a40feb9a7e790eae5c4570dd344a43e94ca55
+DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf
diff --git a/net-misc/openssh/openssh-9.7_p1.ebuild b/net-misc/openssh/openssh-9.7_p1.ebuild
new file mode 100644
index 000000000000..9508c8162da3
--- /dev/null
+++ b/net-misc/openssh/openssh-9.7_p1.ebuild
@@ -0,0 +1,388 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+"
+BDEPEND="
+ dev-build/autoconf
+ virtual/pkgconfig
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ # optional at runtime; guarantee a known path
+ --with-xauth="${EPREFIX}"/usr/bin/xauth
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ # bug #139235
+ optfeature "x11 forwarding" x11-apps/xauth
+
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-02-19 6:17 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-02-19 6:17 UTC (permalink / raw
To: gentoo-commits
commit: 9930542f8c659d729750b6abf2bfb81dcab40cee
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 19 06:17:02 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Feb 19 06:17:11 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9930542f
net-misc/openssh: drop old gcc-config workaround
This shouldn't be needed anymore since 0b22d07f89b16ac3400e45077702ac4c4492e5a4 anyway.
Bug: https://bugs.gentoo.org/872416
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 7 -------
1 file changed, 7 deletions(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 3876e99bb31c..e336bd18281e 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -69,16 +69,9 @@ RDEPEND="
pam? ( >=sys-auth/pambase-20081028 )
!prefix? ( sys-apps/shadow )
"
-# Weird dep construct for newer gcc-config for bug #872416
BDEPEND="
dev-build/autoconf
virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
verify-sig? ( sec-keys/openpgp-keys-openssh )
"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-02-19 6:16 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-02-19 6:16 UTC (permalink / raw
To: gentoo-commits
commit: e6268410df9427a59a9a4f08a0a10f7139f5d3a4
Author: Eli Schwartz <eschwartz93 <AT> gmail <DOT> com>
AuthorDate: Mon Feb 19 06:07:41 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Feb 19 06:16:02 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e6268410
net-misc/openssh: use an officially supported approach to overriding xauth
Instead of patching out a header file, use the ./configure option
dedicated for this purpose. It has the side effect of correctly sed'ing
out config files / manpages with the updated location.
When not explicitly passed, the builtin default is used as a fallback,
but when USE=X, portage as an implementation detail guarantees that
xauth will be installed before openssh is compiled.
... as long as you don't use --buildpkg.
So, "probably" if you used USE=X the paths were correct, but:
- this is overall a poor approach to reliability
- it misses the point of also overriding the path when USE="-X"
- we just removed the USE flag and the RDEPEND
Signed-off-by: Eli Schwartz <eschwartz93 <AT> gmail.com>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
index 164c30ecc6c8..3876e99bb31c 100644
--- a/net-misc/openssh/openssh-9.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -128,10 +128,6 @@ pkg_pretend() {
}
src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
# don't break .ssh/authorized_keys2 for fun
sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
@@ -185,6 +181,8 @@ src_configure() {
--datadir="${EPREFIX}"/usr/share/openssh
--with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
+ # optional at runtime; guarantee a known path
+ --with-xauth="${EPREFIX}"/usr/bin/xauth
# --with-hardening adds the following in addition to flags we
# already set in our toolchain:
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2024-02-19 6:16 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2024-02-19 6:16 UTC (permalink / raw
To: gentoo-commits
commit: 1b305efd9c1f5c34528aa0022e47b04f758bcd2f
Author: Eli Schwartz <eschwartz93 <AT> gmail <DOT> com>
AuthorDate: Mon Feb 19 05:28:30 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Feb 19 06:16:02 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b305efd
net-misc/openssh: remove pointless USE=X
It was originally added in 2006 with the following rationale:
> Since with our new stable modular X, all we need to do X11-forwarding
> via SSH is to have x11-apps/xauth (and dependencies) installed, it would
> be handy to have this as an RDEPEND in the ebuilds. In order to keep
> most entirely-non-X servers happy, it should probably be turned on only
> with a USE flag, say 'X'.
> This is entirely unnecessary for the building of openssh, but would
> provide a straight-foward way of letting users know what to do if they
> want to enable x11-forwarding w/o having xorg-x11 installed, and without
> having to debug their ssh -X session or delve deeply into documentation.
It is the textbook rationale for optfeature. However, in 2006,
optfeature didn't exist -- it was added in 2014 through bug 498988.
(And of course the real solution is GLEP 62 "IUSE_RUNTIME".)
It is now 2024 and enabling/disabling USE=X still causes openssh to
pointlessly recompile and rebuild itself, invalidating binhosts in the
process.
Bug: https://bugs.gentoo.org/139235
Signed-off-by: Eli Schwartz <eschwartz93 <AT> gmail.com>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r3.ebuild | 399 ++++++++++++++++++++++++++++++
1 file changed, 399 insertions(+)
diff --git a/net-misc/openssh/openssh-9.6_p1-r3.ebuild b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
new file mode 100644
index 000000000000..164c30ecc6c8
--- /dev/null
+++ b/net-misc/openssh/openssh-9.6_p1-r3.ebuild
@@ -0,0 +1,399 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ dev-build/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ # bug #139235
+ optfeature "x11 forwarding" x11-apps/xauth
+
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-27 22:58 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-27 22:58 UTC (permalink / raw
To: gentoo-commits
commit: 689b8406100511e1dfdbdebdf78b4c152a0dfa27
Author: Matoro Mahri <matoro_gentoo <AT> matoro <DOT> tk>
AuthorDate: Wed Dec 27 20:25:30 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 27 22:57:25 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=689b8406
net-misc/openssh: Stabilize 9.6_p1-r1 hppa, #920725
Signed-off-by: Matoro Mahri <matoro_gentoo <AT> matoro.tk>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 011e3af524a9..4d58b7dae9d2 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-27 22:58 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-27 22:58 UTC (permalink / raw
To: gentoo-commits
commit: d38585952d9e47d3507284ac84ff71005e762418
Author: Matoro Mahri <matoro_gentoo <AT> matoro <DOT> tk>
AuthorDate: Wed Dec 27 18:51:38 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 27 22:57:25 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d3858595
net-misc/openssh: Stabilize 9.6_p1-r1 sparc, #920725
Signed-off-by: Matoro Mahri <matoro_gentoo <AT> matoro.tk>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 87545bba0213..011e3af524a9 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-27 22:58 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-27 22:58 UTC (permalink / raw
To: gentoo-commits
commit: 8f61bcb78d8d1844b6aee7f9368eb654ffa748fb
Author: Matoro Mahri <matoro_gentoo <AT> matoro <DOT> tk>
AuthorDate: Wed Dec 27 18:28:44 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 27 22:57:24 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f61bcb7
net-misc/openssh: Stabilize 9.6_p1-r1 ppc64, #920725
Signed-off-by: Matoro Mahri <matoro_gentoo <AT> matoro.tk>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index affd7208bd67..4299413343c5 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-27 22:58 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-27 22:58 UTC (permalink / raw
To: gentoo-commits
commit: 973983d8fd30984f259217b10074e8011e0e52eb
Author: Matoro Mahri <matoro_gentoo <AT> matoro <DOT> tk>
AuthorDate: Wed Dec 27 18:34:42 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 27 22:57:24 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=973983d8
net-misc/openssh: Stabilize 9.6_p1-r1 ppc, #920725
Signed-off-by: Matoro Mahri <matoro_gentoo <AT> matoro.tk>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 4299413343c5..87545bba0213 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-27 21:12 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-27 21:12 UTC (permalink / raw
To: gentoo-commits
commit: 078d2b21258b55a295a37a931bc0fbc52be72d01
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 27 21:11:49 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 27 21:11:49 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=078d2b21
net-misc/openssh: Stabilize 9.6_p1-r1 x86, #920725
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 4171585fdb9f..affd7208bd67 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-26 17:34 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-26 17:34 UTC (permalink / raw
To: gentoo-commits
commit: 5b375972ff0e0d1c2cca84a9416a369a1d60ba8d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 26 17:34:00 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 26 17:34:00 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b375972
net-misc/openssh: Stabilize 9.6_p1-r1 amd64, #920725
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 42a3e0b19132..4171585fdb9f 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-26 17:34 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-26 17:34 UTC (permalink / raw
To: gentoo-commits
commit: 01e10d60a7465d13a038628874a53106d57e4c23
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 26 17:33:59 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 26 17:33:59 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=01e10d60
net-misc/openssh: Stabilize 9.6_p1-r1 arm, #920725
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 37d2870e7a4e..42a3e0b19132 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-26 17:34 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-26 17:34 UTC (permalink / raw
To: gentoo-commits
commit: 1587d1c20f6bf40b80a483d04e8bf392e769e453
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 26 17:33:57 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 26 17:33:57 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1587d1c2
net-misc/openssh: Stabilize 9.6_p1-r1 arm64, #920725
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
index 84130f1d6514..37d2870e7a4e 100644
--- a/net-misc/openssh/openssh-9.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -20,7 +20,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-23 19:56 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-12-23 19:56 UTC (permalink / raw
To: gentoo-commits
commit: 05703a8e8f15f62cdea07ccc2b8436b5f56725ee
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 23 19:55:37 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sat Dec 23 19:55:37 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=05703a8e
net-misc/openssh: Stabilize 9.5_p1-r2 ppc, #919972
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 8985d5705b50..5043c36ea762 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-23 4:17 Ionen Wolkens
0 siblings, 0 replies; 441+ messages in thread
From: Ionen Wolkens @ 2023-12-23 4:17 UTC (permalink / raw
To: gentoo-commits
commit: cf40ac4cd273ebd8edb9d0595b7ec1df5d1f2a46
Author: Matoro Mahri <matoro_gentoo <AT> matoro <DOT> tk>
AuthorDate: Fri Dec 22 05:34:33 2023 +0000
Commit: Ionen Wolkens <ionen <AT> gentoo <DOT> org>
CommitDate: Sat Dec 23 04:16:16 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cf40ac4c
net-misc/openssh: Stabilize 9.5_p1-r2 hppa, #919972
Signed-off-by: Matoro Mahri <matoro_gentoo <AT> matoro.tk>
Signed-off-by: Ionen Wolkens <ionen <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 967c48bfb156..8985d5705b50 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-20 7:14 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-20 7:14 UTC (permalink / raw
To: gentoo-commits
commit: 0b22d07f89b16ac3400e45077702ac4c4492e5a4
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 20 07:12:26 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Dec 20 07:14:16 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0b22d07f
net-misc/openssh: disable problematic -fzero-call-used-regs=*
--with-hardening adds the following in addition to flags we
already set in our toolchain:
* -ftrapv (which is broken with GCC anyway),
* -ftrivial-auto-var-init=zero (which is nice, but not the end of
the world to not have)
* -fzero-call-used-regs=used (history of miscompilations with
Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
gcc PR104820, gcc PR104817, gcc PR110934)).
Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
so we cannot just disable -fzero-call-used-regs=used.
Therefore, just pass --without-hardening, given it doesn't negate
our already hardened toolchain defaults, and avoids adding flags
which are known-broken in both Clang and GCC and haven't been
proven reliable.
Bug: https://bugs.gentoo.org/872548
Bug: https://bugs.gentoo.org/920350
Bug: https://bugs.gentoo.org/920292
Bug: https://gcc.gnu.org/PR113086
Bug: https://gcc.gnu.org/PR104820
Bug: https://gcc.gnu.org/PR104817
Bug: https://gcc.gnu.org/PR110934
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.6_p1-r1.ebuild | 396 ++++++++++++++++++++++++++++++
1 file changed, 396 insertions(+)
diff --git a/net-misc/openssh/openssh-9.6_p1-r1.ebuild b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
new file mode 100644
index 000000000000..84130f1d6514
--- /dev/null
+++ b/net-misc/openssh/openssh-9.6_p1-r1.ebuild
@@ -0,0 +1,396 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-19 5:42 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-19 5:42 UTC (permalink / raw
To: gentoo-commits
commit: d1307b9e32ea830c31939a8083de2b052e6fa3bc
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 19 05:40:50 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 19 05:40:50 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d1307b9e
net-misc/openssh: add 9.6_p1
Bug: https://bugs.gentoo.org/920292
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.6_p1.ebuild | 378 +++++++++++++++++++++++++++++++++
2 files changed, 380 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 6b2564313240..23887af76d94 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -6,3 +6,5 @@ DIST openssh-9.4p1.tar.gz 1845094 BLAKE2B d13d758129cce947d3f12edb6e88406aad10de
DIST openssh-9.4p1.tar.gz.asc 833 BLAKE2B 95eedd9356766e5d0ea1261da3dc4c7869f054b418c626fb35815a0aa655b1ddbf54436b437d98c4344b05c9196c8fa1f592eac07b3ccf08bd3e980f8b6955af SHA512 983b4ebaa3b98e70831ce686cb503270926c065163a2510eef0c5102ef50b6e665b889ee15ea8c0bd7c4bbddb19270f036e1d554a8212ef2c292f9c682c8631a
DIST openssh-9.5p1.tar.gz 1843001 BLAKE2B 55dbb0a2792b0046c943a19ca0966660e6e378e77856e94823a1bbbafaa0da94357403765c4c028aebf6543049a0f9bbe0019629be3f92cdadfac1be56def796 SHA512 e183fdf7477fd986215b889eea4a945d71385e35305746ccb164e757ecc28166f429c70890a237d8ef4cdcae5132935ba2ecb3b2a658eb73a6afcf6f42277b9c
DIST openssh-9.5p1.tar.gz.asc 833 BLAKE2B abec3d14d9a880008db202be00ed446ccc0a98ce77c16a9e6d6492feac07c8f3284f9cd24f6ee1d904a55f9f23d5cce8a716916975c179a38ef6bde1d36e0acf SHA512 2b6de653420ba02eb99c7e6fba09af3bacfe9c701f3dfc3c94f41a3539c0414954fc5c64cce63c488c5ccd5d4ddb42d3f2184ff7f323342c885c47bf7d426ca1
+DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509
+DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
diff --git a/net-misc/openssh/openssh-9.6_p1.ebuild b/net-misc/openssh/openssh-9.6_p1.ebuild
new file mode 100644
index 000000000000..c53574f62515
--- /dev/null
+++ b/net-misc/openssh/openssh-9.6_p1.ebuild
@@ -0,0 +1,378 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ --with-hardening
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 12:41 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-12-15 12:41 UTC (permalink / raw
To: gentoo-commits
commit: b65fa6754515104a1010b1c8b7b56397840d3c11
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 12:41:38 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 12:41:38 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b65fa675
net-misc/openssh: Stabilize 9.5_p1-r2 x86, #919972
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 82243ec5313e..967c48bfb156 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 10:38 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-12-15 10:38 UTC (permalink / raw
To: gentoo-commits
commit: f038c1d25975265b8f0f42a5afeb576a0568cf08
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 10:38:22 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 10:38:22 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f038c1d2
net-misc/openssh: Stabilize 9.5_p1-r2 ppc64, #919972
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index d2696cc1f155..82243ec5313e 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 8:16 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-15 8:16 UTC (permalink / raw
To: gentoo-commits
commit: 6a94e5254def0450dad8a7f7114016ca36715942
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 08:16:03 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 08:16:03 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6a94e525
net-misc/openssh: Stabilize 9.5_p1-r2 arm, #919972
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 867b3cc18c87..d2696cc1f155 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 7:49 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-15 7:49 UTC (permalink / raw
To: gentoo-commits
commit: 5b10e23336364fe733da991dc712ddf621bcac74
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 07:48:57 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 07:48:57 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b10e233
net-misc/openssh: Stabilize 9.5_p1-r2 amd64, #919972
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 4fa25b8cea3d..867b3cc18c87 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 7:23 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-15 7:23 UTC (permalink / raw
To: gentoo-commits
commit: 3ab071f183614a99d94c3bdaa20b4c7470825506
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 07:23:26 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 07:23:26 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3ab071f1
net-misc/openssh: Stabilize 9.5_p1-r2 arm64, #919972
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 1466de270592..4fa25b8cea3d 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-12-15 7:23 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-12-15 7:23 UTC (permalink / raw
To: gentoo-commits
commit: 897ae02f0e9d8e41837f1ead0a1b719a3f0a20e2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 15 07:23:24 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 15 07:23:24 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=897ae02f
net-misc/openssh: Stabilize 9.5_p1-r2 sparc, #919972
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.5_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
index b9a20909630a..1466de270592 100644
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-24 19:46 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-10-24 19:46 UTC (permalink / raw
To: gentoo-commits
commit: d64d4d38e8204b9c0f0dfbbe8d471760852d7482
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 24 19:46:39 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 24 19:46:39 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d64d4d38
net-misc/openssh: Stabilize 9.4_p1-r1 ppc64, #915461
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1-r1.ebuild b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
index 5f45647ac5c9..fc65af8c47b0 100644
--- a/net-misc/openssh/openssh-9.4_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-24 19:46 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-10-24 19:46 UTC (permalink / raw
To: gentoo-commits
commit: c967e1bff06e856c8210863f2d8fa3542a3819fc
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 24 19:46:36 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 24 19:46:36 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c967e1bf
net-misc/openssh: Stabilize 9.4_p1-r1 ppc, #915461
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1-r1.ebuild b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
index edd62d7fd3da..5f45647ac5c9 100644
--- a/net-misc/openssh/openssh-9.4_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-13 11:28 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2023-10-13 11:28 UTC (permalink / raw
To: gentoo-commits
commit: 9024643ba0d8cc35557123d3ad34f978906ae96b
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 13 11:28:49 2023 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Fri Oct 13 11:28:49 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9024643b
net-misc/openssh: drop GSSAPI patch
* This patch is far too large for Gentoo to carry without any upstream
guidance and this leads to breakage every few releases.
* Every distro has a different patch for this issue. In particular,
the patches carried by Debian and Fedora are more comprehensive.
* Upstream doesn't seem to care about the actual issue, seeing there
hasn't been any progress in the last 10 years or so:
http://bugzilla.mindrot.org/show_bug.cgi?id=1008
Bug: https://bugs.gentoo.org/165444
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/{openssh-9.5_p1-r1.ebuild => openssh-9.5_p1-r2.ebuild} | 1 -
1 file changed, 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.5_p1-r1.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.5_p1-r1.ebuild
rename to net-misc/openssh/openssh-9.5_p1-r2.ebuild
index 8ab790480184..1bfec7fcc267 100644
--- a/net-misc/openssh/openssh-9.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
@@ -81,7 +81,6 @@ BDEPEND="
"
PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
"${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-13 11:04 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-10-13 11:04 UTC (permalink / raw
To: gentoo-commits
commit: cd2fe0690ce131cc623a34eb8a9586f50d0737c9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 13 11:00:39 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 13 11:03:50 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cd2fe069
net-misc/openssh: drop obsolete patch from 9.4, 9.5
This was fixed properly by upstream in 9.4 so the workaround isn't needed;
openssh-9.3_p1-openssl-ignore-status.patch applies with fuzz to >=9.4 and
does the wrong thing there as it touches the non-OpenSSL 3 case (upstream
added a conditional above in >=9.4).
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/{openssh-9.4_p1.ebuild => openssh-9.4_p1-r1.ebuild} | 1 -
net-misc/openssh/{openssh-9.5_p1.ebuild => openssh-9.5_p1-r1.ebuild} | 1 -
2 files changed, 2 deletions(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.4_p1.ebuild
rename to net-misc/openssh/openssh-9.4_p1-r1.ebuild
index d57adca97bd1..edd62d7fd3da 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
@@ -82,7 +82,6 @@ BDEPEND="
PATCHES=(
"${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-9.3_p1-openssl-ignore-status.patch"
"${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
diff --git a/net-misc/openssh/openssh-9.5_p1.ebuild b/net-misc/openssh/openssh-9.5_p1-r1.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.5_p1.ebuild
rename to net-misc/openssh/openssh-9.5_p1-r1.ebuild
index ec36f3445783..8ab790480184 100644
--- a/net-misc/openssh/openssh-9.5_p1.ebuild
+++ b/net-misc/openssh/openssh-9.5_p1-r1.ebuild
@@ -82,7 +82,6 @@ BDEPEND="
PATCHES=(
"${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-9.3_p1-openssl-ignore-status.patch"
"${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
"${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 18:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-10-09 18:57 UTC (permalink / raw
To: gentoo-commits
commit: 682d6efe2be9885241813bb863324178a8d8aa5a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 18:56:59 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 18:56:59 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=682d6efe
net-misc/openssh: Stabilize 9.4_p1 amd64, #915461
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index 6425c3bf5a36..d57adca97bd1 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 16:21 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-10-09 16:21 UTC (permalink / raw
To: gentoo-commits
commit: 78218a0009569499d204f42a323522eb42d12680
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 16:19:43 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 16:19:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=78218a00
net-misc/openssh: Stabilize 9.4_p1 hppa, #915461
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index 18a639795c06..6425c3bf5a36 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 16:21 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-10-09 16:21 UTC (permalink / raw
To: gentoo-commits
commit: 22447592be90ba7eebd9dfdfbd1c1f5be5f2ef67
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 16:19:43 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 16:19:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=22447592
net-misc/openssh: Stabilize 9.4_p1 x86, #915461
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index c39c8ba35392..18a639795c06 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 5:54 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-10-09 5:54 UTC (permalink / raw
To: gentoo-commits
commit: 115b9b15c488e1162a6692c0ecf44be53aff49a3
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 05:54:28 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 05:54:28 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=115b9b15
net-misc/openssh: Stabilize 9.4_p1 sparc, #915461
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index 33c769b8b00f..c39c8ba35392 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 4:53 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-10-09 4:53 UTC (permalink / raw
To: gentoo-commits
commit: 19b9aaecef9d28fb976e1e7ab93157ce635717c0
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 04:52:52 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 04:52:52 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=19b9aaec
net-misc/openssh: Stabilize 9.4_p1 arm64, #915461
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index 2a7b1a0175bf..33c769b8b00f 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-09 4:46 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-10-09 4:46 UTC (permalink / raw
To: gentoo-commits
commit: 4707c9eb82769a7fa21d4e5ca81dc7b90ffc157d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 9 04:46:23 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Oct 9 04:46:23 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4707c9eb
net-misc/openssh: Stabilize 9.4_p1 arm, #915461
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.4_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
index 5d1ffb94eba4..2a7b1a0175bf 100644
--- a/net-misc/openssh/openssh-9.4_p1.ebuild
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-10-04 17:42 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-10-04 17:42 UTC (permalink / raw
To: gentoo-commits
commit: b381e15eb7d11d5e8a8e8d22a6918422f615dc10
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 4 17:41:57 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Oct 4 17:42:04 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b381e15e
net-misc/openssh: add 9.5_p1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.5_p1.ebuild | 380 +++++++++++++++++++++++++++++++++
2 files changed, 382 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index bf1883a4f917..6b2564313240 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -4,3 +4,5 @@ DIST openssh-9.3p2.tar.gz 1835850 BLAKE2B 38f8d4ada263112b318fafccabf0a33a004d82
DIST openssh-9.3p2.tar.gz.asc 833 BLAKE2B cfba3867d7f97cb2c904bd3ae111bd63e8a050464b66e3f3f22390839a153d57ef5819182f8ad99a6b520f27881143552dc64fccfc33dcc0483ffe1ef33a5a47 SHA512 759e512a36a3a62264803b517298a65c83e1daebd9867e28ea1ca4999c38539368815ccda86540a4f5d45fa79c539d8242995ba55f2918baf2a7404c105e337a
DIST openssh-9.4p1.tar.gz 1845094 BLAKE2B d13d758129cce947d3f12edb6e88406aad10de6887b19ffa3ebd8e382b742a05f2a692a8824aec99939f6c7e13fbccc3bb14e5ee112f9a9255d4882eb87dcf53 SHA512 0aaedeced7dbc70419c7245eb0e9db4ef570e0e7739b890ebae04d56da5fe8d147e8e150f3c943f60730976569e3ac6cc8da62ec7e2a78e2ef47d295ca0b1d25
DIST openssh-9.4p1.tar.gz.asc 833 BLAKE2B 95eedd9356766e5d0ea1261da3dc4c7869f054b418c626fb35815a0aa655b1ddbf54436b437d98c4344b05c9196c8fa1f592eac07b3ccf08bd3e980f8b6955af SHA512 983b4ebaa3b98e70831ce686cb503270926c065163a2510eef0c5102ef50b6e665b889ee15ea8c0bd7c4bbddb19270f036e1d554a8212ef2c292f9c682c8631a
+DIST openssh-9.5p1.tar.gz 1843001 BLAKE2B 55dbb0a2792b0046c943a19ca0966660e6e378e77856e94823a1bbbafaa0da94357403765c4c028aebf6543049a0f9bbe0019629be3f92cdadfac1be56def796 SHA512 e183fdf7477fd986215b889eea4a945d71385e35305746ccb164e757ecc28166f429c70890a237d8ef4cdcae5132935ba2ecb3b2a658eb73a6afcf6f42277b9c
+DIST openssh-9.5p1.tar.gz.asc 833 BLAKE2B abec3d14d9a880008db202be00ed446ccc0a98ce77c16a9e6d6492feac07c8f3284f9cd24f6ee1d904a55f9f23d5cce8a716916975c179a38ef6bde1d36e0acf SHA512 2b6de653420ba02eb99c7e6fba09af3bacfe9c701f3dfc3c94f41a3539c0414954fc5c64cce63c488c5ccd5d4ddb42d3f2184ff7f323342c885c47bf7d426ca1
diff --git a/net-misc/openssh/openssh-9.5_p1.ebuild b/net-misc/openssh/openssh-9.5_p1.ebuild
new file mode 100644
index 000000000000..ec36f3445783
--- /dev/null
+++ b/net-misc/openssh/openssh-9.5_p1.ebuild
@@ -0,0 +1,380 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-9.3_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply -- "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ --with-hardening
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-08-10 21:55 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-08-10 21:55 UTC (permalink / raw
To: gentoo-commits
commit: 46a96be305963e4e1863ac3c0027f7a8900e802e
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 10 21:55:11 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Aug 10 21:55:40 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=46a96be3
net-misc/openssh: add 9.4_p1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.4_p1.ebuild | 380 +++++++++++++++++++++++++++++++++
2 files changed, 382 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 2428753e02f7..bf1883a4f917 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -2,3 +2,5 @@ DIST openssh-9.3p1.tar.gz 1856839 BLAKE2B 45578edf98bba3d23c7cefe60d8a7d3079e7c6
DIST openssh-9.3p1.tar.gz.asc 833 BLAKE2B e6533d64b117a400b76b90f71fa856d352dea57d91e4e89fa375429403ac0734cc0a2f075bc58c6bb4f40a8f9776735aa36bdb0bbf3880a2115cea787633e48b SHA512 6222378eb24a445c6c1db255392b405f5369b1af0e92f558d4ba05b0d83ab0d084cb8f4b91d7ae8636f333d970638a6635e2bc7af885135dd34992d87f2ef1f4
DIST openssh-9.3p2.tar.gz 1835850 BLAKE2B 38f8d4ada263112b318fafccabf0a33a004d8290a867434004eb3d37127c9bdabe6e0225fca9d6d68fb54338fec81dcc9313ca7c91d3a033311db44174dc9f6f SHA512 15b8c57aa120186f1d1c3c2b8dc6ffd26733e12f755a6b0a4255d9ec1815a61506275ff5723b4ac029e44bc2ad22852ac36e1101f292348fbfa79aa1a4cd3f35
DIST openssh-9.3p2.tar.gz.asc 833 BLAKE2B cfba3867d7f97cb2c904bd3ae111bd63e8a050464b66e3f3f22390839a153d57ef5819182f8ad99a6b520f27881143552dc64fccfc33dcc0483ffe1ef33a5a47 SHA512 759e512a36a3a62264803b517298a65c83e1daebd9867e28ea1ca4999c38539368815ccda86540a4f5d45fa79c539d8242995ba55f2918baf2a7404c105e337a
+DIST openssh-9.4p1.tar.gz 1845094 BLAKE2B d13d758129cce947d3f12edb6e88406aad10de6887b19ffa3ebd8e382b742a05f2a692a8824aec99939f6c7e13fbccc3bb14e5ee112f9a9255d4882eb87dcf53 SHA512 0aaedeced7dbc70419c7245eb0e9db4ef570e0e7739b890ebae04d56da5fe8d147e8e150f3c943f60730976569e3ac6cc8da62ec7e2a78e2ef47d295ca0b1d25
+DIST openssh-9.4p1.tar.gz.asc 833 BLAKE2B 95eedd9356766e5d0ea1261da3dc4c7869f054b418c626fb35815a0aa655b1ddbf54436b437d98c4344b05c9196c8fa1f592eac07b3ccf08bd3e980f8b6955af SHA512 983b4ebaa3b98e70831ce686cb503270926c065163a2510eef0c5102ef50b6e665b889ee15ea8c0bd7c4bbddb19270f036e1d554a8212ef2c292f9c682c8631a
diff --git a/net-misc/openssh/openssh-9.4_p1.ebuild b/net-misc/openssh/openssh-9.4_p1.ebuild
new file mode 100644
index 000000000000..ec36f3445783
--- /dev/null
+++ b/net-misc/openssh/openssh-9.4_p1.ebuild
@@ -0,0 +1,380 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-9.3_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply -- "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ --with-hardening
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-08-02 12:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-08-02 12:39 UTC (permalink / raw
To: gentoo-commits
commit: af815ce4c7a7933c36b36b24c29b655bfec37105
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 2 12:38:57 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Aug 2 12:38:57 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af815ce4
net-misc/openssh: skip sanity-check for binpkgs
Because of environment saving, we can't allow users to override for binpkgs, so just
elide the check there.
Closes: https://bugs.gentoo.org/907892
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index e3184f35c252..8e57bfe2061c 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -100,6 +100,9 @@ pkg_pretend() {
done
if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
ewarn "since these USE flags required third-party patches that often trigger bugs"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-23 16:12 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-07-23 16:12 UTC (permalink / raw
To: gentoo-commits
commit: ee25b7d5358f42edd851c00492a885faaf2e349c
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 23 16:12:11 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sun Jul 23 16:12:11 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ee25b7d5
net-misc/openssh: Stabilize 9.3_p2 sparc, #910555
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index 828953a4652f..e3184f35c252 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-23 16:01 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-07-23 16:01 UTC (permalink / raw
To: gentoo-commits
commit: 696ff84abcd8ea66ca7e70eeaaf84771597bc982
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 23 16:01:13 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sun Jul 23 16:01:13 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=696ff84a
net-misc/openssh: Stabilize 9.3_p2 hppa, #910555
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index ce2c7c5bcf0a..828953a4652f 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:23 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-07-19 15:23 UTC (permalink / raw
To: gentoo-commits
commit: f1537b974a4f616df8a75075b10bbe28ef00e1f2
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:23:19 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:23:19 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1537b97
net-misc/openssh: Stabilize 9.3_p2 ppc, #910555
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index 59707d8bb693..42b4c24054c0 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:23 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-07-19 15:23 UTC (permalink / raw
To: gentoo-commits
commit: cda793b7328774c58f6c4ce7baf15a13734b3e87
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:23:29 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:23:29 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cda793b7
net-misc/openssh: Stabilize 9.3_p2 ppc64, #910555
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index 42b4c24054c0..ce2c7c5bcf0a 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:13 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-07-19 15:13 UTC (permalink / raw
To: gentoo-commits
commit: 080bf20c86100a54e932f414a720ce01ebcf1de1
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:13:39 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:13:39 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=080bf20c
net-misc/openssh: Stabilize 9.3_p2 x86, #910555
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index d67ddfcffda4..59707d8bb693 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:13 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-07-19 15:13 UTC (permalink / raw
To: gentoo-commits
commit: 42f7fa536bfbb84553397cd00e4343dc40d4bb3f
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:13:38 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:13:38 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=42f7fa53
net-misc/openssh: Stabilize 9.3_p2 arm, #910555
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index f9b7b475b4f3..d67ddfcffda4 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:11 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-07-19 15:11 UTC (permalink / raw
To: gentoo-commits
commit: b08446b3b5f8c0fa29ec8d2da0a9bdfee0dba01f
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:11:43 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:11:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b08446b3
net-misc/openssh: Stabilize 9.3_p2 amd64, #910555
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index 807a957d8b9b..f9b7b475b4f3 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 15:11 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-07-19 15:11 UTC (permalink / raw
To: gentoo-commits
commit: fb8ce7b47306c0b3837cac22256646034eac8f8f
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 15:11:23 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 15:11:23 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fb8ce7b4
net-misc/openssh: Stabilize 9.3_p2 arm64, #910555
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
index f3833c8da7c4..807a957d8b9b 100644
--- a/net-misc/openssh/openssh-9.3_p2.ebuild
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-07-19 14:41 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-07-19 14:41 UTC (permalink / raw
To: gentoo-commits
commit: 704e9eeeaeb28174462b3a4c68376f43bbfa6765
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 19 14:41:10 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 19 14:41:16 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=704e9eee
net-misc/openssh: add 9.3_p2
Bug: https://bugs.gentoo.org/910553
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.3_p2.ebuild | 379 +++++++++++++++++++++++++++++++++
2 files changed, 381 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 6f31cfab6a73..2428753e02f7 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,2 +1,4 @@
DIST openssh-9.3p1.tar.gz 1856839 BLAKE2B 45578edf98bba3d23c7cefe60d8a7d3079e7c6676459f7422ace7a2461ab96943fbcadb478633a80f40bc098f2435722850b563714adb78b14922be53cb5753d SHA512 087ff6fe5f6caab4c6c3001d906399e02beffad7277280f11187420c2939fd4befdcb14643862a657ce4cad2f115b82a0a1a2c99df6ee54dcd76b53647637c19
DIST openssh-9.3p1.tar.gz.asc 833 BLAKE2B e6533d64b117a400b76b90f71fa856d352dea57d91e4e89fa375429403ac0734cc0a2f075bc58c6bb4f40a8f9776735aa36bdb0bbf3880a2115cea787633e48b SHA512 6222378eb24a445c6c1db255392b405f5369b1af0e92f558d4ba05b0d83ab0d084cb8f4b91d7ae8636f333d970638a6635e2bc7af885135dd34992d87f2ef1f4
+DIST openssh-9.3p2.tar.gz 1835850 BLAKE2B 38f8d4ada263112b318fafccabf0a33a004d8290a867434004eb3d37127c9bdabe6e0225fca9d6d68fb54338fec81dcc9313ca7c91d3a033311db44174dc9f6f SHA512 15b8c57aa120186f1d1c3c2b8dc6ffd26733e12f755a6b0a4255d9ec1815a61506275ff5723b4ac029e44bc2ad22852ac36e1101f292348fbfa79aa1a4cd3f35
+DIST openssh-9.3p2.tar.gz.asc 833 BLAKE2B cfba3867d7f97cb2c904bd3ae111bd63e8a050464b66e3f3f22390839a153d57ef5819182f8ad99a6b520f27881143552dc64fccfc33dcc0483ffe1ef33a5a47 SHA512 759e512a36a3a62264803b517298a65c83e1daebd9867e28ea1ca4999c38539368815ccda86540a4f5d45fa79c539d8242995ba55f2918baf2a7404c105e337a
diff --git a/net-misc/openssh/openssh-9.3_p2.ebuild b/net-misc/openssh/openssh-9.3_p2.ebuild
new file mode 100644
index 000000000000..f3833c8da7c4
--- /dev/null
+++ b/net-misc/openssh/openssh-9.3_p2.ebuild
@@ -0,0 +1,379 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-9.3_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-9.3_p1-gss-use-HOST_NAME_MAX.patch" #834044
+ "${FILESDIR}/${PN}-9.3_p1-openssl-version-compat-check.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply -- "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ --with-hardening
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-06-25 19:28 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-06-25 19:28 UTC (permalink / raw
To: gentoo-commits
commit: 912850f59174a65693859c4a171ef5e98fbdab6b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jun 25 19:27:59 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jun 25 19:27:59 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=912850f5
net-misc/openssh: fix configure arg
Fixes: 5a80377b5bf000d2efbc5ee3a5732c19c010a7a9
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
index 5a0b9de25987..e3184f35c252 100644
--- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
@@ -185,7 +185,7 @@ src_configure() {
--datadir="${EPREFIX}"/usr/share/openssh
--with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
- --enable-hardening
+ --with-hardening
$(use_with audit audit linux)
$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
$(use_with ldns)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-06-25 19:17 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-06-25 19:17 UTC (permalink / raw
To: gentoo-commits
commit: 5a80377b5bf000d2efbc5ee3a5732c19c010a7a9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jun 25 19:15:08 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jun 25 19:17:05 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5a80377b
net-misc/openssh: drop elibc_Cygwin cruft
Support is already gone.
Closes: https://bugs.gentoo.org/909154
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
index 2ec7c9966dff..5a0b9de25987 100644
--- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
@@ -185,6 +185,7 @@ src_configure() {
--datadir="${EPREFIX}"/usr/share/openssh
--with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
+ --enable-hardening
$(use_with audit audit linux)
$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
$(use_with ldns)
@@ -195,7 +196,6 @@ src_configure() {
$(use_with security-key security-key-builtin)
$(use_with ssl openssl)
$(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
)
if use elibc_musl; then
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-05-11 20:03 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-05-11 20:03 UTC (permalink / raw
To: gentoo-commits
commit: 51642f0e13ab03de8a6c3fc729185f96b1618200
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 24 07:18:52 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu May 11 20:03:44 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=51642f0e
net-misc/openssh: use /etc/ssh/ssh_config.d and /etc/ssh/sshd_config.d for config dropins
Debian patches this into their config already and we found ourselves wanting
it when looking at handling the github.com SSH key change/rotation.
/etc/ssh/ssh_config.d and /etc/ssh/sshd_config.d both become directories
where users can add their own configuration files, but we also install the Gentoo
snippets formerly in ssh_config and sshd_config in there instead.
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1-r1.ebuild | 51 ++++++++++++++++++-------------
1 file changed, 29 insertions(+), 22 deletions(-)
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
index 8e9ccf877d5d..83c262f034f8 100644
--- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
@@ -241,39 +241,46 @@ tweak_ssh_configs() {
LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
)
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
+ dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
+ Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
+ Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
EOF
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/90gentoo.conf || die
+ # Send locale environment variables (bug #367017)
SendEnv ${locale_vars[*]}
- # Send COLORTERM to match TERM. #658540
+ # Send COLORTERM to match TERM (bug #658540)
SendEnv COLORTERM
EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
fi
if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-05-11 20:03 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-05-11 20:03 UTC (permalink / raw
To: gentoo-commits
commit: e72af4c9467e79ca6ae198fbbe6fcf3f90ffad42
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue May 9 21:25:27 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu May 11 20:03:46 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e72af4c9
net-misc/openssh: tweak config file names
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1-r1.ebuild | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
index 95ec07b27720..ea2cc9a83d0c 100644
--- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
@@ -249,7 +249,7 @@ tweak_ssh_configs() {
Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/90gentoo.conf || die
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
# Send locale environment variables (bug #367017)
SendEnv ${locale_vars[*]}
@@ -257,7 +257,7 @@ tweak_ssh_configs() {
SendEnv COLORTERM
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/91gentoo-security.conf || die
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
EOF
@@ -266,7 +266,7 @@ tweak_ssh_configs() {
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo.conf || die
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
# Allow client to pass locale environment variables (bug #367017)
AcceptEnv ${locale_vars[*]}
@@ -275,7 +275,7 @@ tweak_ssh_configs() {
EOF
if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo-pam.conf || die
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
UsePAM yes
# This interferes with PAM.
PasswordAuthentication no
@@ -286,7 +286,7 @@ tweak_ssh_configs() {
fi
if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo-livecd.conf || die
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
# Allow root login with password on livecds.
PermitRootLogin Yes
EOF
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-05-11 20:03 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-05-11 20:03 UTC (permalink / raw
To: gentoo-commits
commit: 5985af22c9feaa90943cd4cdc96bfe4da7ac2de5
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 24 07:22:07 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu May 11 20:03:45 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5985af22
net-misc/openssh: revoke github.com's compromised RSA host key
See https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/.
It's necessary for the old github.com key to be explicitly removed (or revoked)
rather than just selecting a new key, i.e. it's possible for users to be silently
affected but not see the error because github.com may not serve them an RSA key.
Revoke the old github.com key as part of the ebuild to help users out.
Signed-off-by: Sam James <sam <AT> gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/30327
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1-r1.ebuild | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net-misc/openssh/openssh-9.3_p1-r1.ebuild b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
index 83c262f034f8..95ec07b27720 100644
--- a/net-misc/openssh/openssh-9.3_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1-r1.ebuild
@@ -257,6 +257,15 @@ tweak_ssh_configs() {
SendEnv COLORTERM
EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/91gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/90gentoo.conf || die
# Allow client to pass locale environment variables (bug #367017)
AcceptEnv ${locale_vars[*]}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-05-06 21:29 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2023-05-06 21:29 UTC (permalink / raw
To: gentoo-commits
commit: 8c6fab56400b1b06b788c7c72c98490f46cd848b
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Sat May 6 21:27:56 2023 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Sat May 6 21:27:56 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8c6fab56
net-misc/openssh: properly indent metadata.xml
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/metadata.xml | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 9f064cdd11a0..0ed696c82ad6 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -6,18 +6,18 @@
<name>Gentoo Base System</name>
</maintainer>
<longdescription>
-OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools that
-increasing numbers of people on the Internet are coming to rely on. Many users of telnet,
-rlogin, ftp, and other such programs might not realize that their password is transmitted
-across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords)
-to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks.
-Additionally, OpenSSH provides a myriad of secure tunneling capabilities, as well as a variety
-of authentication methods.
+ OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools that
+ increasing numbers of people on the Internet are coming to rely on. Many users of telnet,
+ rlogin, ftp, and other such programs might not realize that their password is transmitted
+ across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords)
+ to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks.
+ Additionally, OpenSSH provides a myriad of secure tunneling capabilities, as well as a variety
+ of authentication methods.
-The OpenSSH suite includes the ssh program which replaces rlogin and telnet, scp which
-replaces rcp, and sftp which replaces ftp. Also included is sshd which is the server side of
-the package, and the other basic utilities like ssh-add, ssh-agent, ssh-keysign, ssh-keyscan,
-ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and 2.0.
+ The OpenSSH suite includes the ssh program which replaces rlogin and telnet, scp which
+ replaces rcp, and sftp which replaces ftp. Also included is sshd which is the server side of
+ the package, and the other basic utilities like ssh-add, ssh-agent, ssh-keysign, ssh-keyscan,
+ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and 2.0.
</longdescription>
<use>
<flag name="hpn">Enable high performance ssh</flag>
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-29 8:48 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-29 8:48 UTC (permalink / raw
To: gentoo-commits
commit: 30b24b8811c963483d996dfe66bdd9aaef8cdfd1
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Fri Apr 28 12:33:01 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Apr 29 08:47:41 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=30b24b88
net-misc/openssh: stable 9.3_p1 for sparc, bug #904920
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 582b590ddec9..c3084f573734 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 22:35 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 22:35 UTC (permalink / raw
To: gentoo-commits
commit: 00d93e6525a0705396444876503843ccedb8c0cb
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 22:35:37 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 22:35:37 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=00d93e65
net-misc/openssh: Stabilize 9.3_p1 hppa, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 8b41b22c2c90..582b590ddec9 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 22:34 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 22:34 UTC (permalink / raw
To: gentoo-commits
commit: d983efdcb9330575179dc51e0e424527f04d54a0
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 22:34:06 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 22:34:06 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d983efdc
net-misc/openssh: Stabilize 9.3_p1 arm, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index bb73cf505ea5..8b41b22c2c90 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 21:12 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2023-04-23 21:12 UTC (permalink / raw
To: gentoo-commits
commit: d6c44724e3085a18ed7c4beb8e08958a93d0d56b
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 21:12:34 2023 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 21:12:34 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d6c44724
net-misc/openssh: Stabilize 9.3_p1 ppc, #904920
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 952ae60b91a6..bb73cf505ea5 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 20:32 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 20:32 UTC (permalink / raw
To: gentoo-commits
commit: 9be94ed089e698dbf3ffaea58b8cbeb7ff2e5863
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 20:32:11 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 20:32:19 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9be94ed0
net-misc/openssh: Stabilize 9.3_p1 ppc64, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 27ded0d86427..952ae60b91a6 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 20:22 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 20:22 UTC (permalink / raw
To: gentoo-commits
commit: 9b0be1a5d3bd5c32471599dfcb500dfcfd2dae1e
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 20:21:28 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 20:21:28 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9b0be1a5
net-misc/openssh: Stabilize 9.3_p1 arm64, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 2e8dd9001be6..e8e34590ed19 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 20:22 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 20:22 UTC (permalink / raw
To: gentoo-commits
commit: 62badc2d1da9d8f79a335f1319ec873ef24399c0
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 20:21:30 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 20:21:30 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=62badc2d
net-misc/openssh: Stabilize 9.3_p1 x86, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index e8e34590ed19..27ded0d86427 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-04-23 20:08 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-04-23 20:08 UTC (permalink / raw
To: gentoo-commits
commit: 6d34894908375f304335dae253e99c9984dd7de1
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 23 20:08:05 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 23 20:08:05 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6d348949
net-misc/openssh: Stabilize 9.3_p1 amd64, #904920
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 52b5df3521e8..2e8dd9001be6 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-03-17 17:10 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-03-17 17:10 UTC (permalink / raw
To: gentoo-commits
commit: aa123a786c2519c8ad2338f66fa2d44a28ad4ce1
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 17 17:09:58 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Mar 17 17:09:58 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aa123a78
net-misc/openssh: keyword 9.3_p1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-9.3_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.3_p1.ebuild b/net-misc/openssh/openssh-9.3_p1.ebuild
index 3173cbc8d705..52b5df3521e8 100644
--- a/net-misc/openssh/openssh-9.3_p1.ebuild
+++ b/net-misc/openssh/openssh-9.3_p1.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-03-15 3:52 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-03-15 3:52 UTC (permalink / raw
To: gentoo-commits
commit: 8ce5549f96cbe56151fd1a5adef102a53a821198
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 15 03:52:14 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Mar 15 03:52:14 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8ce5549f
net-misc/openssh: unkeyword 9.2_p1-r3
I think this version is fine, but on reflection, I'd rather wait a bit
longer until upstream have decided for sure which approach they're going with.
Not really in a rush to keyword openssl-3.1.x anyway.
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r3.ebuild b/net-misc/openssh/openssh-9.2_p1-r3.ebuild
index 0c12a424605e..398c9d6f532f 100644
--- a/net-misc/openssh/openssh-9.2_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r3.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-16 10:01 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-16 10:01 UTC (permalink / raw
To: gentoo-commits
commit: 10b132622f4ccf734bda26c81ade9ca55101c35c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 16 10:00:45 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Feb 16 10:00:45 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=10b13262
net-misc/openssh: Stabilize 9.2_p1-r2 x86, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index 26bdfabb396e..0a724fc1e142 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-16 3:30 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-16 3:30 UTC (permalink / raw
To: gentoo-commits
commit: bd98dd4ba8616113a58abfd176b48171a2e0db8b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 16 03:29:55 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Feb 16 03:29:55 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bd98dd4b
net-misc/openssh: Stabilize 9.2_p1-r2 arm64, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index 20ab9a8cb4b1..26bdfabb396e 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 19:21 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-02-15 19:21 UTC (permalink / raw
To: gentoo-commits
commit: 45bee8ef9bef3f1edc902ef168eeec9b613bf175
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 19:20:35 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 19:20:35 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=45bee8ef
net-misc/openssh: Stabilize 9.2_p1-r2 hppa, #893664
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index 59e2d7d98646..20ab9a8cb4b1 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 9:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-15 9:57 UTC (permalink / raw
To: gentoo-commits
commit: 167a565a9e818aaca2eb00b92cbeda85e89996b7
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 09:56:54 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 09:56:54 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=167a565a
net-misc/openssh: Stabilize 9.2_p1-r2 ppc, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index f827f9ba2cc4..338001e5f63e 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 9:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-15 9:57 UTC (permalink / raw
To: gentoo-commits
commit: d902bac7a94ab37a1be7f7151dd377b740636e2a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 09:56:56 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 09:56:56 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d902bac7
net-misc/openssh: Stabilize 9.2_p1-r2 sparc, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index 338001e5f63e..f12f3c4ca2a8 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 9:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-15 9:57 UTC (permalink / raw
To: gentoo-commits
commit: 67614964b5d9a1610361eccd9b1f6c8c9144f9fc
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 09:56:57 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 09:56:57 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=67614964
net-misc/openssh: Stabilize 9.2_p1-r2 arm, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index f12f3c4ca2a8..59e2d7d98646 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-15 9:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-15 9:57 UTC (permalink / raw
To: gentoo-commits
commit: 6e426c1ad7ee234406787cd7549c5f227713ddfd
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 09:56:53 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 09:56:53 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e426c1a
net-misc/openssh: Stabilize 9.2_p1-r2 ppc64, #893664
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1-r2.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
index cb0dc79e72e9..f827f9ba2cc4 100644
--- a/net-misc/openssh/openssh-9.2_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -50,7 +50,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-05 20:40 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-02-05 20:40 UTC (permalink / raw
To: gentoo-commits
commit: a773d7e0cdb9579343c1a4437ed4ce97f9d91d1f
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 5 20:39:38 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sun Feb 5 20:40:06 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a773d7e0
net-misc/openssh: Revbump to 9.2_p1-r2, restore X509 patch with 14.1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 3 +++
.../{openssh-9.2_p1-r1.ebuild => openssh-9.2_p1-r2.ebuild} | 12 ++++++------
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 11ae3471ce66..d16682cf7844 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -10,7 +10,10 @@ DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e51
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
DIST openssh-9.1p1.tar.gz.asc 833 BLAKE2B 83efe3c705f6a02c25a9fc9bac2a4efd77470598d9e0fcb86dff2d265c58cffec1afecad3621769b2bd78ac25884f0ee20ae9b311e895db93e3bb552dffd6e74 SHA512 47dc7295f9694250bcbb86d7ca0830a47da4f3df7795bb05ebaf1590284ccce5317022c536bea1b09bd2fa4d8013295cc0de287ebe3f9dc605582077e9f11ddd
+DIST openssh-9.2_p1-X509-glue-14.1.patch.xz 900 BLAKE2B 1cfde24cdd636390bcd9b546da182b0848d637c366ff387f045e8d9158e94ff9577c0dff9d87a552208a56aac4ae8319bb17fd772719a7aa2cbc8baf2bfe59fc SHA512 b3f87fb0c339ffe627b347b4cc56fc6a056e5e9a4f23481bb18fc55262e1de3f0394d2f7a85c4fa120f74616a5872cf6628118bcda6973dfa9baec8d7e0e65b1
+DIST openssh-9.2_p1-hpn-15.2-X509-14.1-glue.patch.xz 6040 BLAKE2B d032d1f03ab1bd310af055a452375e6b85ebe40f3d09effdfb07085981155b751c6fdc74a9ee10afe807c2cd10be3444baf712eb0b211bdaff4dc43dc4f65938 SHA512 696f5ee26eeef7a1d56c212eb8bf7c7a568ded2a576eddae92b98b9b3b6bd5bd66e0944b9328e93ec4d55d16f72215a13c25d27de81f75aaae8fdbe68e3df51e
DIST openssh-9.2_p1-hpn-15.2-glue.patch.xz 4172 BLAKE2B 7bec61008f02c07bf24112995066bcd434820354155eb022ffa550baa8f7be896d915423698427ec921473190eb8e83739d2ceff04f79967759fc82b74435dac SHA512 c669a70611479f4ee0f3ba8417afc052f0212cb2d338c524fb3bf6c52a1bf3ca78fe78ab04118de5aa472a10d30b95f084c3ed00a542a8b3d0f541f8ea3f26af
+DIST openssh-9.2p1+x509-14.1.diff.gz 1210737 BLAKE2B 6b1cb2392c3fdbc7627b44a055da7662c686786cddaefcdf63f33fa92c1d97a5fb9ff54d03b7aef700715baa44f4485ad2dd73f59aac5b19617597832e135773 SHA512 88ba0dfd6e7eddf06e47d27299ee900dd1a9dc24df706bde51231b290f666848935204281577a9e47267939e7ee852f7232caaccdae6ac3eb503e53c075e630d
DIST openssh-9.2p1-sctp-1.2.patch.xz 6828 BLAKE2B 8a57b85ce5d18dca34ef71b486f2f24bbc82f6bf263a4f162a1222d96ef2adc469cce62f368c9192512efaa8e1e2496a7bd8f79a11698bf0118eee07a703e6ef SHA512 3713847ef7b280f8b74a1b493644152c948ce74e06c1d0bff52996647963ca156cbc845b4459bcdbd4745eb440e409af07af2f0b696c65950a8a6d7ddb46f6c8
DIST openssh-9.2p1.tar.gz 1852380 BLAKE2B 8d0b5e43cb42cba105a1fe303c447a2b85151cb33ec7ed47747d75c5a61d0f07f0ee4b1020b79c13eb8de4b451c5a844a8afc7ebbbea7ffeceafc3bf59cb8d21 SHA512 c4b79ef3a05b96bfc477ffb31f734635bffd5be213ab58e043111c3232dbe999ff24665fa1069518237cffa5126ded0dda8984e1b8f098f4f09b8c1dae20e604
DIST openssh-9.2p1.tar.gz.asc 833 BLAKE2B 36210757aaa4ee8e6bdf4cfbb5590e6c54a617817d1657ebb446e54530d01a9e9f5559408b3d424d5efdb4ba06f0c02755637f5480dc81f9b4e32963de91087a SHA512 2a56f8946ed00fcd5a92935e090523d40b5c3747e25661d575b799b1825bf5e47a95eed5e7ed968fe042349c2c7d94d6b0e6bf2d9145b5c6ff5df2ca538d56e5
diff --git a/net-misc/openssh/openssh-9.2_p1-r1.ebuild b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-9.2_p1-r1.ebuild
rename to net-misc/openssh/openssh-9.2_p1-r2.ebuild
index 8a348bd91862..f228e1636c82 100644
--- a/net-misc/openssh/openssh-9.2_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1-r2.ebuild
@@ -20,21 +20,22 @@ HPN_PATCHES=(
${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
)
HPN_GLUE_PATCH="${PN}-9.2_p1-hpn-${HPN_VER}-glue.patch"
+HPN_PATCH_DIR="HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}"
SCTP_VER="1.2"
SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="14.0.1"
-#X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_VER="14.1"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
-X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
+X509_HPN_GLUE_PATCH="${PN}-9.2_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="https://www.openssh.com/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
${HPN_VER:+hpn? (
- $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
+ $(printf "mirror://sourceforge/project/hpnssh/Patches/${HPN_PATCH_DIR}/%s\n" "${HPN_PATCHES[@]}")
https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
)}
${X509_PATCH:+X509? (
@@ -123,7 +124,6 @@ PATCHES=(
"${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
"${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
"${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
- #"${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
)
pkg_pretend() {
@@ -164,7 +164,7 @@ src_prepare() {
# don't break .ssh/authorized_keys2 for fun
sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
- eapply "${PATCHES[@]}"
+ eapply -- "${PATCHES[@]}"
[[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-03 6:28 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-02-03 6:28 UTC (permalink / raw
To: gentoo-commits
commit: a2aab4aa4bf07a06214919cd792a7da90a26d9c8
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 3 06:27:26 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Feb 3 06:27:26 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a2aab4aa
net-misc/openssh: drop 9.1_p1, 9.1_p1-r2
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 3 -
net-misc/openssh/openssh-9.1_p1-r2.ebuild | 514 ------------------------------
net-misc/openssh/openssh-9.1_p1.ebuild | 514 ------------------------------
3 files changed, 1031 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 20caae8fc83d..11ae3471ce66 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,14 +1,11 @@
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
-DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
DIST openssh-9.1_p1-getentropy.patch 2818 BLAKE2B 883cd035ec4aee7df9951d7da11bec5a8b9645c7e9225495bb8c86e7e07e89d7c989d32d4db7c46118e20a045e1a07c1bbf98726a69a41351968ce4b04b6779e SHA512 5153a97116e0eed9d7d238478304991737ebb837e7253dd931390bfe287398760ef5134a801825e66d95dd9daf95ed9145a260e23b459b721bc27e628da1a6c0
DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
-DIST openssh-9.1_p1-hpn-15.2-X509-glue.patch.xz 5504 BLAKE2B 776b467ddde16e268536c5632b028a32db22b26d7bc11e2a9fa6c8e29528be3eb781066d6b30fb2f561a73a24c34a29963fcd7c872aa92dc19d715d8ffbf2cbe SHA512 aa753da5f75d90165f5922ead1dd495a15a4c581360d5862ec6f802caea54055da8e308c1919efa8e78b31a7ea082f8693dda0ab84ccee414c562ec062c50fb1
DIST openssh-9.1_p1-hpn-15.2-glue.patch.xz 3840 BLAKE2B 06fb14d8c6f52f1c6fae7971fc4da810c814d7b52063f8cc7e83356baa7ed70c84476c1d1cc896eba6d0d51813dc994e3c82278e66c04998431c8123a09fe7df SHA512 99c88c08fb384336a9680629bc04a89121780d64ee8b03ac164c4e446cc30b865004292e98516b6f857bd75e1b4393291427c046ffcabc1578629e6075636cbf
DIST openssh-9.1_p1-sandbox-writev.patch 819 BLAKE2B c2e4d507540e704b241ab9fb2c63774a2a5031879a746fcb65405f91ff8434ca1877509a5e87484dffc4b9d52da9d7f3b8e177cbbd75d9c632785ba269c3f86a SHA512 ce491ad3ee02a9f455fdd7ab5cbf16d286f439205d557deb4ef3b9d7e092ef5e9b98e682bdc0e65804ee557581133353116d508c60b0ba4a18e2cdcd3aed6bf1
-DIST openssh-9.1p1+x509-13.5.diff.gz 1213948 BLAKE2B 5663a1c865c80f590642bb855f7d7a17e71e0db099deb4cea5750cfe734bd506b70a1b266fccc2a58174ae2b1b96a7f1ced56382d5d7e741b07e46422b03f7e6 SHA512 70a1f12e98b8fa8170c208803ee482aea2fcf6b9e41ecada5fabaa0288ed5a32574f42a7b50718bb484978f3c65f50e55966c9f555a9de100dc8d695b9aec531
DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e516a9454b0c6cb540a64aa47c0b14ac80bd9ad5aa7aa72a00dbc9024aa7c1186b19f2c62f179b8a6463085dd1bdde15fd44e451e5 SHA512 da754497f3f7d173b273f710dab2e7dbc5bf5257c95e661687ff4dd6b5e1c696ac031785850d9a9eb5669f728cbe4fe26d256a7cbd6f137ecadaf38f153770d1
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
diff --git a/net-misc/openssh/openssh-9.1_p1-r2.ebuild b/net-misc/openssh/openssh-9.1_p1-r2.ebuild
deleted file mode 100644
index a934b584c29e..000000000000
--- a/net-misc/openssh/openssh-9.1_p1-r2.ebuild
+++ /dev/null
@@ -1,514 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-
-X509_VER="14.0.1"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
-X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? (
- $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
- https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
- )}
- ${X509_PATCH:+X509? (
- https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
- https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
- ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
- )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-# Blocker on older gcc-config for bug #872416
-LIB_DEPEND="
- !<sys-devel/gcc-config-2.6
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
- "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
- "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
- "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
- "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
-)
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${WORKDIR}/${X509_GLUE_PATCH}"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
- use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
deleted file mode 100644
index fed9e319ecd0..000000000000
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ /dev/null
@@ -1,514 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-
-X509_VER="13.5"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
-X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-glue.patch"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? (
- $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
- https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
- )}
- ${X509_PATCH:+X509? (
- https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
- https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
- ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
- )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-# Blocker on older gcc-config for bug #872416
-LIB_DEPEND="
- !<sys-devel/gcc-config-2.6
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
- "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
- "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
- "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
- "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
-)
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${WORKDIR}/${X509_GLUE_PATCH}"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
- use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-02 19:55 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-02-02 19:55 UTC (permalink / raw
To: gentoo-commits
commit: 92c203bd616f4b0deec30adea87188ad7599e37d
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 2 19:54:46 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Feb 2 19:54:57 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=92c203bd
net-misc/openssh: destabilize 9.2_p1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-9.2_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.2_p1.ebuild b/net-misc/openssh/openssh-9.2_p1.ebuild
index 3f9704119bee..9fa1599bd620 100644
--- a/net-misc/openssh/openssh-9.2_p1.ebuild
+++ b/net-misc/openssh/openssh-9.2_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-02-02 19:52 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-02-02 19:52 UTC (permalink / raw
To: gentoo-commits
commit: 65e4a5b4fd83f9f698b411b037fde5799c8b72c1
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 2 19:51:26 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Feb 2 19:51:34 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65e4a5b4
net-misc/openssh: add 9.2_p1
Bug: https://bugs.gentoo.org/892936
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 4 +
net-misc/openssh/openssh-9.2_p1.ebuild | 514 +++++++++++++++++++++++++++++++++
2 files changed, 518 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 56efbafa3b3b..20caae8fc83d 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -13,3 +13,7 @@ DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e51
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
DIST openssh-9.1p1.tar.gz.asc 833 BLAKE2B 83efe3c705f6a02c25a9fc9bac2a4efd77470598d9e0fcb86dff2d265c58cffec1afecad3621769b2bd78ac25884f0ee20ae9b311e895db93e3bb552dffd6e74 SHA512 47dc7295f9694250bcbb86d7ca0830a47da4f3df7795bb05ebaf1590284ccce5317022c536bea1b09bd2fa4d8013295cc0de287ebe3f9dc605582077e9f11ddd
+DIST openssh-9.2_p1-hpn-15.2-glue.patch.xz 4172 BLAKE2B 7bec61008f02c07bf24112995066bcd434820354155eb022ffa550baa8f7be896d915423698427ec921473190eb8e83739d2ceff04f79967759fc82b74435dac SHA512 c669a70611479f4ee0f3ba8417afc052f0212cb2d338c524fb3bf6c52a1bf3ca78fe78ab04118de5aa472a10d30b95f084c3ed00a542a8b3d0f541f8ea3f26af
+DIST openssh-9.2p1-sctp-1.2.patch.xz 6828 BLAKE2B 8a57b85ce5d18dca34ef71b486f2f24bbc82f6bf263a4f162a1222d96ef2adc469cce62f368c9192512efaa8e1e2496a7bd8f79a11698bf0118eee07a703e6ef SHA512 3713847ef7b280f8b74a1b493644152c948ce74e06c1d0bff52996647963ca156cbc845b4459bcdbd4745eb440e409af07af2f0b696c65950a8a6d7ddb46f6c8
+DIST openssh-9.2p1.tar.gz 1852380 BLAKE2B 8d0b5e43cb42cba105a1fe303c447a2b85151cb33ec7ed47747d75c5a61d0f07f0ee4b1020b79c13eb8de4b451c5a844a8afc7ebbbea7ffeceafc3bf59cb8d21 SHA512 c4b79ef3a05b96bfc477ffb31f734635bffd5be213ab58e043111c3232dbe999ff24665fa1069518237cffa5126ded0dda8984e1b8f098f4f09b8c1dae20e604
+DIST openssh-9.2p1.tar.gz.asc 833 BLAKE2B 36210757aaa4ee8e6bdf4cfbb5590e6c54a617817d1657ebb446e54530d01a9e9f5559408b3d424d5efdb4ba06f0c02755637f5480dc81f9b4e32963de91087a SHA512 2a56f8946ed00fcd5a92935e090523d40b5c3747e25661d575b799b1825bf5e47a95eed5e7ed968fe042349c2c7d94d6b0e6bf2d9145b5c6ff5df2ca538d56e5
diff --git a/net-misc/openssh/openssh-9.2_p1.ebuild b/net-misc/openssh/openssh-9.2_p1.ebuild
new file mode 100644
index 000000000000..3f9704119bee
--- /dev/null
+++ b/net-misc/openssh/openssh-9.2_p1.ebuild
@@ -0,0 +1,514 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+HPN_GLUE_PATCH="${PN}-9.2_p1-hpn-${HPN_VER}-glue.patch"
+
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+
+X509_VER="14.0.1"
+#X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
+X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? (
+ $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
+ )}
+ ${X509_PATCH:+X509? (
+ https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
+ ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
+ )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+# Blocker on older gcc-config for bug #872416
+LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
+ "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
+ "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
+ #"${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
+)
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${WORKDIR}/${X509_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
+ use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-25 19:22 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-01-25 19:22 UTC (permalink / raw
To: gentoo-commits
commit: d64432e8cad74847b04f75b28c95a19415cde7f7
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 25 19:22:06 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Jan 25 19:22:46 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d64432e8
net-misc/openssh: Stabilize 9.1_p1-r3 hppa, #891639
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index fe5cfcbade18..767c9f57b3e4 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-25 19:22 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2023-01-25 19:22 UTC (permalink / raw
To: gentoo-commits
commit: cc7743df407956c152e4bcdfb28f5ddd682331d8
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 25 19:22:03 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Wed Jan 25 19:22:45 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cc7743df
net-misc/openssh: Stabilize 9.1_p1-r3 ppc, #891639
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index a11418a8dea0..fe5cfcbade18 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 17:50 Robin H. Johnson
0 siblings, 0 replies; 441+ messages in thread
From: Robin H. Johnson @ 2023-01-22 17:50 UTC (permalink / raw
To: gentoo-commits
commit: 1b2bcb67e18ff9150bc5c7e758bc2d6d72e75ba9
Author: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 17:49:01 2023 +0000
Commit: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 17:50:32 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b2bcb67
net-misc/openssh: avoid conflict between x509 patch and getentropy fix
Signed-off-by: Robin H. Johnson <robbat2 <AT> gentoo.org>
Closes: https://bugs.gentoo.org/891665
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index dbbb727af2ea..a11418a8dea0 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -126,7 +126,7 @@ PATCHES=(
"${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
"${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
"${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
- "${DISTDIR}"/${PN}-9.1_p1-getentropy.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3487
+ #"${DISTDIR}"/${PN}-9.1_p1-getentropy.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3487 # Conditionally applied below
"${DISTDIR}"/${PN}-9.1_p1-sandbox-writev.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3512
)
@@ -168,6 +168,11 @@ src_prepare() {
# don't break .ssh/authorized_keys2 for fun
sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+ # openssh-9.1_p1: X509 patch includes a different fix for the getentropy bug
+ # will need removal in 9.2, because x509 will have to normalize onto
+ # upstream openssh fix.
+ use X509 || PATCHES+=( "${DISTDIR}/${PN}-9.1_p1-getentropy.patch" )
+
eapply "${PATCHES[@]}"
[[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 2:25 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 2:25 UTC (permalink / raw
To: gentoo-commits
commit: 0fa539efa501c07e82d0187b84e204d1dc26d00d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 02:24:43 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 02:24:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0fa539ef
net-misc/openssh: Stabilize 9.1_p1-r3 arm64, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index fa1647a7b28e..a9df5ee3cf7c 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 2:25 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 2:25 UTC (permalink / raw
To: gentoo-commits
commit: 46e158aece43ddef8eaab5db6eb680849ab50f75
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 02:24:44 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 02:24:44 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=46e158ae
net-misc/openssh: Stabilize 9.1_p1-r3 arm, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index a9df5ee3cf7c..dbbb727af2ea 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 1:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 1:39 UTC (permalink / raw
To: gentoo-commits
commit: f1f5f51742c77e69a84eb381b0d52cdba7328a26
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 01:38:43 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 01:38:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1f5f517
net-misc/openssh: Stabilize 9.1_p1-r3 x86, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index 81d594053ea1..1298bb895844 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 1:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 1:39 UTC (permalink / raw
To: gentoo-commits
commit: aaf486f74fc3556a654bf177ac749ebe6c1a312f
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 01:38:48 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 01:38:48 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aaf486f7
net-misc/openssh: Stabilize 9.1_p1-r3 ppc64, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index 379803bea97d..fa1647a7b28e 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 1:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 1:39 UTC (permalink / raw
To: gentoo-commits
commit: 62cb7d66fd5b47c9e50dcb9e8cc0de541ba93d4b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 01:38:46 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 01:38:46 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=62cb7d66
net-misc/openssh: Stabilize 9.1_p1-r3 amd64, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index 57e96334c551..379803bea97d 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-22 1:39 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2023-01-22 1:39 UTC (permalink / raw
To: gentoo-commits
commit: c4a1dbdca64def88faa7aa0d2c13596c5cf1f913
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 22 01:38:45 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jan 22 01:38:45 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4a1dbdc
net-misc/openssh: Stabilize 9.1_p1-r3 sparc, #891639
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
index 1298bb895844..57e96334c551 100644
--- a/net-misc/openssh/openssh-9.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -51,7 +51,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-21 21:57 Robin H. Johnson
0 siblings, 0 replies; 441+ messages in thread
From: Robin H. Johnson @ 2023-01-21 21:57 UTC (permalink / raw
To: gentoo-commits
commit: 319e9c219f56e3cf54f432d9f9b12b8e9be9dc08
Author: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 21 21:55:16 2023 +0000
Commit: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org>
CommitDate: Sat Jan 21 21:55:16 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=319e9c21
net-misc/openssh: backport getentropy & sandbox writev patches
Required on hosts where glibc has getentropy support but the kernel does
NOT have getentropy support.
Reference: https://bugzilla.mindrot.org/show_bug.cgi?id=3512
Reference: https://bugzilla.mindrot.org/show_bug.cgi?id=3487
Reference: https://bugs.gentoo.org/887405
Signed-off-by: Robin H. Johnson <robbat2 <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-9.1_p1-r3.ebuild | 518 ++++++++++++++++++++++++++++++
2 files changed, 520 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 19c7a125738b..56efbafa3b3b 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -3,9 +3,11 @@ DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
+DIST openssh-9.1_p1-getentropy.patch 2818 BLAKE2B 883cd035ec4aee7df9951d7da11bec5a8b9645c7e9225495bb8c86e7e07e89d7c989d32d4db7c46118e20a045e1a07c1bbf98726a69a41351968ce4b04b6779e SHA512 5153a97116e0eed9d7d238478304991737ebb837e7253dd931390bfe287398760ef5134a801825e66d95dd9daf95ed9145a260e23b459b721bc27e628da1a6c0
DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
DIST openssh-9.1_p1-hpn-15.2-X509-glue.patch.xz 5504 BLAKE2B 776b467ddde16e268536c5632b028a32db22b26d7bc11e2a9fa6c8e29528be3eb781066d6b30fb2f561a73a24c34a29963fcd7c872aa92dc19d715d8ffbf2cbe SHA512 aa753da5f75d90165f5922ead1dd495a15a4c581360d5862ec6f802caea54055da8e308c1919efa8e78b31a7ea082f8693dda0ab84ccee414c562ec062c50fb1
DIST openssh-9.1_p1-hpn-15.2-glue.patch.xz 3840 BLAKE2B 06fb14d8c6f52f1c6fae7971fc4da810c814d7b52063f8cc7e83356baa7ed70c84476c1d1cc896eba6d0d51813dc994e3c82278e66c04998431c8123a09fe7df SHA512 99c88c08fb384336a9680629bc04a89121780d64ee8b03ac164c4e446cc30b865004292e98516b6f857bd75e1b4393291427c046ffcabc1578629e6075636cbf
+DIST openssh-9.1_p1-sandbox-writev.patch 819 BLAKE2B c2e4d507540e704b241ab9fb2c63774a2a5031879a746fcb65405f91ff8434ca1877509a5e87484dffc4b9d52da9d7f3b8e177cbbd75d9c632785ba269c3f86a SHA512 ce491ad3ee02a9f455fdd7ab5cbf16d286f439205d557deb4ef3b9d7e092ef5e9b98e682bdc0e65804ee557581133353116d508c60b0ba4a18e2cdcd3aed6bf1
DIST openssh-9.1p1+x509-13.5.diff.gz 1213948 BLAKE2B 5663a1c865c80f590642bb855f7d7a17e71e0db099deb4cea5750cfe734bd506b70a1b266fccc2a58174ae2b1b96a7f1ced56382d5d7e741b07e46422b03f7e6 SHA512 70a1f12e98b8fa8170c208803ee482aea2fcf6b9e41ecada5fabaa0288ed5a32574f42a7b50718bb484978f3c65f50e55966c9f555a9de100dc8d695b9aec531
DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e516a9454b0c6cb540a64aa47c0b14ac80bd9ad5aa7aa72a00dbc9024aa7c1186b19f2c62f179b8a6463085dd1bdde15fd44e451e5 SHA512 da754497f3f7d173b273f710dab2e7dbc5bf5257c95e661687ff4dd6b5e1c696ac031785850d9a9eb5669f728cbe4fe26d256a7cbd6f137ecadaf38f153770d1
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
diff --git a/net-misc/openssh/openssh-9.1_p1-r3.ebuild b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
new file mode 100644
index 000000000000..81d594053ea1
--- /dev/null
+++ b/net-misc/openssh/openssh-9.1_p1-r3.ebuild
@@ -0,0 +1,518 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
+
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+
+X509_VER="14.0.1"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
+X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? (
+ $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
+ )}
+ ${X509_PATCH:+X509? (
+ https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
+ ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
+ )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+ https://github.com/openssh/openssh-portable/commit/da6038bd5cd55eb212eb2aec1fc8ae79bbf76156.patch -> ${PN}-9.1_p1-getentropy.patch
+ https://github.com/openssh/openssh-portable/commit/6283f4bd83eee714d0f5fc55802eff836b06fea8.patch -> ${PN}-9.1_p1-sandbox-writev.patch
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+# Blocker on older gcc-config for bug #872416
+LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
+ "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
+ "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
+ "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
+ "${DISTDIR}"/${PN}-9.1_p1-getentropy.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3487
+ "${DISTDIR}"/${PN}-9.1_p1-sandbox-writev.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3512
+)
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${WORKDIR}/${X509_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
+ use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2023-01-05 18:44 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2023-01-05 18:44 UTC (permalink / raw
To: gentoo-commits
commit: 7e8476492e2c245fdb00974bc0bdd2b3fd41324b
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 5 18:44:10 2023 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Jan 5 18:44:49 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7e847649
net-misc/openssh: Revbump, update X509 patch to 14.0.3
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/{openssh-9.1_p1-r1.ebuild => openssh-9.1_p1-r2.ebuild} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1-r1.ebuild b/net-misc/openssh/openssh-9.1_p1-r2.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.1_p1-r1.ebuild
rename to net-misc/openssh/openssh-9.1_p1-r2.ebuild
index 2eae29e04ea9..a934b584c29e 100644
--- a/net-misc/openssh/openssh-9.1_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-28 20:49 John Helmert III
0 siblings, 0 replies; 441+ messages in thread
From: John Helmert III @ 2022-12-28 20:49 UTC (permalink / raw
To: gentoo-commits
commit: eadbba1d383201b13a6392480682a029d5cd6632
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 28 20:47:37 2022 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Wed Dec 28 20:47:37 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eadbba1d
net-misc/openssh: drop 9.0_p1-r6
Bug: https://bugs.gentoo.org/733802
Bug: https://bugs.gentoo.org/874876
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-misc/openssh/Manifest | 4 -
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 499 ------------------------------
2 files changed, 503 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 09985386afdf..19c7a125738b 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,10 +1,6 @@
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
-DIST openssh-9.0p1+x509-13.4.1.diff.gz 1146757 BLAKE2B 070d6bc23179a581e4fe79412274f11399009ba69ad643cc354ec9cd6392ffb0a651fd2d7f310c52c60a9c626140b9c823e2f19c600f15ac9cdf992707274bcb SHA512 4aaa86c1a785741b28c5e2738cf6de6fa7965ac8692165a8b18fe7677aeb0996979f23b45306781e6be75d34fb39294659be5ae016ab4a82ef2a73bedcc6e8e7
-DIST openssh-9.0p1-sctp-1.2.patch.xz 6768 BLAKE2B 8a18aea57b0b3f8f0a641870f0cd1570c6cc48d1e28ef7261344918905e94a548d3a3acb6feb1c6ef13f0c6cacf2b845163cad2b96ab20cb9fc58a49aeb699c1 SHA512 d6aa5f32464d5f3e2e63e9ba82108f33bdaa890e2adf2ccc47ce0d672979fc67510d9dd7561b17eaba0c2f11a8eb565029b0ebff3b2d050e9e04e6143aedb8a3
-DIST openssh-9.0p1.tar.gz 1822183 BLAKE2B 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 SHA512 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9
-DIST openssh-9.0p1.tar.gz.asc 833 BLAKE2B e29ff08f10feee7347c02a7ce4b33b8d9c71a26656f0430a2511c25bc6b5006f1683d845826a68ff4eed068b30c911e273cb34e5b4880854d55a776415474019 SHA512 7b1445764058435d2fa8a9c7553643983650d4232036c088e46e44beeb538d32cba88f775b1be9da5f21a01d6caea59b3dc4714507781e9cb946546fa54f169f
DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
deleted file mode 100644
index eb042a3fb063..000000000000
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ /dev/null
@@ -1,499 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.4.1"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-# Blocker on older gcc-config for bug #872416
-LIB_DEPEND="
- !<sys-devel/gcc-config-2.6
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
- eapply "${FILESDIR}"/${PN}-8.9_p1-allow-ppoll_time64.patch #834019
- eapply "${FILESDIR}"/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch #834044
- eapply "${FILESDIR}"/${PN}-9.0_p1-implicit-func-decl-vsnprintf.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-glue.patch
- use X509 && eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-X509-glue.patch
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-28 20:46 John Helmert III
0 siblings, 0 replies; 441+ messages in thread
From: John Helmert III @ 2022-12-28 20:46 UTC (permalink / raw
To: gentoo-commits
commit: ae4de40668abbfd2a9bb19284a0bb0d4d6d6106e
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 28 20:45:17 2022 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Wed Dec 28 20:45:44 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae4de406
Revert "net-misc/openssh: drop 9.0_p1-r6, 9.1_p1"
This reverts commit 08f683984806bb85009e0e7ab23623600c8129e2.
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-misc/openssh/Manifest | 7 +
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 499 +++++++++++++++++++++++++++++
net-misc/openssh/openssh-9.1_p1.ebuild | 514 ++++++++++++++++++++++++++++++
3 files changed, 1020 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 3666c5881a43..09985386afdf 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,9 +1,16 @@
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
+DIST openssh-9.0p1+x509-13.4.1.diff.gz 1146757 BLAKE2B 070d6bc23179a581e4fe79412274f11399009ba69ad643cc354ec9cd6392ffb0a651fd2d7f310c52c60a9c626140b9c823e2f19c600f15ac9cdf992707274bcb SHA512 4aaa86c1a785741b28c5e2738cf6de6fa7965ac8692165a8b18fe7677aeb0996979f23b45306781e6be75d34fb39294659be5ae016ab4a82ef2a73bedcc6e8e7
+DIST openssh-9.0p1-sctp-1.2.patch.xz 6768 BLAKE2B 8a18aea57b0b3f8f0a641870f0cd1570c6cc48d1e28ef7261344918905e94a548d3a3acb6feb1c6ef13f0c6cacf2b845163cad2b96ab20cb9fc58a49aeb699c1 SHA512 d6aa5f32464d5f3e2e63e9ba82108f33bdaa890e2adf2ccc47ce0d672979fc67510d9dd7561b17eaba0c2f11a8eb565029b0ebff3b2d050e9e04e6143aedb8a3
+DIST openssh-9.0p1.tar.gz 1822183 BLAKE2B 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 SHA512 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9
+DIST openssh-9.0p1.tar.gz.asc 833 BLAKE2B e29ff08f10feee7347c02a7ce4b33b8d9c71a26656f0430a2511c25bc6b5006f1683d845826a68ff4eed068b30c911e273cb34e5b4880854d55a776415474019 SHA512 7b1445764058435d2fa8a9c7553643983650d4232036c088e46e44beeb538d32cba88f775b1be9da5f21a01d6caea59b3dc4714507781e9cb946546fa54f169f
+DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
+DIST openssh-9.1_p1-hpn-15.2-X509-glue.patch.xz 5504 BLAKE2B 776b467ddde16e268536c5632b028a32db22b26d7bc11e2a9fa6c8e29528be3eb781066d6b30fb2f561a73a24c34a29963fcd7c872aa92dc19d715d8ffbf2cbe SHA512 aa753da5f75d90165f5922ead1dd495a15a4c581360d5862ec6f802caea54055da8e308c1919efa8e78b31a7ea082f8693dda0ab84ccee414c562ec062c50fb1
DIST openssh-9.1_p1-hpn-15.2-glue.patch.xz 3840 BLAKE2B 06fb14d8c6f52f1c6fae7971fc4da810c814d7b52063f8cc7e83356baa7ed70c84476c1d1cc896eba6d0d51813dc994e3c82278e66c04998431c8123a09fe7df SHA512 99c88c08fb384336a9680629bc04a89121780d64ee8b03ac164c4e446cc30b865004292e98516b6f857bd75e1b4393291427c046ffcabc1578629e6075636cbf
+DIST openssh-9.1p1+x509-13.5.diff.gz 1213948 BLAKE2B 5663a1c865c80f590642bb855f7d7a17e71e0db099deb4cea5750cfe734bd506b70a1b266fccc2a58174ae2b1b96a7f1ced56382d5d7e741b07e46422b03f7e6 SHA512 70a1f12e98b8fa8170c208803ee482aea2fcf6b9e41ecada5fabaa0288ed5a32574f42a7b50718bb484978f3c65f50e55966c9f555a9de100dc8d695b9aec531
DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e516a9454b0c6cb540a64aa47c0b14ac80bd9ad5aa7aa72a00dbc9024aa7c1186b19f2c62f179b8a6463085dd1bdde15fd44e451e5 SHA512 da754497f3f7d173b273f710dab2e7dbc5bf5257c95e661687ff4dd6b5e1c696ac031785850d9a9eb5669f728cbe4fe26d256a7cbd6f137ecadaf38f153770d1
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
new file mode 100644
index 000000000000..eb042a3fb063
--- /dev/null
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -0,0 +1,499 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="13.4.1"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+# Blocker on older gcc-config for bug #872416
+LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
+ eapply "${FILESDIR}"/${PN}-8.9_p1-allow-ppoll_time64.patch #834019
+ eapply "${FILESDIR}"/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch #834044
+ eapply "${FILESDIR}"/${PN}-9.0_p1-implicit-func-decl-vsnprintf.patch
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-glue.patch
+ use X509 && eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
new file mode 100644
index 000000000000..fed9e319ecd0
--- /dev/null
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -0,0 +1,514 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
+
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+
+X509_VER="13.5"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
+X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-glue.patch"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? (
+ $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
+ )}
+ ${X509_PATCH:+X509? (
+ https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
+ ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
+ )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+# Blocker on older gcc-config for bug #872416
+LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
+ "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
+ "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
+ "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
+)
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${WORKDIR}/${X509_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
+ use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-28 20:44 John Helmert III
0 siblings, 0 replies; 441+ messages in thread
From: John Helmert III @ 2022-12-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: 08f683984806bb85009e0e7ab23623600c8129e2
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 28 20:43:45 2022 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Wed Dec 28 20:43:58 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=08f68398
net-misc/openssh: drop 9.0_p1-r6, 9.1_p1
Bug: https://bugs.gentoo.org/874876
Bug: https://bugs.gentoo.org/733802
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-misc/openssh/Manifest | 7 -
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 499 -----------------------------
net-misc/openssh/openssh-9.1_p1.ebuild | 514 ------------------------------
3 files changed, 1020 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 09985386afdf..3666c5881a43 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,16 +1,9 @@
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
-DIST openssh-9.0p1+x509-13.4.1.diff.gz 1146757 BLAKE2B 070d6bc23179a581e4fe79412274f11399009ba69ad643cc354ec9cd6392ffb0a651fd2d7f310c52c60a9c626140b9c823e2f19c600f15ac9cdf992707274bcb SHA512 4aaa86c1a785741b28c5e2738cf6de6fa7965ac8692165a8b18fe7677aeb0996979f23b45306781e6be75d34fb39294659be5ae016ab4a82ef2a73bedcc6e8e7
-DIST openssh-9.0p1-sctp-1.2.patch.xz 6768 BLAKE2B 8a18aea57b0b3f8f0a641870f0cd1570c6cc48d1e28ef7261344918905e94a548d3a3acb6feb1c6ef13f0c6cacf2b845163cad2b96ab20cb9fc58a49aeb699c1 SHA512 d6aa5f32464d5f3e2e63e9ba82108f33bdaa890e2adf2ccc47ce0d672979fc67510d9dd7561b17eaba0c2f11a8eb565029b0ebff3b2d050e9e04e6143aedb8a3
-DIST openssh-9.0p1.tar.gz 1822183 BLAKE2B 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 SHA512 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9
-DIST openssh-9.0p1.tar.gz.asc 833 BLAKE2B e29ff08f10feee7347c02a7ce4b33b8d9c71a26656f0430a2511c25bc6b5006f1683d845826a68ff4eed068b30c911e273cb34e5b4880854d55a776415474019 SHA512 7b1445764058435d2fa8a9c7553643983650d4232036c088e46e44beeb538d32cba88f775b1be9da5f21a01d6caea59b3dc4714507781e9cb946546fa54f169f
-DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
-DIST openssh-9.1_p1-hpn-15.2-X509-glue.patch.xz 5504 BLAKE2B 776b467ddde16e268536c5632b028a32db22b26d7bc11e2a9fa6c8e29528be3eb781066d6b30fb2f561a73a24c34a29963fcd7c872aa92dc19d715d8ffbf2cbe SHA512 aa753da5f75d90165f5922ead1dd495a15a4c581360d5862ec6f802caea54055da8e308c1919efa8e78b31a7ea082f8693dda0ab84ccee414c562ec062c50fb1
DIST openssh-9.1_p1-hpn-15.2-glue.patch.xz 3840 BLAKE2B 06fb14d8c6f52f1c6fae7971fc4da810c814d7b52063f8cc7e83356baa7ed70c84476c1d1cc896eba6d0d51813dc994e3c82278e66c04998431c8123a09fe7df SHA512 99c88c08fb384336a9680629bc04a89121780d64ee8b03ac164c4e446cc30b865004292e98516b6f857bd75e1b4393291427c046ffcabc1578629e6075636cbf
-DIST openssh-9.1p1+x509-13.5.diff.gz 1213948 BLAKE2B 5663a1c865c80f590642bb855f7d7a17e71e0db099deb4cea5750cfe734bd506b70a1b266fccc2a58174ae2b1b96a7f1ced56382d5d7e741b07e46422b03f7e6 SHA512 70a1f12e98b8fa8170c208803ee482aea2fcf6b9e41ecada5fabaa0288ed5a32574f42a7b50718bb484978f3c65f50e55966c9f555a9de100dc8d695b9aec531
DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e516a9454b0c6cb540a64aa47c0b14ac80bd9ad5aa7aa72a00dbc9024aa7c1186b19f2c62f179b8a6463085dd1bdde15fd44e451e5 SHA512 da754497f3f7d173b273f710dab2e7dbc5bf5257c95e661687ff4dd6b5e1c696ac031785850d9a9eb5669f728cbe4fe26d256a7cbd6f137ecadaf38f153770d1
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
deleted file mode 100644
index eb042a3fb063..000000000000
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ /dev/null
@@ -1,499 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.4.1"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-# Blocker on older gcc-config for bug #872416
-LIB_DEPEND="
- !<sys-devel/gcc-config-2.6
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
- eapply "${FILESDIR}"/${PN}-8.9_p1-allow-ppoll_time64.patch #834019
- eapply "${FILESDIR}"/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch #834044
- eapply "${FILESDIR}"/${PN}-9.0_p1-implicit-func-decl-vsnprintf.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-glue.patch
- use X509 && eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-X509-glue.patch
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
deleted file mode 100644
index fed9e319ecd0..000000000000
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ /dev/null
@@ -1,514 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-
-X509_VER="13.5"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
-X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-glue.patch"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? (
- $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
- https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
- )}
- ${X509_PATCH:+X509? (
- https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
- https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
- ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
- )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-# Blocker on older gcc-config for bug #872416
-LIB_DEPEND="
- !<sys-devel/gcc-config-2.6
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
- "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
- "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
- "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
- "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
-)
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${WORKDIR}/${X509_GLUE_PATCH}"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
- use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-20 0:33 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2022-12-20 0:33 UTC (permalink / raw
To: gentoo-commits
commit: fcf8905ce3db9b8b6d1fca4e30cf37c30502208e
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 20 00:32:32 2022 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Tue Dec 20 00:32:32 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fcf8905c
net-misc/openssh: Revbump to 9.1_p1-r1, bump X509 to 14.0.1
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 3 +
net-misc/openssh/openssh-9.1_p1-r1.ebuild | 514 ++++++++++++++++++++++++++++++
2 files changed, 517 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index b806e5091184..76bd25673799 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -10,9 +10,12 @@ DIST openssh-9.0p1-sctp-1.2.patch.xz 6768 BLAKE2B 8a18aea57b0b3f8f0a641870f0cd15
DIST openssh-9.0p1.tar.gz 1822183 BLAKE2B 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 SHA512 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9
DIST openssh-9.0p1.tar.gz.asc 833 BLAKE2B e29ff08f10feee7347c02a7ce4b33b8d9c71a26656f0430a2511c25bc6b5006f1683d845826a68ff4eed068b30c911e273cb34e5b4880854d55a776415474019 SHA512 7b1445764058435d2fa8a9c7553643983650d4232036c088e46e44beeb538d32cba88f775b1be9da5f21a01d6caea59b3dc4714507781e9cb946546fa54f169f
DIST openssh-9.1_p1-X509-glue-13.5.patch.xz 1092 BLAKE2B 19da945547472048d01a6ec26f28cba11afe1a0590a115582d1e21a852b6b66589b091ab4440d57952200522318aeffb7d9404e53f9532ae80e47685c24c4097 SHA512 96de9f59bacfd99aa9ef03362d55d88b3eea0acc57a11fb72e5c612bfb0f5e48455b0a0d0add9a8a5524b9d4701f47db1ff7859f1d3c2a12947b27292961cbd5
+DIST openssh-9.1_p1-X509-glue-14.0.1.patch.xz 1096 BLAKE2B cf5568982c9b2b69ee9f99f3e80459aed7b89f1350362e550ae8db3e5eee4a6d2e07879f962262a05c9745d39f34a3ae83792595c61f0ac287226ee9e0ec2a1b SHA512 18c65c97cc8c436fa8e28c0ad9f0a3874f1fb745d75e0bfb76c180bc148ae14a5f6cc5c2b2fa7261d76a8e1234f28fe869bd7f64ed282bf39c88cc3f20932be5
+DIST openssh-9.1_p1-hpn-15.2-X509-14.0.1-glue.patch.xz 5536 BLAKE2B 4629e62287f2bc36fe1eb830e4c47c5482e36650c1e725978e150e4f2a233d58b5bd1286024bdbef4d05586bb3e5d13c51fbd191dfe7429fdb06a278c564a777 SHA512 03467605b57ab3fb7ef2a9be175cf3708fa92234f3f0abfa74ea371c9ee90f2c01a3311022e282823c7bb67249d65aabf89f1574b917dc798c51847e57b0e33f
DIST openssh-9.1_p1-hpn-15.2-X509-glue.patch.xz 5504 BLAKE2B 776b467ddde16e268536c5632b028a32db22b26d7bc11e2a9fa6c8e29528be3eb781066d6b30fb2f561a73a24c34a29963fcd7c872aa92dc19d715d8ffbf2cbe SHA512 aa753da5f75d90165f5922ead1dd495a15a4c581360d5862ec6f802caea54055da8e308c1919efa8e78b31a7ea082f8693dda0ab84ccee414c562ec062c50fb1
DIST openssh-9.1_p1-hpn-15.2-glue.patch.xz 3840 BLAKE2B 06fb14d8c6f52f1c6fae7971fc4da810c814d7b52063f8cc7e83356baa7ed70c84476c1d1cc896eba6d0d51813dc994e3c82278e66c04998431c8123a09fe7df SHA512 99c88c08fb384336a9680629bc04a89121780d64ee8b03ac164c4e446cc30b865004292e98516b6f857bd75e1b4393291427c046ffcabc1578629e6075636cbf
DIST openssh-9.1p1+x509-13.5.diff.gz 1213948 BLAKE2B 5663a1c865c80f590642bb855f7d7a17e71e0db099deb4cea5750cfe734bd506b70a1b266fccc2a58174ae2b1b96a7f1ced56382d5d7e741b07e46422b03f7e6 SHA512 70a1f12e98b8fa8170c208803ee482aea2fcf6b9e41ecada5fabaa0288ed5a32574f42a7b50718bb484978f3c65f50e55966c9f555a9de100dc8d695b9aec531
+DIST openssh-9.1p1+x509-14.0.1.diff.gz 1236304 BLAKE2B 389e652a7cca4d7322d784e516a9454b0c6cb540a64aa47c0b14ac80bd9ad5aa7aa72a00dbc9024aa7c1186b19f2c62f179b8a6463085dd1bdde15fd44e451e5 SHA512 da754497f3f7d173b273f710dab2e7dbc5bf5257c95e661687ff4dd6b5e1c696ac031785850d9a9eb5669f728cbe4fe26d256a7cbd6f137ecadaf38f153770d1
DIST openssh-9.1p1-sctp-1.2.patch.xz 6772 BLAKE2B 8393c1ca5f0df7e4d490cef5c38d50d45da83a9c3f650e9af15d95825f9e682a6aaf6a0e85fc1704d41d6567aec8f0b34e43b20652e0141008ccdbe91426dfac SHA512 6750394d0fb7b7f93a0e4f94204e53277cc341c5b2427130559e443557dbb95f2e85a71cfe8d40cfa17dd015b0f3880f79a1f868374e60e94e8385c9b45acec5
DIST openssh-9.1p1.tar.gz 1838747 BLAKE2B 287b6b1cc4858b27af88f4a4674670afff1fb5b99461892083393c53ef3747c5a0fcd90cba95d2c27465a919e00f7f42732c93af4f306665ba0393bbb7a534f5 SHA512 a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
DIST openssh-9.1p1.tar.gz.asc 833 BLAKE2B 83efe3c705f6a02c25a9fc9bac2a4efd77470598d9e0fcb86dff2d265c58cffec1afecad3621769b2bd78ac25884f0ee20ae9b311e895db93e3bb552dffd6e74 SHA512 47dc7295f9694250bcbb86d7ca0830a47da4f3df7795bb05ebaf1590284ccce5317022c536bea1b09bd2fa4d8013295cc0de287ebe3f9dc605582077e9f11ddd
diff --git a/net-misc/openssh/openssh-9.1_p1-r1.ebuild b/net-misc/openssh/openssh-9.1_p1-r1.ebuild
new file mode 100644
index 000000000000..2eae29e04ea9
--- /dev/null
+++ b/net-misc/openssh/openssh-9.1_p1-r1.ebuild
@@ -0,0 +1,514 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-glue.patch"
+
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+
+X509_VER="14.0.1"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_GLUE_PATCH="${P}-X509-glue-${X509_VER}.patch"
+X509_HPN_GLUE_PATCH="${PN}-9.1_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? (
+ $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}")
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
+ )}
+ ${X509_PATCH:+X509? (
+ https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
+ ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
+ )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+# Blocker on older gcc-config for bug #872416
+LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+ X? ( x11-apps/xauth )
+"
+# Weird dep construct for newer gcc-config for bug #872416
+BDEPEND="
+ sys-devel/autoconf
+ virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-7.9_p1-include-stdlib.patch"
+ "${FILESDIR}/${PN}-8.7_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
+ "${FILESDIR}/${PN}-6.7_p1-openssl-ignore-status.patch"
+ "${FILESDIR}/${PN}-7.5_p1-disable-conch-interop-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-fix-putty-tests.patch"
+ "${FILESDIR}/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/${PN}-8.9_p1-allow-ppoll_time64.patch" #834019
+ "${FILESDIR}/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch" #834044
+ "${FILESDIR}/${PN}-9.1_p1-build-tests.patch"
+)
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${PATCHES[@]}"
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${WORKDIR}/${X509_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
+ use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-19 18:32 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-12-19 18:32 UTC (permalink / raw
To: gentoo-commits
commit: 82d965f3693f4553f659b5ca4e8e3fd8facad749
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 19 18:31:53 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Dec 19 18:31:53 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=82d965f3
net-misc/openssh: Stabilize 9.1_p1 ppc, #885121
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index ef615ebb81ea..297fa1689e51 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-19 18:32 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-12-19 18:32 UTC (permalink / raw
To: gentoo-commits
commit: cf8b6dc888dd52d7386cadcbd44c32b38af5941f
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 19 18:31:56 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Dec 19 18:31:56 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cf8b6dc8
net-misc/openssh: Stabilize 9.1_p1 sparc, #885121
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index 297fa1689e51..fed9e319ecd0 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-19 18:32 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-12-19 18:32 UTC (permalink / raw
To: gentoo-commits
commit: d0c49a63404792c0acdb8c824d0fda1e9cacfd59
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 19 18:31:50 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Mon Dec 19 18:31:50 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d0c49a63
net-misc/openssh: Stabilize 9.1_p1 hppa, #885121
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index 640a41e00f80..ef615ebb81ea 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-18 5:03 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-12-18 5:03 UTC (permalink / raw
To: gentoo-commits
commit: 26ee507cf07e5c2576c74c50d455e97f80574e74
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 18 05:03:06 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 18 05:03:09 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=26ee507c
net-misc/openssh: Stabilize 9.1_p1 ppc64, #885121
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index a48e7933469a..640a41e00f80 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-18 4:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-12-18 4:57 UTC (permalink / raw
To: gentoo-commits
commit: e51c48f91c0fec9657d21ba27972db066f256423
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 18 04:57:07 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 18 04:57:07 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e51c48f9
net-misc/openssh: Stabilize 9.1_p1 arm64, #885121
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index ffd0ca01fa51..1b6c754cbf70 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-18 4:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-12-18 4:57 UTC (permalink / raw
To: gentoo-commits
commit: d3919efdc4631357417997b4b690ae7a36e76e49
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 18 04:57:06 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 18 04:57:06 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d3919efd
net-misc/openssh: Stabilize 9.1_p1 amd64, #885121
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index db2b3cdfb3a7..ffd0ca01fa51 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-18 4:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-12-18 4:57 UTC (permalink / raw
To: gentoo-commits
commit: a04cc529936be522ffbe59f5425c3e50867ec659
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 18 04:57:08 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 18 04:57:08 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a04cc529
net-misc/openssh: Stabilize 9.1_p1 x86, #885121
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index 1b6c754cbf70..a48e7933469a 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-12-18 4:57 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-12-18 4:57 UTC (permalink / raw
To: gentoo-commits
commit: 2c9b82fc10fa24ed20ed34f56b08d3ec4bff6294
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 18 04:57:05 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 18 04:57:05 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2c9b82fc
net-misc/openssh: Stabilize 9.1_p1 arm, #885121
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.1_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.1_p1.ebuild b/net-misc/openssh/openssh-9.1_p1.ebuild
index 823f2305834f..db2b3cdfb3a7 100644
--- a/net-misc/openssh/openssh-9.1_p1.ebuild
+++ b/net-misc/openssh/openssh-9.1_p1.ebuild
@@ -49,7 +49,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-29 5:45 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-10-29 5:45 UTC (permalink / raw
To: gentoo-commits
commit: dcbb4ced959433a00e4c1c628c6abb450232a619
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 29 05:45:40 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sat Oct 29 05:45:40 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dcbb4ced
net-misc/openssh: Stabilize 9.0_p1-r6 hppa, #878571
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 7251de181f3e..eb042a3fb063 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: 48051825dd14dccb3867bce50dcb8c61b3ae8e0d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:13 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:13 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=48051825
net-misc/openssh: Stabilize 9.0_p1-r6 arm, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index b99872ca703f..080b2aaba67e 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: bac5a2b163ec2ee5dc0d1470d88e4f592847d57b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:16 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:16 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bac5a2b1
net-misc/openssh: Stabilize 9.0_p1-r6 ppc64, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 93d2e3f4be7b..7251de181f3e 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: 2950653b525b62f676adae4b7d3070348c89fe28
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:14 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:14 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2950653b
net-misc/openssh: Stabilize 9.0_p1-r6 amd64, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 080b2aaba67e..93d2e3f4be7b 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: e09823e3d016f5171be5448d09b29f21a0380909
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:08 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:08 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e09823e3
net-misc/openssh: Stabilize 9.0_p1-r6 arm64, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 8d824ef20b07..e1d6fc82a066 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: ae507b9d3a5b82e761f0f5a3da49fc5f3f96f41a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:10 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:10 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae507b9d
net-misc/openssh: Stabilize 9.0_p1-r6 sparc, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index e1d6fc82a066..b99872ca703f 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: 3a845502711b8d3ea20fe11b06ca3b9f3c8cd33c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:06 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:06 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3a845502
net-misc/openssh: Stabilize 9.0_p1-r6 x86, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index a32e95392438..8d824ef20b07 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:44 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:44 UTC (permalink / raw
To: gentoo-commits
commit: d4676cd8809e3dd8599d9150409b9c7ebada61e9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:44:04 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:44:04 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d4676cd8
net-misc/openssh: Stabilize 9.0_p1-r6 ppc, #878571
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index f1fddab0bc79..a32e95392438 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-10-28 20:09 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-10-28 20:09 UTC (permalink / raw
To: gentoo-commits
commit: df4a1e45284cb44f3d6c137a35ea16c87548ea4f
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 28 20:01:30 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Oct 28 20:09:26 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df4a1e45
net-misc/openssh: drop 9.0_p1-r1
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-9.0_p1-r1.ebuild | 485 ------------------------------
2 files changed, 486 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index bf68be53332e..b806e5091184 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -5,7 +5,6 @@ DIST openssh-8.9p1.tar.gz.asc 833 BLAKE2B fd44a5545bd0795ee335e480011dbe3c12011d
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
-DIST openssh-9.0p1+x509-13.3.2.diff.gz 1128591 BLAKE2B fb560e2f1803ceb946a1ba8bd53a1f9fd262896b820c23d4b0015218433d2200f1fd9df5b1889a670261f13936d8153da1ab4beb2a5d52ede78168189c522bf3 SHA512 e643168d7098c44f85a9bac9894a936a3480ec843162197ce56e016dd4f634ef182dcfae1f7e18408f6a18832e0a95d2d249a23fdbc3dc46df76989ca0a0c7fc
DIST openssh-9.0p1+x509-13.4.1.diff.gz 1146757 BLAKE2B 070d6bc23179a581e4fe79412274f11399009ba69ad643cc354ec9cd6392ffb0a651fd2d7f310c52c60a9c626140b9c823e2f19c600f15ac9cdf992707274bcb SHA512 4aaa86c1a785741b28c5e2738cf6de6fa7965ac8692165a8b18fe7677aeb0996979f23b45306781e6be75d34fb39294659be5ae016ab4a82ef2a73bedcc6e8e7
DIST openssh-9.0p1-sctp-1.2.patch.xz 6768 BLAKE2B 8a18aea57b0b3f8f0a641870f0cd1570c6cc48d1e28ef7261344918905e94a548d3a3acb6feb1c6ef13f0c6cacf2b845163cad2b96ab20cb9fc58a49aeb699c1 SHA512 d6aa5f32464d5f3e2e63e9ba82108f33bdaa890e2adf2ccc47ce0d672979fc67510d9dd7561b17eaba0c2f11a8eb565029b0ebff3b2d050e9e04e6143aedb8a3
DIST openssh-9.0p1.tar.gz 1822183 BLAKE2B 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 SHA512 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9
diff --git a/net-misc/openssh/openssh-9.0_p1-r1.ebuild b/net-misc/openssh/openssh-9.0_p1-r1.ebuild
deleted file mode 100644
index 25e69c941bf4..000000000000
--- a/net-misc/openssh/openssh-9.0_p1-r1.ebuild
+++ /dev/null
@@ -1,485 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.5_P1"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2"
-SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.3.2"
-X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- hpn? ( ssl )
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- local missing=()
- check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
- check_feature hpn HPN_VER
- check_feature sctp SCTP_PATCH
- check_feature X509 X509_PATCH
- if [[ ${#missing[@]} -ne 0 ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${missing[*]}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_unpack() {
- default
-
- # We don't have signatures for HPN, X509, so we have to write this ourselves
- use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
- eapply "${FILESDIR}"/${PN}-8.9_p1-allow-ppoll_time64.patch #834019
- eapply "${FILESDIR}"/${PN}-8.9_p1-gss-use-HOST_NAME_MAX.patch #834044
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}/${PN}-9.0_p1-X509-uninitialized-delay.patch"
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-glue.patch
- use X509 && eapply "${FILESDIR}"/${PN}-8.9_p1-hpn-${HPN_VER}-X509-glue.patch
- use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-09-23 23:19 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-09-23 23:19 UTC (permalink / raw
To: gentoo-commits
commit: 5960ca2680746712abace4abc4de5ae04516169e
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 23 23:19:12 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Sep 23 23:19:12 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5960ca26
net-misc/openssh: simplify || ( ... ) dep for gcc-config
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r6.ebuild | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r6.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 84ce8c292cc7..f1fddab0bc79 100644
--- a/net-misc/openssh/openssh-9.0_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -96,11 +96,9 @@ BDEPEND="
virtual/pkgconfig
|| (
>=sys-devel/gcc-config-2.6
- || (
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
)
verify-sig? ( sec-keys/openpgp-keys-openssh )
"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-09-23 23:17 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-09-23 23:17 UTC (permalink / raw
To: gentoo-commits
commit: 3194d18b9e7a583b3dc764bd1fdceada10417859
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 23 23:15:07 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Sep 23 23:17:07 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3194d18b
net-misc/openssh: depend on newer gcc-config or clang-toolchain-symlinks
Made the classic mistake I always moan about! Blockers don't affect
dependency resolution, although they do mean "eventual consistency"
in that it ensures you do upgrade by the end of the run.
Let's be safe given we're talking miscompilation here (i.e. runtime
failure) and depend on newer gcc-config (or newer clang-toolchain-symlinks)
in openssh to make sure the merge order is correct.
Bug: https://bugs.gentoo.org/872416
Bug: https://bugs.gentoo.org/872548
See: cc6a27ec99c1e08ac51c69ff0ab4c2b8a5578e2e
Fixes: 961f11b11a0022c5a4a4a34cc4065d13a48906ba
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../{openssh-9.0_p1-r5.ebuild => openssh-9.0_p1-r6.ebuild} | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r5.ebuild b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-9.0_p1-r5.ebuild
rename to net-misc/openssh/openssh-9.0_p1-r6.ebuild
index 072e3ca8f2df..84ce8c292cc7 100644
--- a/net-misc/openssh/openssh-9.0_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r6.ebuild
@@ -57,7 +57,9 @@ REQUIRED_USE="
# tests currently fail with XMSS
REQUIRED_USE+="test? ( !xmss )"
+# Blocker on older gcc-config for bug #872416
LIB_DEPEND="
+ !<sys-devel/gcc-config-2.6
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
@@ -88,11 +90,18 @@ RDEPEND="${RDEPEND}
!prefix? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
-# Blocker on older gcc-config for bug #872416
+# Weird dep construct for newer gcc-config for bug #872416
BDEPEND="
- !<sys-devel/gcc-config-2.6
sys-devel/autoconf
virtual/pkgconfig
+ || (
+ >=sys-devel/gcc-config-2.6
+ || (
+ >=sys-devel/clang-toolchain-symlinks-14-r1:14
+ >=sys-devel/clang-toolchain-symlinks-15-r1:15
+ >=sys-devel/clang-toolchain-symlinks-16-r1:*
+ )
+ )
verify-sig? ( sec-keys/openpgp-keys-openssh )
"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-09-23 23:02 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-09-23 23:02 UTC (permalink / raw
To: gentoo-commits
commit: 961f11b11a0022c5a4a4a34cc4065d13a48906ba
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 23 23:01:10 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Sep 23 23:01:49 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=961f11b1
net-misc/openssh: block older gcc-config w/o ${CTARGET}-cc
>=sys-devel/gcc-config-2.6 will create ${CTARGET}-cc which avoids
clang-toolchain-symlinks providing it even on systems with GCC.
See cc6a27ec99c1e08ac51c69ff0ab4c2b8a5578e2e for the details but
abuse a blocker given it can lead to runtime problems with say,
OpenSSH.
Bug: https://bugs.gentoo.org/872416
Bug: https://bugs.gentoo.org/872548
See: cc6a27ec99c1e08ac51c69ff0ab4c2b8a5578e2e
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../openssh/{openssh-9.0_p1-r4.ebuild => openssh-9.0_p1-r5.ebuild} | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r4.ebuild b/net-misc/openssh/openssh-9.0_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-9.0_p1-r4.ebuild
rename to net-misc/openssh/openssh-9.0_p1-r5.ebuild
index 4f44fcf80e97..072e3ca8f2df 100644
--- a/net-misc/openssh/openssh-9.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r5.ebuild
@@ -88,9 +88,11 @@ RDEPEND="${RDEPEND}
!prefix? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
+# Blocker on older gcc-config for bug #872416
BDEPEND="
- virtual/pkgconfig
+ !<sys-devel/gcc-config-2.6
sys-devel/autoconf
+ virtual/pkgconfig
verify-sig? ( sec-keys/openpgp-keys-openssh )
"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-09-12 20:29 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-09-12 20:29 UTC (permalink / raw
To: gentoo-commits
commit: 0a8dffa398fcbd459916ca331da9cb713372616a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 12 20:28:33 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Sep 12 20:28:33 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0a8dffa3
net-misc/openssh: work around Clang 15 miscompilation with -fzero-call-used-regs=all
Bug: https://github.com/llvm/llvm-project/issues/57692
Bug: https://bugs.gentoo.org/869839
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../openssh/{openssh-9.0_p1-r3.ebuild => openssh-9.0_p1-r4.ebuild} | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net-misc/openssh/openssh-9.0_p1-r3.ebuild b/net-misc/openssh/openssh-9.0_p1-r4.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-9.0_p1-r3.ebuild
rename to net-misc/openssh/openssh-9.0_p1-r4.ebuild
index fb65bd3d8b54..4f44fcf80e97 100644
--- a/net-misc/openssh/openssh-9.0_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r4.ebuild
@@ -326,6 +326,10 @@ src_configure() {
myconf+=( --disable-utmp --disable-wtmp )
fi
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
econf "${myconf[@]}"
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-08-26 10:08 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-08-26 10:08 UTC (permalink / raw
To: gentoo-commits
commit: 06d808f296628dcc7201d75c50ffedc568a55451
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 26 10:07:16 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Aug 26 10:08:22 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06d808f2
net-misc/openssh: Stabilize 9.0_p1-r2 x86, #866434
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r2.ebuild b/net-misc/openssh/openssh-9.0_p1-r2.ebuild
index 7f9101132fa1..75e9c1d0ecc3 100644
--- a/net-misc/openssh/openssh-9.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r2.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-08-25 16:44 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-08-25 16:44 UTC (permalink / raw
To: gentoo-commits
commit: 5788b8e3a36566f1589986c942d21cf669fffb8f
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 25 16:43:48 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Thu Aug 25 16:43:48 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5788b8e3
net-misc/openssh: Stabilize 9.0_p1-r2 ppc, #866434
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-9.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-9.0_p1-r2.ebuild b/net-misc/openssh/openssh-9.0_p1-r2.ebuild
index e782cf932aa7..7f9101132fa1 100644
--- a/net-misc/openssh/openssh-9.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r2.ebuild
@@ -38,7 +38,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-20 18:09 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-05-20 18:09 UTC (permalink / raw
To: gentoo-commits
commit: de045c154a9b7b9fc56549b12e6fa49a49336a3f
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri May 20 18:05:37 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri May 20 18:05:37 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de045c15
net-misc/openssh: format variable assignments
The previous syntax, of assigning multiple times in same line might
be legal for bash, but it was very confusing and breaking for the
pkgcheck bash parser.
Switch to a style that enables pkgcheck to parse correctly the
ebuild.
Acked-by: Mike Gilbert <floppym <AT> gentoo.org>
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 6 ++++--
net-misc/openssh/openssh-9.0_p1-r1.ebuild | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 7cc0b4d2528a..52bb14990c58 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -20,8 +20,10 @@ HPN_PATCHES=(
${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
)
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.3.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="13.3.1"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="https://www.openssh.com/"
diff --git a/net-misc/openssh/openssh-9.0_p1-r1.ebuild b/net-misc/openssh/openssh-9.0_p1-r1.ebuild
index 9fc26e8968bf..25e69c941bf4 100644
--- a/net-misc/openssh/openssh-9.0_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1-r1.ebuild
@@ -20,8 +20,10 @@ HPN_PATCHES=(
${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
)
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.3.2" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+SCTP_VER="1.2"
+SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="13.3.2"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="https://www.openssh.com/"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-10 17:26 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2022-05-10 17:26 UTC (permalink / raw
To: gentoo-commits
commit: 2d93fd3ddb707cc07c8a1545616c055ed59c9ddb
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Tue May 10 17:25:35 2022 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Tue May 10 17:26:26 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2d93fd3d
net-misc/openssh: use seccomp sandbox on x32
Closes: https://bugs.gentoo.org/842624
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 3 ---
net-misc/openssh/openssh-9.0_p1.ebuild | 3 ---
2 files changed, 6 deletions(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 80ddf5b632ba..7cc0b4d2528a 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -323,9 +323,6 @@ src_configure() {
myconf+=( --disable-utmp --disable-wtmp )
fi
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
econf "${myconf[@]}"
}
diff --git a/net-misc/openssh/openssh-9.0_p1.ebuild b/net-misc/openssh/openssh-9.0_p1.ebuild
index 1b77b70031c9..13c0bb4fa5c5 100644
--- a/net-misc/openssh/openssh-9.0_p1.ebuild
+++ b/net-misc/openssh/openssh-9.0_p1.ebuild
@@ -322,9 +322,6 @@ src_configure() {
myconf+=( --disable-utmp --disable-wtmp )
fi
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
econf "${myconf[@]}"
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-06 8:07 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2022-05-06 8:07 UTC (permalink / raw
To: gentoo-commits
commit: 3369e2d3b0d48b5c1d579006206b874331362ea4
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Fri May 6 08:07:20 2022 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Fri May 6 08:07:20 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3369e2d3
net-misc/openssh: Stabilize 8.9_p1-r2 ppc, #841572
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index ed4062d651b6..80ddf5b632ba 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-05 7:07 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2022-05-05 7:07 UTC (permalink / raw
To: gentoo-commits
commit: 6686f7237c815628f5876b4c44a92e6959504b11
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Thu May 5 07:06:02 2022 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Thu May 5 07:06:43 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6686f723
net-misc/openssh: Stabilize 8.9_p1-r2 arm64, #841572
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index a5b1fcae7bc4..ed4062d651b6 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-03 18:48 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-05-03 18:48 UTC (permalink / raw
To: gentoo-commits
commit: d9c1d15f383f462991abc6ec2e1b1bae22d168d1
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue May 3 18:47:41 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue May 3 18:47:41 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d9c1d15f
net-misc/openssh: Stabilize 8.9_p1-r2 ppc64, #841572
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index c3e20babdec1..a5b1fcae7bc4 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-03 18:48 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-05-03 18:48 UTC (permalink / raw
To: gentoo-commits
commit: 8e9005103f02501e8c38798edcc8f39ca748b3d2
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue May 3 18:47:41 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue May 3 18:47:41 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e900510
net-misc/openssh: Stabilize 8.9_p1-r2 arm, #841572
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 6dda1ceb9ad9..c3e20babdec1 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-03 17:52 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2022-05-03 17:52 UTC (permalink / raw
To: gentoo-commits
commit: b9833e247a5c9e0fc483bf3efbfb77bcc53f6351
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue May 3 17:52:24 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue May 3 17:52:24 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b9833e24
net-misc/openssh: Stabilize 8.9_p1-r2 sparc, #841572
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index c81376e3848c..6dda1ceb9ad9 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-05-01 12:20 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2022-05-01 12:20 UTC (permalink / raw
To: gentoo-commits
commit: 33da931a7f69be1223289845956c08289d2e4616
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Sun May 1 12:19:12 2022 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Sun May 1 12:19:12 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33da931a
net-misc/openssh: Stabilize 8.9_p1-r2 x86, #841572
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 7ffe28719298..c81376e3848c 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-04-29 21:24 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-04-29 21:24 UTC (permalink / raw
To: gentoo-commits
commit: daefa9db8a67d0680fb555596990e4e975379fb9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 29 21:23:50 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Apr 29 21:23:50 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=daefa9db
net-misc/openssh: Stabilize 8.9_p1-r2 hppa, #841572
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 64d88e4197f6..425d89cdd1bc 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -36,7 +36,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-04-02 3:30 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-04-02 3:30 UTC (permalink / raw
To: gentoo-commits
commit: 7c4b3cc7397f5d1df9d820c9f899dc04cc0d01e3
Author: Martin Matous <m <AT> matous <DOT> dev>
AuthorDate: Fri Apr 1 22:28:48 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Apr 2 03:30:02 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7c4b3cc7
net-misc/openssh: fix build with ldns
Closes: https://bugs.gentoo.org/744166
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Martin Matouš <m <AT> matous.dev>
Closes: https://github.com/gentoo/gentoo/pull/24857
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 346f1afe7e1f..561dc2dd6076 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -303,7 +303,7 @@ src_configure() {
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
+ $(use_with ldns)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index d56d99980ece..64d88e4197f6 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -306,7 +306,7 @@ src_configure() {
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
+ $(use_with ldns)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-03-17 1:09 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-03-17 1:09 UTC (permalink / raw
To: gentoo-commits
commit: f2f6db6b580924c93b370f49ad5cb9529b9058e9
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 17 01:09:12 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Mar 17 01:09:12 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f2f6db6b
net-misc/openssh: conditionally verify signatures(!)
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 4a714fc75f28..346f1afe7e1f 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -119,7 +119,7 @@ src_unpack() {
default
# We don't have signatures for HPN, X509, so we have to write this ourselves
- verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
}
src_prepare() {
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index c0d96a21bb5f..d56d99980ece 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -119,7 +119,7 @@ src_unpack() {
default
# We don't have signatures for HPN, X509, so we have to write this ourselves
- verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
}
src_prepare() {
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-03-16 22:25 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-03-16 22:25 UTC (permalink / raw
To: gentoo-commits
commit: 018da4b1ce3f8de20b915511017bfc406365678b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 16 22:25:21 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Mar 16 22:25:36 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=018da4b1
net-misc/openssh: fix USE=verify-sig for USE=hpn/USE=X509
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 7 +++++++
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index ecd07a1a1bf4..4a714fc75f28 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -115,6 +115,13 @@ pkg_pretend() {
fi
}
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
src_prepare() {
sed -i \
-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index 57ea25252cb7..c0d96a21bb5f 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -115,6 +115,13 @@ pkg_pretend() {
fi
}
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
src_prepare() {
sed -i \
-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-03-16 19:07 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2022-03-16 19:07 UTC (permalink / raw
To: gentoo-commits
commit: 0aa56e8a5bd648ea30137922b0d4a467060fd800
Author: Jonathan Davies <jpds <AT> protonmail <DOT> com>
AuthorDate: Wed Mar 16 18:22:22 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Mar 16 19:05:04 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0aa56e8a
net-misc/openssh: Added verify-sig integration.
Signed-off-by: Jonathan Davies <jpds <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/24609
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/Manifest | 2 ++
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 5 ++++-
net-misc/openssh/openssh-8.9_p1-r2.ebuild | 5 ++++-
3 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 90b2cf0c98f7..dc2617579f57 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,9 +1,11 @@
DIST openssh-8.8p1+x509-13.2.3.diff.gz 1071138 BLAKE2B dfbe53ccfdfe0a3da9bac927c5bb0ccfeb20f1ba69cef2ffb52999e6f6b0a3282e28a888aab40096fe9eed819f4c9b27592a8771d786580b8fa4f507f6b02557 SHA512 e55e9cdcde1b02b2799600083db8c3b85d207b251b99b4efabe8614bedf1daae28e5ed10cbe1f6a2e5ba766fe1eaf41be9e90fefdaae1352808c504fc0f4e7e6
DIST openssh-8.8p1-sctp-1.2.patch.xz 6744 BLAKE2B 9f99e0abfbfbda2cc1c7c2a465d044c900da862e5a38f01260f388ac089b2e66c5ea7664d71d18b924552ae177e5893cdcbfbccc20eeb3aaeae00b3d552379e3 SHA512 5290c5ef08a418dcc9260812d8e75ce266e22e2258514f11da6fb178e0ae2ef16046523f72a50f74ae7b98e7eb52d16143befc8ce2919041382d314aa05adda0
DIST openssh-8.8p1.tar.gz 1815060 BLAKE2B 3a054ce19781aceca5ab1a0839d7435d88aff4481e8c74b91ffd2046dc8b6f03d6bf584ecda066c0496acf43cea9ab4085f26a29e34e20736e752f204b8c76c3 SHA512 d44cd04445f9c8963513b0d5a7e8348985114ff2471e119a6e344498719ef40f09c61c354888a3be9dabcb5870e5cbe5d3aafbb861dfa1d82a4952f3d233a8df
+DIST openssh-8.8p1.tar.gz.asc 833 BLAKE2B ffe78af226b9c8395e60ca54bcb626cc933ee069f9f0f17f408ca1493cb346aa3fb878efeaccc646f8fa7bf1c40d6d61a81e37342ccf56ae601403bf9d59f4d6 SHA512 165e025305902f884d04d4444fa3143e4ea1a25a1c65aafe05e113537b3d3e50f7cd5f818bc2ca3404699372ca78f69c46b7452faf2d3998c448a5b80a411ae4
DIST openssh-8.9p1+x509-13.3.1.diff.gz 1113333 BLAKE2B 01fc34ed5c5c64a97db99f8f5a98f5917519474b4c22a2372f76a9c36d5dfc4efe1d03fcc43ed3d1602177f7e674a58676b9d04444d7bb66bc1c096136fd2ed0 SHA512 4fea3cf0dd0f6e0b9e28c16fb88f2a125c3ec7f86111d33e040664ab4976e697b137ffe80d02c979e2eb55a5c004f597299cfec22e730b80279665de61cb1f13
DIST openssh-8.9p1-sctp-1.2.patch.xz 6752 BLAKE2B 8f87a4e604ce412f45432ae29b6ccb5a10f6bd6ddc3c688b85d75c2126387dc5d4ed2b2396691db016cc0dee3e71a557611bcf34066dee075d62c9e69e887f14 SHA512 88a36e2d87bb8b6136885094729d001953e15799e06885ff1c489300458b6e412520f7a78c48dfd24df46e58f2561051212d7948f8af63082edcb85c33b4d32b
DIST openssh-8.9p1.tar.gz 1820282 BLAKE2B 02934da7f7a2954141888e63e81e38fad4fb8558ddd1032de44f69684802c62771fdd7e9e470e0715059635999c8f9d2ab95f6351217e236573ead83a867f59b SHA512 04bd38ea6fe4be31acc8c4e83de7d3dda66fb7207be2e4ba25d3b8118d13d098a283769da9e8ce1fc4fba7edf739c14efcc6c9137132919261a7f882314b0f6b
+DIST openssh-8.9p1.tar.gz.asc 833 BLAKE2B fd44a5545bd0795ee335e480011dbe3c12011dc05b8722fb257bf4c7e8067ab4b515293cf73d23d57b6cf6980eb4e49251b026af9498a237365c5b0440226898 SHA512 fd0bbd285ff2f8791f5a512f087f32bce026b716d5ac213cd4ef28f08722601fb943514bee71b2ac4b9f9363e2f120ce6c60fed952d1d8e53dbcf2a6fe2e706b
DIST openssh-8_5_P1-hpn-AES-CTR-15.2.diff 30096 BLAKE2B f0c020dd2403806c79d4c37a019996d275655b04997301e247f5c4dd7fad35d12b3b7c25afb1b078d915ef2a4ae02f736f0aec9ba2a8c56a405d7ca303bcadf7 SHA512 4c2dbf99a9b5953fdb955f700272bbaeaa025f108a8860d2190197962b849f8385327af82c4d6a3a130a7fba35a74a8ec9437d642867601acb29817c49632a8f
DIST openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff 51428 BLAKE2B 370b88a7da7f148bf5a4d445f05cf593b486e9df53bba027e2e179726f534b68cf9d94edd6e53024e0b6ff5f20e568727bc9d26c94d0d415603602a80d3ad241 SHA512 2d8d887901164b33b2799ff3ec72e86a39ae4a1696e52bcee0872dbae7772fcc534351e6e7f87126ee71b164c74e9091350f14b782f4b242a09f09b4f50d047a
DIST openssh-8_5_P1-hpn-PeakTput-15.2.diff 2429 BLAKE2B 849bf3c313719ab7a25c75e82d5dc5ac98365a038b2a66fe58d01eae5b20c7777258b94b5830e799d6909e75c69753cda05a910f3bdab9606fb7d5efa68e05f1 SHA512 c4a56fab55fabd1d902d45f235b603708d43f969920e45c9a57e557dccfa9cade2ec61f26d1ace938f6f73e79f17b12f119b5aea9166cbda8e3435b910500914
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index fb0a37a3290a..ecd07a1a1bf4 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
# Make it more portable between straight releases
# and _p? releases.
@@ -29,7 +29,9 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
@@ -87,6 +89,7 @@ RDEPEND="${RDEPEND}
BDEPEND="
virtual/pkgconfig
sys-devel/autoconf
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
"
pkg_pretend() {
diff --git a/net-misc/openssh/openssh-8.9_p1-r2.ebuild b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
index a6888564f58a..57ea25252cb7 100644
--- a/net-misc/openssh/openssh-8.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.9_p1-r2.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
# Make it more portable between straight releases
# and _p? releases.
@@ -29,7 +29,9 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/openssh.org.asc
S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
@@ -87,6 +89,7 @@ RDEPEND="${RDEPEND}
BDEPEND="
virtual/pkgconfig
sys-devel/autoconf
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
"
pkg_pretend() {
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-01-06 9:07 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2022-01-06 9:07 UTC (permalink / raw
To: gentoo-commits
commit: f5e1d43247becc14a22c323a2402e5df7665121f
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 6 09:07:06 2022 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Thu Jan 6 09:07:06 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f5e1d432
net-misc/openssh: remove userland_GNU
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r4.ebuild b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
index 416fab9e867d..d38be351907d 100644
--- a/net-misc/openssh/openssh-8.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
@@ -81,7 +81,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
+ !prefix? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
BDEPEND="
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 1ae1a14f69d5..fb0a37a3290a 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -81,7 +81,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
+ !prefix? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
BDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2022-01-04 10:30 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2022-01-04 10:30 UTC (permalink / raw
To: gentoo-commits
commit: 2b450be9ad06f7c61e460548b80549e0bcffe053
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 4 10:29:49 2022 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Tue Jan 4 10:29:49 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2b450be9
net-misc/openssh: remove implicit kernel_linux
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r4.ebuild | 4 ++--
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r4.ebuild b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
index 0d7b0c47c069..416fab9e867d 100644
--- a/net-misc/openssh/openssh-8.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 207de04962a7..1ae1a14f69d5 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-25 21:14 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-12-25 21:14 UTC (permalink / raw
To: gentoo-commits
commit: 28e445eecf0c247302cfe60f557a12ecd244107e
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Sat Dec 25 20:50:36 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Dec 25 21:14:25 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=28e445ee
net-misc/openssh: stable 8.8_p1-r4 for hppa, bug #829386
Package-Manager: Portage-3.0.28, Repoman-3.0.3
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index cc2c72f2fd25..207de04962a7 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-25 10:21 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-12-25 10:21 UTC (permalink / raw
To: gentoo-commits
commit: 5497cf6a03cc05774145227fe3adc6deb0cf7bef
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Sat Dec 25 09:48:36 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Dec 25 10:21:00 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5497cf6a
net-misc/openssh: stable 8.8_p1-r4 for sparc, bug #829386
Package-Manager: Portage-3.0.28, Repoman-3.0.3
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 3e47a53e6dd1..cc2c72f2fd25 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-25 9:51 Jakov Smolić
0 siblings, 0 replies; 441+ messages in thread
From: Jakov Smolić @ 2021-12-25 9:51 UTC (permalink / raw
To: gentoo-commits
commit: b33c9627408f622581dd308ba0e1adc5446f9626
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 25 09:50:58 2021 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Sat Dec 25 09:50:58 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b33c9627
net-misc/openssh: Stabilize 8.8_p1-r4 x86, #829386
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 6f1416d69f0f..3e47a53e6dd1 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-25 8:24 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2021-12-25 8:24 UTC (permalink / raw
To: gentoo-commits
commit: efc450bd6c273a72102ad96887b8c4ca7cbe89df
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 25 08:23:21 2021 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sat Dec 25 08:23:21 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=efc450bd
net-misc/openssh: amd64 stable wrt bug #829386
Package-Manager: Portage-3.0.28, Repoman-3.0.3
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 0318642061e4..6f1416d69f0f 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 20:01 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2021-12-24 20:01 UTC (permalink / raw
To: gentoo-commits
commit: 582dc14f2825c5508b8bba5cd7750b09395e86d7
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 20:01:08 2021 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 20:01:08 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=582dc14f
net-misc/openssh: Stabilize 8.8_p1-r4 ppc64, #829386
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index be1aa1b7b6ab..0318642061e4 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 20:01 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2021-12-24 20:01 UTC (permalink / raw
To: gentoo-commits
commit: fa00c192fb705c18f9bd9e8c2d234a9bd2cd5b2e
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 20:01:05 2021 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 20:01:05 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fa00c192
net-misc/openssh: Stabilize 8.8_p1-r4 ppc, #829386
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 738766f60231..be1aa1b7b6ab 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 17:32 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2021-12-24 17:32 UTC (permalink / raw
To: gentoo-commits
commit: 74f095b4da46d896961f219265f62c1dafdf4591
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 17:31:47 2021 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 17:32:04 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=74f095b4
net-misc/openssh: simplify src_test
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 29 +++++++----------------------
1 file changed, 7 insertions(+), 22 deletions(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 229620f1605f..738766f60231 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -318,34 +318,19 @@ src_configure() {
}
src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
+ local tests=( compat-tests )
local shell=$(egetshell "${UID}")
if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
else
tests+=( tests )
fi
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
- SUDO="" SSH_SK_PROVIDER="" \
- TEST_SSH_UNSAFE_PERMISSIONS=1 \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
}
# Gentoo tweaks to default config files.
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 16:16 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2021-12-24 16:16 UTC (permalink / raw
To: gentoo-commits
commit: 257f5efa474c0a43c923116df7772eeccb967634
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 16:16:01 2021 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 16:16:01 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=257f5efa
net-misc/openssh: Stabilize 8.8_p1-r4 arm64, #829386
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index a3fd0d511275..229620f1605f 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 16:15 Arthur Zamarin
0 siblings, 0 replies; 441+ messages in thread
From: Arthur Zamarin @ 2021-12-24 16:15 UTC (permalink / raw
To: gentoo-commits
commit: ae4fe5a2415279d45555213fbdda64fd9729d1f2
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 16:15:20 2021 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 16:15:20 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae4fe5a2
net-misc/openssh: Stabilize 8.8_p1-r4 arm, #829386
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 0160b1ecb4ac..a3fd0d511275 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 16:09 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2021-12-24 16:09 UTC (permalink / raw
To: gentoo-commits
commit: 8007a8a22364aeaefc7c4219c4b06efe347f05a1
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 24 16:08:33 2021 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 16:08:33 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8007a8a2
net-misc/openssh: rework pkg_pretend code
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1-r4.ebuild | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/net-misc/openssh/openssh-8.8_p1-r4.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 38b10330277e..0160b1ecb4ac 100644
--- a/net-misc/openssh/openssh-8.8_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -92,16 +92,14 @@ BDEPEND="
pkg_pretend() {
# this sucks, but i'd rather have people unable to `emerge -u openssh`
# than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature sctp SCTP_PATCH
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
+ eerror "that you requested: ${missing[*]}"
eerror "Please mask ${PF} for now and check back later:"
eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
die "Missing requested third party patch."
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-24 10:57 Marc Schiffbauer
0 siblings, 0 replies; 441+ messages in thread
From: Marc Schiffbauer @ 2021-12-24 10:57 UTC (permalink / raw
To: gentoo-commits
commit: dde4f2128731e569c9a71573795946f4d83f5b12
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 22 21:57:58 2021 +0000
Commit: Marc Schiffbauer <mschiff <AT> gentoo <DOT> org>
CommitDate: Fri Dec 24 10:39:00 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dde4f212
net-misc/openssh: update ldns dep
The ecdsa USE flag is being removed.
Bug: https://bugs.gentoo.org/829687
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
Signed-off-by: Marc Schiffbauer <mschiff <AT> gentoo.org>
net-misc/openssh/{openssh-8.7_p1-r3.ebuild => openssh-8.7_p1-r4.ebuild} | 2 +-
net-misc/openssh/{openssh-8.8_p1-r3.ebuild => openssh-8.8_p1-r4.ebuild} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r3.ebuild b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.7_p1-r3.ebuild
rename to net-misc/openssh/openssh-8.7_p1-r4.ebuild
index 488f832c164c..0d7b0c47c069 100644
--- a/net-misc/openssh/openssh-8.7_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r4.ebuild
@@ -57,7 +57,7 @@ LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa,ssl(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
diff --git a/net-misc/openssh/openssh-8.8_p1-r3.ebuild b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.8_p1-r3.ebuild
rename to net-misc/openssh/openssh-8.8_p1-r4.ebuild
index 1c1068878712..38b10330277e 100644
--- a/net-misc/openssh/openssh-8.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r4.ebuild
@@ -57,7 +57,7 @@ LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa,ssl(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-19 1:10 John Helmert III
0 siblings, 0 replies; 441+ messages in thread
From: John Helmert III @ 2021-12-19 1:10 UTC (permalink / raw
To: gentoo-commits
commit: 307230a6d1ac9ebf6a354de7f4ed60a4879e2fdc
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 18 05:11:36 2021 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Sun Dec 19 01:10:04 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=307230a6
net-misc/openssh: drop 8.5_p1-r2
Bug: https://bugs.gentoo.org/784896
Acked-By: Sam James <sam <AT> gentoo.org>
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-misc/openssh/Manifest | 3 -
net-misc/openssh/openssh-8.5_p1-r2.ebuild | 510 ------------------------------
2 files changed, 513 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index e3a9ef1d4eb6..91d4f77fa8f4 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,6 +1,3 @@
-DIST openssh-8.5p1+x509-13.0.1.diff.gz 997005 BLAKE2B b6cdc9ba12dc642c7073463fb8b153a32019e8bc4c1778c2371d89cdc8d9b43e86523d0c03ebeeafa7004a16ad46dfbc18b338bf95f46101d8865709d45aa6b0 SHA512 b0247885d3a0718eb4df123c552f9e95ad9ffd55f96189aca35006c23d76ec76b28420cac4d7b2167c07f2e0a0652edfa20c2ce60aea3f7607a1e747f836ff91
-DIST openssh-8.5p1-sctp-1.2.patch.xz 7692 BLAKE2B 298bf5e2004fd864bdbb6d6f354d1fbcb7052a9caaf8e39863b840a7af8e31f87790f6aa10ae84df177d450bb34a43c4a3aa87d7472e2505d727757c016ce92b SHA512 84990f95e22c90dbc4d04d47ea88b761ff1d0101018661ff2376ac2a726b5fca43f1b5f5d926ccbe1c8d0143ac36b104616bd1a6b5dcdba4addf48a5dd196e2b
-DIST openssh-8.5p1.tar.gz 1779733 BLAKE2B f4e4bd39e2dd275d4811e06ca994f2239ad27c804b003c74cc26f9dffae28f1b4006fc618580f0dc9c45f0b7361c24728c23688b45f41cb8a15cf6206c3f15c3 SHA512 af9c34d89170a30fc92a63973e32c766ed4a6d254bb210e317c000d46913e78d0c60c7befe62d993d659be000b828b9d4d3832fc40df1c3d33850aaa6293846f
DIST openssh-8.6p1+x509-13.1.diff.gz 1011666 BLAKE2B 0ac0cf2ff962b8ef677c49de0bb586f375f14d8964e077c10f6a88ec15734807940ab6c0277e44ebdfde0e50c2c80103cff614a6cde4d66e9986152032eeaa90 SHA512 ae4986dd079678c7b0cfd805136ff7ac940d1049fdddeb5a7c4ea2141bfcca70463b951485fb2b113bc930f519b1b41562900ced0269f5673dbdad867f464251
DIST openssh-8.6p1-sctp-1.2.patch.xz 7696 BLAKE2B 37f9e943a1881af05d9cf2234433711dc45ca30c60af4c0ea38a1d361df02abb491fa114f3698285f582b40b838414c1a048c4f09aa4f7ae9499adb09201d2ac SHA512 ba8c4d38a3d90854e79dc18918fffde246d7609a3f1c3a35e06c0fbe33d3688ed29b0ec33556ae37d1654e1dc2133d892613ad8d1ecbdce9aaa5b9eb10dcbb7a
DIST openssh-8.6p1.tar.gz 1786328 BLAKE2B 261a0f1a6235275894d487cce37537755c86835e3a34871462fe29bfe72b49cd9a6b6a547aea4bd554f0957e110c84458cc75a5f2560717fb04804d62228562a SHA512 9854eda0b773c64c9f1f74844ce466b2b42ee8845f58ad062b73141d617af944fa4ebafdf72069f400106d2c2bd0a69c92fe805ec1fc26d4f0faadf06c3fbbe6
diff --git a/net-misc/openssh/openssh-8.5_p1-r2.ebuild b/net-misc/openssh/openssh-8.5_p1-r2.ebuild
deleted file mode 100644
index 96e4f161abd5..000000000000
--- a/net-misc/openssh/openssh-8.5_p1-r2.ebuild
+++ /dev/null
@@ -1,510 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-HPN_PV="${PV^^}"
-
-HPN_VER="15.2"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="13.0.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp !security-key ssl !xmss )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)] !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist(-)=]
- <dev-libs/openssl-1.1.0:0[bindist(-)=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist(-)=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "Missing requested third party patch."
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
-
- # workaround for https://bugs.gentoo.org/734984
- use X509 || eapply "${FILESDIR}"/${PN}-8.3_p1-sha2-include.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
- use X509 && eapply "${FILESDIR}/${PN}-8.5_p1-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
- use sctp && eapply "${FILESDIR}/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch"
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- if use elibc_musl; then
- # stackprotect is broken on musl x86 and ppc
- if use x86 || use ppc; then
- myconf+=( --without-stackprotect )
- fi
-
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
- SUDO="" SSH_SK_PROVIDER="" \
- TEST_SSH_UNSAFE_PERMISSIONS=1 \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- # https://bugs.gentoo.org/733802
- if ! use scp; then
- rm -f "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
- || die "failed to remove scp"
- fi
-
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-16 0:09 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-12-16 0:09 UTC (permalink / raw
To: gentoo-commits
commit: 7751088eb97abfc6ec4495b0622e3860c0cbdb3e
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 16 00:08:55 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Dec 16 00:08:55 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7751088e
net-misc/openssh: Stabilize 8.7_p1-r3 ALLARCHES, #828045
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r3.ebuild b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
index 9a1a572b0363..488f832c164c 100644
--- a/net-misc/openssh/openssh-8.7_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-03 6:38 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-12-03 6:38 UTC (permalink / raw
To: gentoo-commits
commit: f679c94c410ce0678a8e8b06952421094f3c2f5e
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 3 06:36:44 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 3 06:36:44 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f679c94c
net-misc/openssh: allow stack protector on musl x86 + musl ppc
See: b28378fc2358c24785f41fdf92c00d617998ea3d
Bug: https://bugs.gentoo.org/706210
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r3.ebuild | 5 -----
net-misc/openssh/openssh-8.8_p1-r2.ebuild | 5 -----
net-misc/openssh/openssh-8.8_p1-r3.ebuild | 5 -----
3 files changed, 15 deletions(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r3.ebuild b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
index d08c08baabcb..9a1a572b0363 100644
--- a/net-misc/openssh/openssh-8.7_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
@@ -308,11 +308,6 @@ src_configure() {
)
if use elibc_musl; then
- # stackprotect is broken on musl x86 and ppc
- if use x86 || use ppc; then
- myconf+=( --without-stackprotect )
- fi
-
# musl defines bogus values for UTMP_FILE and WTMP_FILE
# https://bugs.gentoo.org/753230
myconf+=( --disable-utmp --disable-wtmp )
diff --git a/net-misc/openssh/openssh-8.8_p1-r2.ebuild b/net-misc/openssh/openssh-8.8_p1-r2.ebuild
index b41b2579d815..a8039cdc405f 100644
--- a/net-misc/openssh/openssh-8.8_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r2.ebuild
@@ -318,11 +318,6 @@ src_configure() {
)
if use elibc_musl; then
- # stackprotect is broken on musl x86 and ppc
- if use x86 || use ppc; then
- myconf+=( --without-stackprotect )
- fi
-
# musl defines bogus values for UTMP_FILE and WTMP_FILE
# https://bugs.gentoo.org/753230
myconf+=( --disable-utmp --disable-wtmp )
diff --git a/net-misc/openssh/openssh-8.8_p1-r3.ebuild b/net-misc/openssh/openssh-8.8_p1-r3.ebuild
index a146d8797f04..1c1068878712 100644
--- a/net-misc/openssh/openssh-8.8_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1-r3.ebuild
@@ -308,11 +308,6 @@ src_configure() {
)
if use elibc_musl; then
- # stackprotect is broken on musl x86 and ppc
- if use x86 || use ppc; then
- myconf+=( --without-stackprotect )
- fi
-
# musl defines bogus values for UTMP_FILE and WTMP_FILE
# https://bugs.gentoo.org/753230
myconf+=( --disable-utmp --disable-wtmp )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-12-03 4:26 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-12-03 4:26 UTC (permalink / raw
To: gentoo-commits
commit: 91c1a70f4c8d56e56e2445bbd123ed286f8d1444
Author: Michał Górny <mgorny <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 12 09:14:07 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 3 04:26:20 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=91c1a70f
net-misc/openssh: Update for openssl/ldns bindist update
Bug: https://bugs.gentoo.org/762850
Signed-off-by: Michał Górny <mgorny <AT> gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/18894
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r3.ebuild | 503 ++++++++++++++++++++++++++++++
net-misc/openssh/openssh-8.8_p1-r3.ebuild | 503 ++++++++++++++++++++++++++++++
2 files changed, 1006 insertions(+)
diff --git a/net-misc/openssh/openssh-8.7_p1-r3.ebuild b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
new file mode 100644
index 000000000000..d08c08baabcb
--- /dev/null
+++ b/net-misc/openssh/openssh-8.7_p1-r3.ebuild
@@ -0,0 +1,503 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="13.2.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa,ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
+ X? ( x11-apps/xauth )
+"
+BDEPEND="
+ virtual/pkgconfig
+ sys-devel/autoconf
+"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
+ use X509 && eapply "${FILESDIR}"/${PN}-8.7_p1-hpn-${HPN_VER}-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # stackprotect is broken on musl x86 and ppc
+ if use x86 || use ppc; then
+ myconf+=( --without-stackprotect )
+ fi
+
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
+ SUDO="" SSH_SK_PROVIDER="" \
+ TEST_SSH_UNSAFE_PERMISSIONS=1 \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ # https://bugs.gentoo.org/733802
+ if ! use scp; then
+ rm -f "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
+ || die "failed to remove scp"
+ fi
+
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
diff --git a/net-misc/openssh/openssh-8.8_p1-r3.ebuild b/net-misc/openssh/openssh-8.8_p1-r3.ebuild
new file mode 100644
index 000000000000..a146d8797f04
--- /dev/null
+++ b/net-misc/openssh/openssh-8.8_p1-r3.ebuild
@@ -0,0 +1,503 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="13.2.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/project/hpnssh/Patches/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl !xmss )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa,ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
+ X? ( x11-apps/xauth )
+"
+BDEPEND="
+ virtual/pkgconfig
+ sys-devel/autoconf
+"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-8.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${FILESDIR}"/${PN}-8.7_p1-hpn-${HPN_VER}-glue.patch
+ use X509 && eapply "${FILESDIR}"/${PN}-8.7_p1-hpn-${HPN_VER}-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${PN}-8.5_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ if use elibc_musl; then
+ # stackprotect is broken on musl x86 and ppc
+ if use x86 || use ppc; then
+ myconf+=( --without-stackprotect )
+ fi
+
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
+ SUDO="" SSH_SK_PROVIDER="" \
+ TEST_SSH_UNSAFE_PERMISSIONS=1 \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ # https://bugs.gentoo.org/733802
+ if ! use scp; then
+ rm -f "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
+ || die "failed to remove scp"
+ fi
+
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-10-06 1:22 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-10-06 1:22 UTC (permalink / raw
To: gentoo-commits
commit: 44ec879cae8f359e98fc977ed51eeea512f1edf2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 6 01:20:32 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Oct 6 01:22:47 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=44ec879c
net-misc/openssh: fix typo in einfo
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.8_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.8_p1.ebuild b/net-misc/openssh/openssh-8.8_p1.ebuild
index a0557e249c1..064bb4adcd3 100644
--- a/net-misc/openssh/openssh-8.8_p1.ebuild
+++ b/net-misc/openssh/openssh-8.8_p1.ebuild
@@ -174,7 +174,7 @@ src_prepare() {
"${S}"/version.h || die "Failed to sed-in SCTP patch version"
PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ einfo "Disabling known failing test (cfgparse) caused by SCTP patch ..."
sed -i \
-e "/\t\tcfgparse \\\/d" \
"${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-09-09 16:56 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2021-09-09 16:56 UTC (permalink / raw
To: gentoo-commits
commit: 9079d7adfc763c2eaf726d60e128277735b2bc70
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 9 16:56:08 2021 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Sep 9 16:56:08 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9079d7ad
net-misc/openssh-8.7_p1-r2: Allow X509 and security-key
Package-Manager: Portage-3.0.22, Repoman-3.0.3
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.7_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.7_p1-r2.ebuild b/net-misc/openssh/openssh-8.7_p1-r2.ebuild
index d2f32ef627b..c44fb1a6f82 100644
--- a/net-misc/openssh/openssh-8.7_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.7_p1-r2.ebuild
@@ -45,7 +45,7 @@ REQUIRED_USE="
ldns? ( ssl )
pie? ( !static )
static? ( !kerberos !pam )
- X509? ( !sctp !security-key ssl !xmss )
+ X509? ( !sctp ssl !xmss )
xmss? ( ssl )
test? ( ssl )
"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-06-17 22:18 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2021-06-17 22:18 UTC (permalink / raw
To: gentoo-commits
commit: d4b53da5b3e1a481168cc87636121c0656e4975b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 17 21:58:29 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Jun 17 22:18:11 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d4b53da5
net-misc/openssh: rev bump for commit 08ab771b7
Package-Manager: Portage-3.0.20, Repoman-3.0.3
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/{openssh-8.5_p1-r1.ebuild => openssh-8.5_p1-r2.ebuild} | 0
net-misc/openssh/{openssh-8.6_p1-r1.ebuild => openssh-8.6_p1-r2.ebuild} | 0
2 files changed, 0 insertions(+), 0 deletions(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r2.ebuild
similarity index 100%
rename from net-misc/openssh/openssh-8.5_p1-r1.ebuild
rename to net-misc/openssh/openssh-8.5_p1-r2.ebuild
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r2.ebuild
similarity index 100%
rename from net-misc/openssh/openssh-8.6_p1-r1.ebuild
rename to net-misc/openssh/openssh-8.6_p1-r2.ebuild
^ permalink raw reply [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-27 16:51 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2021-05-27 16:51 UTC (permalink / raw
To: gentoo-commits
commit: b3fe4598c9a62a58f92f27a6daea48c677f06198
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Thu May 27 15:56:10 2021 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu May 27 16:51:13 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b3fe4598
net-misc/openssh: stable 8.6_p1-r1 for hppa, bug #784896
Package-Manager: Portage-3.0.18, Repoman-3.0.2
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index c9a5fba54f7..a44f020428b 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-25 16:55 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-25 16:55 UTC (permalink / raw
To: gentoo-commits
commit: 9565f8995164913bda1613b02c3addb6ea8ebfbd
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue May 25 16:54:17 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue May 25 16:54:17 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9565f899
net-misc/openssh: Stabilize 8.6_p1-r1 ppc, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index 20d887d60fa..c9a5fba54f7 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-25 11:06 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-25 11:06 UTC (permalink / raw
To: gentoo-commits
commit: ea0cb3780f22ccc03862ea0a5a9e95eabe24551b
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue May 25 11:04:33 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue May 25 11:04:33 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea0cb378
net-misc/openssh: Stabilize 8.6_p1-r1 sparc, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index 3adf717dc72..20d887d60fa 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-24 2:04 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-24 2:04 UTC (permalink / raw
To: gentoo-commits
commit: f05c6e704347d8a3f02af91c8b7f76adcf90e627
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon May 24 02:04:15 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon May 24 02:04:15 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f05c6e70
net-misc/openssh: Stabilize 8.6_p1-r1 arm, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index 210be2be559..3adf717dc72 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-24 2:04 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-24 2:04 UTC (permalink / raw
To: gentoo-commits
commit: 9c0143013ffb7f206f767fc1db0e80603333c7da
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon May 24 02:03:51 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon May 24 02:03:51 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9c014301
net-misc/openssh: Stabilize 8.6_p1-r1 amd64, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index 213c2f37a43..210be2be559 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-24 1:45 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-24 1:45 UTC (permalink / raw
To: gentoo-commits
commit: 45a7ce50fc4437180b41be701a71441e2763836d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon May 24 01:44:47 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon May 24 01:44:47 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=45a7ce50
net-misc/openssh: Stabilize 8.6_p1-r1 arm64, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index e27e6b73e81..213c2f37a43 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-24 1:37 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-05-24 1:37 UTC (permalink / raw
To: gentoo-commits
commit: 5b0914f8e29b9e850893c44b5fd7e0289cbe531e
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon May 24 01:35:13 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon May 24 01:35:13 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b0914f8
net-misc/openssh: Stabilize 8.6_p1-r1 x86, #784896
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index ca2ff312f1a..e27e6b73e81 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-14 23:28 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2021-05-14 23:28 UTC (permalink / raw
To: gentoo-commits
commit: 529e323aad6b43a9a0c06520c1e4f6ae69b9bafa
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri May 14 23:28:05 2021 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri May 14 23:28:15 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=529e323a
net-misc/openssh-8.6_p1-r1: Fix REQUIRED_USE (bug #790092)
Currently the second REQUIRED_USE setting overrides the first one, let's change
it to an append rather than a replacement.
Bug: https://bugs.gentoo.org/790092
Package-Manager: Portage-3.0.18, Repoman-3.0.3
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index dd9d76ad5bc..ca2ff312f1a 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -50,7 +50,7 @@ REQUIRED_USE="
"
# tests currently fail with XMSS
-REQUIRED_USE="test? ( !xmss )"
+REQUIRED_USE+="test? ( !xmss )"
LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-13 13:55 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2021-05-13 13:55 UTC (permalink / raw
To: gentoo-commits
commit: c890ba5476d5bb4b52dd117a35bc25c98d554d18
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu May 13 13:54:58 2021 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Thu May 13 13:54:58 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c890ba54
net-misc/openssh: drop unused multilib inherit
Signed-off-by: Sam James <sam <AT> gentoo.org>
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r3.ebuild | 2 +-
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
net-misc/openssh/openssh-8.5_p1.ebuild | 2 +-
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r3.ebuild b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
index ef43e0aa202..bc42f87054e 100644
--- a/net-misc/openssh/openssh-8.4_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index b440e7aa4ae..8aea025ac78 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-8.5_p1.ebuild b/net-misc/openssh/openssh-8.5_p1.ebuild
index 1d37aa2af6c..340080016b3 100644
--- a/net-misc/openssh/openssh-8.5_p1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index bda61266ca3..dd9d76ad5bc 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
+inherit user-info flag-o-matic autotools pam systemd toolchain-funcs
# Make it more portable between straight releases
# and _p? releases.
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-05-01 14:30 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2021-05-01 14:30 UTC (permalink / raw
To: gentoo-commits
commit: 6001af6dfef17fd3aead79d70d492665b5d5b68a
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat May 1 14:29:04 2021 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat May 1 14:29:04 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6001af6d
net-misc/openssh: remove libressl support
Package-Manager: Portage-3.0.18, Repoman-3.0.2
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r3.ebuild | 8 ++------
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 10 +++-------
net-misc/openssh/openssh-8.5_p1.ebuild | 7 ++-----
net-misc/openssh/openssh-8.6_p1-r1.ebuild | 7 ++-----
4 files changed, 9 insertions(+), 23 deletions(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r3.ebuild b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
index da520e54331..ef43e0aa202 100644
--- a/net-misc/openssh/openssh-8.4_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
@@ -45,7 +45,7 @@ REQUIRED_USE="
pie? ( !static )
static? ( !kerberos !pam )
X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
+ xmss? ( ssl )
test? ( ssl )
"
@@ -61,7 +61,6 @@ LIB_DEPEND="
security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
ssl? (
- !libressl? (
|| (
(
>=dev-libs/openssl-1.0.1:0[bindist=]
@@ -70,8 +69,6 @@ LIB_DEPEND="
>=dev-libs/openssl-1.1.0g:0[bindist=]
)
dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
)
virtual/libcrypt:=[static-libs(+)]
>=sys-libs/zlib-1.2.3:=[static-libs(+)]
@@ -191,7 +188,6 @@ src_prepare() {
cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
pushd "${hpn_patchdir}" &>/dev/null || die
eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
- eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-libressl.patch
use X509 && eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-X509-glue.patch
use sctp && eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-sctp-glue.patch
popd &>/dev/null || die
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 72fe6e947d1..b440e7aa4ae 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -35,7 +35,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
@@ -44,15 +44,14 @@ REQUIRED_USE="
pie? ( !static )
static? ( !kerberos !pam )
X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
+ xmss? ( ssl )
test? ( ssl )
"
LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ net-libs/ldns[static-libs(+)] !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
@@ -60,7 +59,6 @@ LIB_DEPEND="
security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
ssl? (
- !libressl? (
|| (
(
>=dev-libs/openssl-1.0.1:0[bindist=]
@@ -69,8 +67,6 @@ LIB_DEPEND="
>=dev-libs/openssl-1.1.0g:0[bindist=]
)
dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
)
virtual/libcrypt:=[static-libs(+)]
>=sys-libs/zlib-1.2.3:=[static-libs(+)]
diff --git a/net-misc/openssh/openssh-8.5_p1.ebuild b/net-misc/openssh/openssh-8.5_p1.ebuild
index f04773b5b3a..1d37aa2af6c 100644
--- a/net-misc/openssh/openssh-8.5_p1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1.ebuild
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
@@ -45,7 +45,7 @@ REQUIRED_USE="
pie? ( !static )
static? ( !kerberos !pam )
X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
+ xmss? ( ssl )
test? ( ssl )
"
@@ -61,7 +61,6 @@ LIB_DEPEND="
security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
ssl? (
- !libressl? (
|| (
(
>=dev-libs/openssl-1.0.1:0[bindist=]
@@ -70,8 +69,6 @@ LIB_DEPEND="
>=dev-libs/openssl-1.1.0g:0[bindist=]
)
dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
)
virtual/libcrypt:=[static-libs(+)]
>=sys-libs/zlib-1.2.3:=[static-libs(+)]
diff --git a/net-misc/openssh/openssh-8.6_p1-r1.ebuild b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
index a09b6842fbe..bda61266ca3 100644
--- a/net-misc/openssh/openssh-8.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1-r1.ebuild
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
@@ -45,7 +45,7 @@ REQUIRED_USE="
pie? ( !static )
static? ( !kerberos !pam )
X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
+ xmss? ( ssl )
test? ( ssl )
"
@@ -64,7 +64,6 @@ LIB_DEPEND="
security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
ssl? (
- !libressl? (
|| (
(
>=dev-libs/openssl-1.0.1:0[bindist=]
@@ -73,8 +72,6 @@ LIB_DEPEND="
>=dev-libs/openssl-1.1.0g:0[bindist=]
)
dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
)
virtual/libcrypt:=[static-libs(+)]
>=sys-libs/zlib-1.2.3:=[static-libs(+)]
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-04-22 8:09 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2021-04-22 8:09 UTC (permalink / raw
To: gentoo-commits
commit: 09c8ad5e182e371e9b46cedac82327140cd8360a
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 22 08:08:50 2021 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Thu Apr 22 08:09:20 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=09c8ad5e
net-misc/openssh: Use a meaningful die message
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r3.ebuild | 2 +-
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
net-misc/openssh/openssh-8.5_p1.ebuild | 2 +-
net-misc/openssh/openssh-8.6_p1.ebuild | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r3.ebuild b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
index a0feaf7d423..da520e54331 100644
--- a/net-misc/openssh/openssh-8.4_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
@@ -113,7 +113,7 @@ pkg_pretend() {
eerror "that you requested: ${fail}"
eerror "Please mask ${PF} for now and check back later:"
eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
+ die "Missing requested third party patch."
fi
# Make sure people who are using tcp wrappers are notified of its removal. #531156
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 9786c44508b..72fe6e947d1 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -112,7 +112,7 @@ pkg_pretend() {
eerror "that you requested: ${fail}"
eerror "Please mask ${PF} for now and check back later:"
eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
+ die "Missing requested third party patch."
fi
# Make sure people who are using tcp wrappers are notified of its removal. #531156
diff --git a/net-misc/openssh/openssh-8.5_p1.ebuild b/net-misc/openssh/openssh-8.5_p1.ebuild
index ab670d15e10..f04773b5b3a 100644
--- a/net-misc/openssh/openssh-8.5_p1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1.ebuild
@@ -113,7 +113,7 @@ pkg_pretend() {
eerror "that you requested: ${fail}"
eerror "Please mask ${PF} for now and check back later:"
eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
+ die "Missing requested third party patch."
fi
# Make sure people who are using tcp wrappers are notified of its removal. #531156
diff --git a/net-misc/openssh/openssh-8.6_p1.ebuild b/net-misc/openssh/openssh-8.6_p1.ebuild
index 88a3073e029..d3c60891be0 100644
--- a/net-misc/openssh/openssh-8.6_p1.ebuild
+++ b/net-misc/openssh/openssh-8.6_p1.ebuild
@@ -116,7 +116,7 @@ pkg_pretend() {
eerror "that you requested: ${fail}"
eerror "Please mask ${PF} for now and check back later:"
eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
+ die "Missing requested third party patch."
fi
# Make sure people who are using tcp wrappers are notified of its removal. #531156
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-04-12 16:02 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2021-04-12 16:02 UTC (permalink / raw
To: gentoo-commits
commit: c6d62c2ffeb602b9f6e398135c4c2ba0bc6a8e9c
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 12 16:01:53 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Apr 12 16:01:53 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c6d62c2f
net-misc/openssh: Stabilize 8.5_p1-r1 arm64, #774090
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 452199f4634..9786c44508b 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-04-01 17:30 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2021-04-01 17:30 UTC (permalink / raw
To: gentoo-commits
commit: 2cfb9a67c08760ce1c8bca809e3ea693177532d0
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 1 17:30:07 2021 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Apr 1 17:30:07 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2cfb9a67
net-misc/openssh: ppc64 stable wrt bug #774090
Package-Manager: Portage-3.0.13, Repoman-3.0.2
RepoMan-Options: --include-arches="ppc64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 96ef233d5dd..7d73c214eb8 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-31 14:08 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2021-03-31 14:08 UTC (permalink / raw
To: gentoo-commits
commit: 285f591f20c3bef1a11d0a1cac7bbcca25d2211b
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 31 14:07:35 2021 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Mar 31 14:08:16 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=285f591f
net-misc/openssh: s390 stable wrt bug #774090
Package-Manager: Portage-3.0.13, Repoman-3.0.2
RepoMan-Options: --include-arches="s390"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 8f15f44dc2f..96ef233d5dd 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-31 13:53 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2021-03-31 13:53 UTC (permalink / raw
To: gentoo-commits
commit: 84356f5c660622d4d1b585ede5b5d8d669e58633
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 31 13:53:23 2021 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Mar 31 13:53:23 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84356f5c
net-misc/openssh: ppc stable wrt bug #774090
Package-Manager: Portage-3.0.13, Repoman-3.0.2
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 48c99037369..8f15f44dc2f 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-30 20:36 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2021-03-30 20:36 UTC (permalink / raw
To: gentoo-commits
commit: de7ffbd4b8af48a88330bf39ed5666521f9c78fb
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Tue Mar 30 20:33:16 2021 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Mar 30 20:36:32 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de7ffbd4
net-misc/openssh: stable 8.5_p1-r1 for sparc, bug #774090
Package-Manager: Portage-3.0.17, Repoman-3.0.2
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index f3271e63f6f..48c99037369 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-30 6:52 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2021-03-30 6:52 UTC (permalink / raw
To: gentoo-commits
commit: c8dac3b84be5a4898275a8247adafab14106e11f
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Tue Mar 30 05:47:18 2021 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Mar 30 06:51:46 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c8dac3b8
net-misc/openssh: stable 8.5_p1-r1 for hppa, bug #774090
Package-Manager: Portage-3.0.17, Repoman-3.0.2
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 368dc1a2a43..f3271e63f6f 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-30 1:17 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2021-03-30 1:17 UTC (permalink / raw
To: gentoo-commits
commit: 0d9cbd0c10e390fd7428e682bfb37215ae66438d
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 30 01:15:38 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Mar 30 01:15:38 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0d9cbd0c
net-misc/openssh: x86 stable (bug #774090)
Package-Manager: Portage-3.0.17, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 44fe9e3416e..368dc1a2a43 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-29 11:50 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2021-03-29 11:50 UTC (permalink / raw
To: gentoo-commits
commit: a4bb6f346e4d815978d83b69bfef9f0793cbf113
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 29 11:50:45 2021 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Mar 29 11:50:45 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a4bb6f34
net-misc/openssh: amd64 stable wrt bug #774090
Package-Manager: Portage-3.0.13, Repoman-3.0.2
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1-r1.ebuild b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
index 6ed670ff5e9..ad4084515a6 100644
--- a/net-misc/openssh/openssh-8.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1-r1.ebuild
@@ -33,7 +33,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-03-05 18:44 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2021-03-05 18:44 UTC (permalink / raw
To: gentoo-commits
commit: 7450452e3294e02ce38c03194aec9ee4acf2770a
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 5 04:29:08 2021 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Mar 5 18:44:23 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7450452e
net-misc/openssh-8.5_p1: Fix USE=-scp FEATURES=noman (bug #763051)
Closes: https://bugs.gentoo.org/763051
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.5_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.5_p1.ebuild b/net-misc/openssh/openssh-8.5_p1.ebuild
index a5b7915c25d..ab670d15e10 100644
--- a/net-misc/openssh/openssh-8.5_p1.ebuild
+++ b/net-misc/openssh/openssh-8.5_p1.ebuild
@@ -438,7 +438,7 @@ src_install() {
# https://bugs.gentoo.org/733802
if ! use scp; then
- rm "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
+ rm -f "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
|| die "failed to remove scp"
fi
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-02-06 13:49 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2021-02-06 13:49 UTC (permalink / raw
To: gentoo-commits
commit: 6c78ffd4871e513b3c7ef6599503b446929b7ace
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 6 13:48:26 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sat Feb 6 13:48:26 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c78ffd4
net-misc/openssh: security cleanup (#763048)
Bug: https://bugs.gentoo.org/763048
Package-Manager: Portage-3.0.14, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 13 -
net-misc/openssh/openssh-8.1_p1-r5.ebuild | 471 ---------------------------
net-misc/openssh/openssh-8.2_p1-r8.ebuild | 486 ----------------------------
net-misc/openssh/openssh-8.3_p1-r6.ebuild | 511 ------------------------------
4 files changed, 1481 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 173d930cac0..5b21cbdc99a 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,19 +1,6 @@
-DIST openssh-8.1_p1-glibc-2.31-patches.tar.xz 1752 BLAKE2B ccab53069c0058be7ba787281f5a1775d169a9dcda6f78742eb8cb3cce4ebe3a4c506c75a8ac142700669cf04b7475e35f6a06a4499d3d076e4e88e4fc59f3e6 SHA512 270d532fc7f4ec10c5ee56677f8280dec47a96e73f8032713b212cfad64a58ef142a7f49b7981dca80cbf0dd99753ef7a93b6af164cad9492fa224d546c27f14
-DIST openssh-8.1p1+x509-12.3.diff.gz 689934 BLAKE2B 57a302a25bec1d630b9c36f74ab490e11c97f9bcbaf8f527e46ae7fd5bade19feb3d8853079870b5c08b70a55e289cf4bf7981c11983973fa588841aeb21e650 SHA512 8d7c321423940f5a78a51a25ad5373f5db17a4a8ca7e85041e503998e0823ad22068bc652e907e9f5787858d45ce438a4bba18240fa72e088eb10b903e96b192
-DIST openssh-8.1p1-sctp-1.2.patch.xz 7672 BLAKE2B f1aa0713fcb114d8774bd8d524d106401a9d7c2c73a05fbde200ccbdd2562b3636ddd2d0bc3eae9f04b4d7c729c3dafd814ae8c530a76c4a0190fae71d1edcd2 SHA512 2bffab0bbae5a4c1875e0cc229bfd83d8565bd831309158cd489d8b877556c69b936243888a181bd9ff302e19f2c174156781574294d260b6384c464d003d566
-DIST openssh-8.1p1.tar.gz 1625894 BLAKE2B d525be921a6f49420a58df5ac434d43a0c85e0f6bf8428ecebf04117c50f473185933e6e4485e506ac614f71887a513b9962d7b47969ba785da8e3a38f767322 SHA512 b987ea4ffd4ab0c94110723860273b06ed8ffb4d21cbd99ca144a4722dc55f4bf86f6253d500386b6bee7af50f066e2aa2dd095d50746509a10e11221d39d925
-DIST openssh-8.2p1+x509-12.4.3.diff.gz 806905 BLAKE2B 8e0f0f3eeb2aafd9fc9e6eca80c0b51ffedbed9dfc46ff73bb1becd28f6ac013407d03107b59da05d9d56edbf283eef20891086867b79efd8aab81c3e9a4a32f SHA512 51117d7e4df2ff78c4fdfd08c2bb8f1739b1db064df65bab3872e1a956c277a4736c511794aa399061058fea666a76ee07bb50d83a0d077b7fa572d02c030b91
-DIST openssh-8.2p1-sctp-1.2.patch.xz 7668 BLAKE2B 717487cffd235a5dfa2d9d3f2c1983f410d400b0d23f71a9b74406ac3d2f448d76381a3b7a3244942bff4e6bdc3bc78d148b9949c78dc297d99c7330179f8176 SHA512 a5fbd827e62e91b762062a29c7bc3bf569a202bdc8c91da7d77566ff8bb958b5b9fb6f8d45df586e0d7ac07a83de6e82996e9c5cdd6b3bf43336c420d3099305
-DIST openssh-8.2p1.tar.gz 1701197 BLAKE2B 8b95cdebc87e8d14f655ed13c12b91b122adf47161071aa81d0763f81b12fe4bc3d409c260783d995307d4e4ed2d16080fd74b15e4dc6dcc5648d7e66720c3ed SHA512 c4db64e52a3a4c410de9de49f9cb104dd493b10250af3599b92457dd986277b3fd99a6f51cec94892fd1be5bd0369c5757262ea7805f0de464b245c3d34c120a
-DIST openssh-8.3p1+x509-12.5.1.diff.gz 803054 BLAKE2B ec88959b4e3328e70d6f136f3d5bebced2e555de3ea40f55c535ca8a30a0eed84d177ad966e5bda46e1fc61d42141b13e96d068f5abfd069ae81b131dfb5a66c SHA512 28166a1a1aeff0c65f36263c0009e82cda81fc8f4efe3d11fabd0312d199a4f935476cf7074fbce68787d2fec0fd42f00fef383bf856a5767ce9d0ca6bbc8ef0
-DIST openssh-8.3p1-sctp-1.2.patch.xz 7668 BLAKE2B abbc65253d842c09a04811bdbafc175c5226996cdd190812b47ce9646853cd5c1b21d733e719b481cce9c7f4dc00894b6d6be732e311850963df23b9dc55a0e6 SHA512 4e0cc1707663f902dfbf331a431325da78759cc757a4aaae33e0c7f64f21830ec805168d8ae4d47a65a20c235fa534679e288f922df2b24655b7d1ee9a3bf014
-DIST openssh-8.3p1.tar.gz 1706358 BLAKE2B 0b53d92caa4a0f4cb40eee671ac889753d320b7c8e44df159a81dd8163c3663f07fa648f5dc506fb27d31893acf9701b997598c50bf204acf54172d72825a4d8 SHA512 b5232f7c85bf59ae2ff9d17b030117012e257e3b8c0d5ac60bb139a85b1fbf298b40f2e04203a2e13ca7273053ed668b9dedd54d3a67a7cb8e8e58c0228c5f40
DIST openssh-8.4p1+x509-12.6.diff.gz 857479 BLAKE2B ac8c3e8c1087ca571e5459c9826903410ff2d45de60151d9bd8e59da15805b75752f8f3ffc231c9f8aaa8f2b2c07a97a8296684f885e0d14b54ff5d7bc585588 SHA512 e56516b376ecc3e5464895744ce0616cf4446a891fbd3cbcb090d5f61ebc349d74f9c01e855ccd22e574dbfeec0cb2ba7daf582983010ff991243a6371cc5fe3
DIST openssh-8.4p1-sctp-1.2.patch.xz 7668 BLAKE2B 2e22d2a90723cea9ef958bd989b8c431fcb08b4dc5bfd3ebbf463ca9546dc37acdc185c35ddf3adbb90bde9b3902bf36524a456061a9bcbdef7a76ece79e2ff4 SHA512 90da34b7b86e52df9e0191c99c9d645a4d4671958adebeed46e1149102d4ba8c729eadb79d84fad9feac64aafa0541d2f1f4db8cdfe0af5ba893aac072ef2380
DIST openssh-8.4p1.tar.gz 1742201 BLAKE2B 4b1e60d4962095df045c3a31bbf8af725b1c07324c4aa1f6b9a3ddb7e695c98e9aa01655b268f6fd6a400f511b23be91f6b89d07b14a6a2d92f873efb4d9c146 SHA512 d65275b082c46c5efe7cf3264fa6794d6e99a36d4a54b50554fc56979d6c0837381587fd5399195e1db680d2a5ad1ef0b99a180eac2b4de5637906cb7a89e9ce
-DIST openssh-8_1_P1-hpn-AES-CTR-14.20.diff 29935 BLAKE2B 79101c43601e41306c957481c0680a63357d93bededdf12a32229d50acd9c1f46a386cbb91282e9e7d7bb26a9f276f5a675fd2de7662b7cbd073322b172d3bca SHA512 94f011b7e654630e968a378375aa54fa1fde087b4426d0f2225813262e6667a1073814d6a83e9005f97b371c536e462e614bfe726b092ffed8229791592ca221
-DIST openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 42696 BLAKE2B d8ac7fa1a4e4d1877acdedeaee80172da469b5a62d0aaa43d6ed46c578e7893577b9d563835d89ca2044867fc561ad3f562bf504c025cf4c78421cf3d24397e9 SHA512 768db7cca8839df4441afcb08457d13d32625b31859da527c3d7f1a92d17a4ec81d6987db00879c394bbe59589e57b10bfd98899a167ffed65ab367b1fd08739
-DIST openssh-8_1_P1-hpn-PeakTput-14.20.diff 2012 BLAKE2B e42c43128f1d82b4de1517e6a9219947da03cecb607f1bc45f0728547f17601a6ce2ec819b6434890efd19ceaf4d20cb98183596ab5ee79e104a52cda7db9cdc SHA512 238f9419efd3be80bd700f6ae7e210e522d747c363c4e670364f5191f144ae3aa8d1b1539c0bf87b3de36743aa73e8101c53c0ef1c6472d209569be389e7814d
DIST openssh-8_3_P1-hpn-AES-CTR-14.22.diff 29963 BLAKE2B 19b82f4ff820f52dafaa5b3f09f8a0a67f318771c1c7276b9d37e4a6412052c9c53347f880f2d78981af3830432704b9ad74b375241965326530ae23ec8d74a2 SHA512 49f2778831dc768850870a1755da9cdd7d3bc83fa87069070f5a1d357ce9bdadeb2506c8ff3c6b055708da12a70e9ede7ed0e8a29fcab441abb55c9d483663be
DIST openssh-8_3_P1-hpn-DynWinNoneSwitch-14.22.diff 42783 BLAKE2B 10940c35ae6bdc33e58bc9abd9cd7a551d4ca76a175400acb872906805bd04d384f57e81049b183d7d892ce1b5f7a138e197366369fe12e5c9dc1349850b0582 SHA512 c09162b96e0ffadc59c6076507bc843e6f8f2fb372140b84181f5fb2894225b1e05a831d85ba689c35c322b5a99302b9db77c324f978f1a46a16b185b3cb28dd
DIST openssh-8_3_P1-hpn-PeakTput-14.22.diff 2012 BLAKE2B 701f46da022e7ecf35b57f41bf5682a37be453c175928d3ff3df09292275e6021f6108a20c02eec9d636e85ee5a8e05b7233ada180edf1209a3dc4b139d58858 SHA512 026f65c62e4c05b69661094d41bf338df608e2a9b23ef95588062e3bd68729733dae32adab783609a6eca810ccdcbddee25e7649a534c9a283a03282f73438bb
diff --git a/net-misc/openssh/openssh-8.1_p1-r5.ebuild b/net-misc/openssh/openssh-8.1_p1-r5.ebuild
deleted file mode 100644
index e055a207b9d..00000000000
--- a/net-misc/openssh/openssh-8.1_p1-r5.ebuild
+++ /dev/null
@@ -1,471 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-HPN_PV="${PV^^}"
-
-HPN_VER="14.20"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~chutzpah/dist/openssh/${P}-glibc-2.31-patches.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )
-"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.1_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
- eapply "${FILESDIR}"/${PN}-8.1_p1-tests-2020.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-$(ver_cut 1-2 ${X509_VER})-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${PN}-8.1_p1-hpn-${HPN_VER}-glue.patch
- if use X509; then
- # einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # # X509 and AES-CTR-MT don't get along, let's just drop it
- # rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-${HPN_VER}-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-8.1_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-8.2_p1-r8.ebuild b/net-misc/openssh/openssh-8.2_p1-r8.ebuild
deleted file mode 100644
index 595226626d7..00000000000
--- a/net-misc/openssh/openssh-8.2_p1-r8.ebuild
+++ /dev/null
@@ -1,486 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-HPN_PV="8.1_P1"
-
-HPN_VER="14.20"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.4.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
- test? ( ssl )
-"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( dev-libs/libfido2:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-libressl.patch
- if use X509; then
- # einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # # X509 and AES-CTR-MT don't get along, let's just drop it
- # rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-8.3_p1-r6.ebuild b/net-misc/openssh/openssh-8.3_p1-r6.ebuild
deleted file mode 100644
index ef9e80ab84f..00000000000
--- a/net-misc/openssh/openssh-8.3_p1-r6.ebuild
+++ /dev/null
@@ -1,511 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-# PV to USE for HPN patches
-#HPN_PV="${PV^^}"
-HPN_PV="8.1_P1"
-
-HPN_VER="14.20"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.5.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
- test? ( ssl )
-"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.4.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
-
- # workaround for https://bugs.gentoo.org/734984
- use X509 || eapply "${FILESDIR}"/${PN}-8.3_p1-sha2-include.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
- eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-libressl.patch
- if use X509; then
- # einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # # X509 and AES-CTR-MT don't get along, let's just drop it
- # rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
-
- eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(usex X509 '' "$(use_with security-key security-key-builtin)")
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
- SUDO="" SSH_SK_PROVIDER="" \
- TEST_SSH_UNSAFE_PERMISSIONS=1 \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- # https://bugs.gentoo.org/733802
- if ! use scp; then
- rm "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
- || die "failed to remove scp"
- fi
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-01-25 13:17 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2021-01-25 13:17 UTC (permalink / raw
To: gentoo-commits
commit: 3df7cf1f9fb1d1201c3d29a77ebc1d3375f8df64
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 25 12:21:04 2021 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Mon Jan 25 13:16:49 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3df7cf1f
net-misc/openssh-8.4_p1-r3: fix compilation on Darwin
Package-Manager: Portage-3.0.14-prefix, Repoman-3.0.2
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r3.ebuild | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net-misc/openssh/openssh-8.4_p1-r3.ebuild b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
index 6f524b1cb9f..fc00136b312 100644
--- a/net-misc/openssh/openssh-8.4_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
@@ -294,6 +294,9 @@ src_configure() {
append-cppflags -DBROKEN_GLOB
fi
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
local myconf=(
--with-ldflags="${LDFLAGS}"
--disable-strip
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-01-23 10:51 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2021-01-23 10:51 UTC (permalink / raw
To: gentoo-commits
commit: 9050251b703fb4afd2e499a349125104b7e03096
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 23 10:50:44 2021 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat Jan 23 10:51:31 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9050251b
net-misc/openssh: install pam files conditionally
Package-Manager: Portage-3.0.13, Repoman-3.0.2
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
.../openssh/{openssh-8.1_p1-r4.ebuild => openssh-8.1_p1-r5.ebuild} | 4 +++-
.../openssh/{openssh-8.2_p1-r7.ebuild => openssh-8.2_p1-r8.ebuild} | 4 +++-
.../openssh/{openssh-8.3_p1-r5.ebuild => openssh-8.3_p1-r6.ebuild} | 4 +++-
.../openssh/{openssh-8.4_p1-r2.ebuild => openssh-8.4_p1-r3.ebuild} | 4 +++-
4 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r4.ebuild b/net-misc/openssh/openssh-8.1_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.1_p1-r4.ebuild
rename to net-misc/openssh/openssh-8.1_p1-r5.ebuild
index 8ca157b9c13..e055a207b9d 100644
--- a/net-misc/openssh/openssh-8.1_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r5.ebuild
@@ -399,7 +399,9 @@ src_install() {
newinitd "${FILESDIR}"/sshd-r1.initd sshd
newconfd "${FILESDIR}"/sshd-r1.confd sshd
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
tweak_ssh_configs
diff --git a/net-misc/openssh/openssh-8.2_p1-r7.ebuild b/net-misc/openssh/openssh-8.2_p1-r8.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.2_p1-r7.ebuild
rename to net-misc/openssh/openssh-8.2_p1-r8.ebuild
index b40fb15e500..595226626d7 100644
--- a/net-misc/openssh/openssh-8.2_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r8.ebuild
@@ -399,7 +399,9 @@ src_install() {
newinitd "${FILESDIR}"/sshd-r1.initd sshd
newconfd "${FILESDIR}"/sshd-r1.confd sshd
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
tweak_ssh_configs
diff --git a/net-misc/openssh/openssh-8.3_p1-r5.ebuild b/net-misc/openssh/openssh-8.3_p1-r6.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.3_p1-r5.ebuild
rename to net-misc/openssh/openssh-8.3_p1-r6.ebuild
index 20705683e44..ef9e80ab84f 100644
--- a/net-misc/openssh/openssh-8.3_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r6.ebuild
@@ -418,7 +418,9 @@ src_install() {
newinitd "${FILESDIR}"/sshd-r1.initd sshd
newconfd "${FILESDIR}"/sshd-r1.confd sshd
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
tweak_ssh_configs
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.4_p1-r2.ebuild
rename to net-misc/openssh/openssh-8.4_p1-r3.ebuild
index 89417640373..6f524b1cb9f 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r3.ebuild
@@ -423,7 +423,9 @@ src_install() {
newinitd "${FILESDIR}"/sshd-r1.initd sshd
newconfd "${FILESDIR}"/sshd-r1.confd sshd
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
tweak_ssh_configs
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-01-15 6:31 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2021-01-15 6:31 UTC (permalink / raw
To: gentoo-commits
commit: d6fba7a9d7fb7a3fd6f8933187c18ca826ddd622
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 15 06:31:07 2021 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Jan 15 06:31:07 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d6fba7a9
net-misc/openssh: mark 8.4_p1-r2 s390 stable
Signed-off-by: Mike Frysinger <vapier <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index a227ae6cb12..89417640373 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-01-14 20:09 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2021-01-14 20:09 UTC (permalink / raw
To: gentoo-commits
commit: 16fef389970623e59f1f39f9a783820e10027fca
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Thu Jan 14 18:28:20 2021 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Jan 14 20:09:40 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16fef389
net-misc/openssh: stable 8.4_p1-r2 for sparc, bug #751484
Package-Manager: Portage-3.0.12, Repoman-3.0.2
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 6f909a78c10..a227ae6cb12 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2021-01-06 15:06 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2021-01-06 15:06 UTC (permalink / raw
To: gentoo-commits
commit: 06373e5b4631b534206ad40b75806213765e988a
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 6 14:49:06 2021 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Wed Jan 6 15:06:38 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06373e5b
net-misc/openssh: drop x86-macos
Package-Manager: Portage-3.0.12, Repoman-3.0.2
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r4.ebuild | 4 ++--
net-misc/openssh/openssh-8.2_p1-r7.ebuild | 4 ++--
net-misc/openssh/openssh-8.3_p1-r5.ebuild | 4 ++--
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 4 ++--
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r4.ebuild b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
index 6b4bedd6a87..8ca157b9c13 100644
--- a/net-misc/openssh/openssh-8.1_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.2_p1-r7.ebuild b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
index 2ee020b7986..b40fb15e500 100644
--- a/net-misc/openssh/openssh-8.2_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -31,7 +31,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.3_p1-r5.ebuild b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
index 25c6597c739..20705683e44 100644
--- a/net-misc/openssh/openssh-8.3_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 01b1aed7926..6f909a78c10 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-27 17:57 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2020-12-27 17:57 UTC (permalink / raw
To: gentoo-commits
commit: 038c46fc596a480f07098096f976678ff022db9b
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 27 17:55:36 2020 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Sun Dec 27 17:56:36 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=038c46fc
net-misc/openssh: drop ppc-aix m68k-mint
Package-Manager: Portage-3.0.9, Repoman-3.0.2
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.2_p1-r7.ebuild | 2 +-
net-misc/openssh/openssh-8.3_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r4.ebuild b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
index 53ccdd567a2..6b4bedd6a87 100644
--- a/net-misc/openssh/openssh-8.1_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.2_p1-r7.ebuild b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
index c8fff3ba950..2ee020b7986 100644
--- a/net-misc/openssh/openssh-8.2_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
@@ -31,7 +31,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.3_p1-r5.ebuild b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
index fffc55544f4..25c6597c739 100644
--- a/net-misc/openssh/openssh-8.3_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index e7f9d0e08f1..01b1aed7926 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-27 12:51 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-12-27 12:51 UTC (permalink / raw
To: gentoo-commits
commit: 38b27941fc2fb5cf255abd73e1ae1d4088cbc12a
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 27 12:50:32 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sun Dec 27 12:51:09 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38b27941
net-misc/openssh: stable 8.4_p1-r2 for hppa
stable wrt bug #751484
Package-Manager: Portage-3.0.12, Repoman-3.0.2
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 92c9bf3de97..e7f9d0e08f1 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-24 22:06 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-12-24 22:06 UTC (permalink / raw
To: gentoo-commits
commit: 6fc5661edf9c9d6da3bf2c9bb88dd6eac6ec4c96
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 24 18:41:02 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Dec 24 22:06:34 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6fc5661e
net-misc/openssh: stable 8.4_p1-r2 for ppc64
stable wrt bug #751484
Package-Manager: Portage-3.0.12, Repoman-3.0.2
RepoMan-Options: --include-arches="ppc64"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 601036db138..92c9bf3de97 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-24 10:03 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2020-12-24 10:03 UTC (permalink / raw
To: gentoo-commits
commit: 340448a61d0db394af9a3a71ba550247a34ad87a
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 24 10:02:11 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Dec 24 10:02:11 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=340448a6
net-misc/openssh: amd64 stable wrt bug #751484
Package-Manager: Portage-3.0.9, Repoman-3.0.2
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index bd38b3d2617..601036db138 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-22 21:04 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2020-12-22 21:04 UTC (permalink / raw
To: gentoo-commits
commit: adcbab1e62d3e1a21d3295ec72195e888d99da02
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 22 21:04:23 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 22 21:04:23 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=adcbab1e
net-misc/openssh: Stabilize 8.4_p1-r2 arm, #751484
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index bde2be05236..bd38b3d2617 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-22 21:03 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2020-12-22 21:03 UTC (permalink / raw
To: gentoo-commits
commit: f2ab0dfb3bdd5e09097db3fc7c3a8d6e6e51afe6
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 22 21:03:01 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Dec 22 21:03:01 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f2ab0dfb
net-misc/openssh: Stabilize 8.4_p1-r2 arm64, #751484
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 0cc4c6974de..bde2be05236 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-21 23:55 Sam James
0 siblings, 0 replies; 441+ messages in thread
From: Sam James @ 2020-12-21 23:55 UTC (permalink / raw
To: gentoo-commits
commit: 3bbbe808e8c5798b596d2f322b565d05a8b56800
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 21 23:54:08 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Dec 21 23:55:33 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3bbbe808
net-misc/openssh: Stabilize 8.4_p1-r2 ppc, #751484
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index fd3ebc4899e..0cc4c6974de 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-21 17:48 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2020-12-21 17:48 UTC (permalink / raw
To: gentoo-commits
commit: d3999e89aa508814d9a72439d06b0c697ec81e41
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 21 17:46:28 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Dec 21 17:46:28 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d3999e89
net-misc/openssh: x86 stable (bug #751484)
Package-Manager: Portage-3.0.12, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index b2de02f38d4..fd3ebc4899e 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-12-09 12:10 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2020-12-09 12:10 UTC (permalink / raw
To: gentoo-commits
commit: 363c66ac52d3589664e735c0795b26f5f785b587
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 9 08:32:07 2020 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Wed Dec 9 12:09:56 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=363c66ac
net-misc/openssh-8.4_p1-r2: don't depend on linux-headers in Prefix
Package-Manager: Portage-3.0.9, Repoman-3.0.2
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 4122763052b..b2de02f38d4 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -85,7 +85,7 @@ RDEPEND="
"
DEPEND="${RDEPEND}
virtual/os-headers
- kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
static? ( ${LIB_DEPEND} )
"
RDEPEND="${RDEPEND}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-11-05 18:38 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2020-11-05 18:38 UTC (permalink / raw
To: gentoo-commits
commit: 466c34fd3e7836a9b180dcf320023596a1df0567
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 5 18:38:01 2020 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Thu Nov 5 18:38:01 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=466c34fd
net-misc/openssh: disable utmp and wtmp on musl
Closes: https://bugs.gentoo.org/753230
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r2.ebuild | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r2.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 09691782910..4122763052b 100644
--- a/net-misc/openssh/openssh-8.4_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -320,8 +320,16 @@ src_configure() {
$(use_with !elibc_Cygwin hardening) #659210
)
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
+ if use elibc_musl; then
+ # stackprotect is broken on musl x86 and ppc
+ if use x86 || use ppc; then
+ myconf+=( --without-stackprotect )
+ fi
+
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ # https://bugs.gentoo.org/753230
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-10-06 8:35 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2020-10-06 8:35 UTC (permalink / raw
To: gentoo-commits
commit: 3be8e67027b4ef698281a9971313896de0d91adf
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 6 08:35:13 2020 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Tue Oct 6 08:35:13 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3be8e670
net-misc/openssh-8.4_p1-r1: fix removal of /var/empty for Prefix
Package-Manager: Portage-3.0.4, Repoman-3.0.1
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.4_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.4_p1-r1.ebuild b/net-misc/openssh/openssh-8.4_p1-r1.ebuild
index 34edf4ea761..6c183e64862 100644
--- a/net-misc/openssh/openssh-8.4_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r1.ebuild
@@ -430,7 +430,7 @@ src_install() {
|| die "failed to remove scp"
fi
- rmdir "${D}"/var/empty || die
+ rmdir "${ED}"/var/empty || die
systemd_dounit "${FILESDIR}"/sshd.{service,socket}
systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-09-27 11:47 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2020-09-27 11:47 UTC (permalink / raw
To: gentoo-commits
commit: 5505ffc4cae3bd8ac17ac4d14b40b1c392baec4a
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 27 11:46:58 2020 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Sun Sep 27 11:47:39 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5505ffc4
net-misc/openssh-8.3_p1-r5: fix compilation on Solaris
Package-Manager: Portage-3.0.4, Repoman-3.0.1
Signed-off-by: Fabian Groffen <grobian <AT> gentoo.org>
net-misc/openssh/openssh-8.3_p1-r5.ebuild | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net-misc/openssh/openssh-8.3_p1-r5.ebuild b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
index 86300b9d810..fffc55544f4 100644
--- a/net-misc/openssh/openssh-8.3_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
@@ -290,6 +290,13 @@ src_configure() {
use static && append-ldflags -static
use xmss && append-cflags -DWITH_XMSS
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
local myconf=(
--with-ldflags="${LDFLAGS}"
--disable-strip
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-08-17 14:32 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2020-08-17 14:32 UTC (permalink / raw
To: gentoo-commits
commit: a3ddee3a0c95e932481d494930a05f6f34938c1e
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 17 14:29:28 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Aug 17 14:32:33 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a3ddee3a
net-misc/openssh: depend on >=sys-kernel/linux-headers-5.1
In >=sys-libs/glibc-2.31 we are already forcing an upgrade of net-misc/openssh.
However, sandbox code in OpenSSH [Link 1] is guarded by "#ifdef" so an upgrade
of OpenSSH before glibc upgrade won't fix the problem if system is using old
linux-headers without __NR_clock_nanosleep{,_time64}.
Forcing >=linux-headers-5.1 will ensure that OpenSSH's sandbox supports
__NR_clock_nanosleep{,_time64} and will therefore work with >=glibc-2.31.
Link 1: https://github.com/openssh/openssh-portable/blob/V_8_3/sandbox-seccomp-filter.c#L252-L257
Bug: https://bugs.gentoo.org/708224
Closes: https://bugs.gentoo.org/737604
Package-Manager: Portage-3.0.2, Repoman-2.3.23
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
.../openssh/{openssh-8.1_p1-r3.ebuild => openssh-8.1_p1-r4.ebuild} | 3 ++-
.../openssh/{openssh-8.2_p1-r6.ebuild => openssh-8.2_p1-r7.ebuild} | 3 ++-
.../openssh/{openssh-8.3_p1-r4.ebuild => openssh-8.3_p1-r5.ebuild} | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.1_p1-r3.ebuild
rename to net-misc/openssh/openssh-8.1_p1-r4.ebuild
index 75b805da4dd..53ccdd567a2 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r4.ebuild
@@ -82,8 +82,9 @@ RDEPEND="
kerberos? ( virtual/krb5 )
"
DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
virtual/os-headers
+ kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
+ static? ( ${LIB_DEPEND} )
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
diff --git a/net-misc/openssh/openssh-8.2_p1-r6.ebuild b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.2_p1-r6.ebuild
rename to net-misc/openssh/openssh-8.2_p1-r7.ebuild
index c0ed8f5dec4..c8fff3ba950 100644
--- a/net-misc/openssh/openssh-8.2_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r7.ebuild
@@ -81,8 +81,9 @@ RDEPEND="
kerberos? ( virtual/krb5 )
"
DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
virtual/os-headers
+ kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
+ static? ( ${LIB_DEPEND} )
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
diff --git a/net-misc/openssh/openssh-8.3_p1-r4.ebuild b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.3_p1-r4.ebuild
rename to net-misc/openssh/openssh-8.3_p1-r5.ebuild
index 6e93d57cf89..86300b9d810 100644
--- a/net-misc/openssh/openssh-8.3_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r5.ebuild
@@ -84,8 +84,9 @@ RDEPEND="
kerberos? ( virtual/krb5 )
"
DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
virtual/os-headers
+ kernel_linux? ( >=sys-kernel/linux-headers-5.1 )
+ static? ( ${LIB_DEPEND} )
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-07-27 21:19 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-07-27 21:19 UTC (permalink / raw
To: gentoo-commits
commit: 0dc8c82d4cd5ad3976601916b0afe4f9427f513b
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 27 17:17:48 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Mon Jul 27 21:19:30 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0dc8c82d
net-misc/openssh-9.3_p1-r4: Default enable the scp USE flag (bug #733802)
Bug: https://bugs.gentoo.org/733802
Package-Manager: Portage-3.0.0, Repoman-2.3.23
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/{openssh-8.3_p1-r3.ebuild => openssh-8.3_p1-r4.ebuild} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.3_p1-r3.ebuild b/net-misc/openssh/openssh-8.3_p1-r4.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.3_p1-r3.ebuild
rename to net-misc/openssh/openssh-8.3_p1-r4.ebuild
index 4b456430ead..a3d261036a7 100644
--- a/net-misc/openssh/openssh-8.3_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r4.ebuild
@@ -36,7 +36,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie scp sctp security-key selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie +scp sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-07-24 23:55 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-07-24 23:55 UTC (permalink / raw
To: gentoo-commits
commit: 8f1a39c074c81fad3745655a67cbc5f8b50866df
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 24 23:46:09 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Jul 24 23:55:20 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f1a39c0
net-misc/openssh-8.3_p1-r3: s:${D}:${ED}:
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.3_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.3_p1-r3.ebuild b/net-misc/openssh/openssh-8.3_p1-r3.ebuild
index 6a9b9b724f8..4b456430ead 100644
--- a/net-misc/openssh/openssh-8.3_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.3_p1-r3.ebuild
@@ -421,7 +421,7 @@ src_install() {
# https://bugs.gentoo.org/733802
if ! use scp; then
- rm "${D}"/usr/{bin/scp,share/man/man1/scp.1} \
+ rm "${ED}"/usr/{bin/scp,share/man/man1/scp.1} \
|| die "failed to remove scp"
fi
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-07-24 21:12 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-07-24 21:12 UTC (permalink / raw
To: gentoo-commits
commit: bf05cf2e9fe336b6e7577e806271441c566c9d0d
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 24 20:25:51 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Jul 24 21:10:11 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bf05cf2e
net-misc/openssh: remove redundant 8.2_p1-r5
Package-Manager: Portage-3.0.0, Repoman-2.3.23
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-8.2_p1-r5.ebuild | 482 ------------------------------
2 files changed, 483 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index c423297d475..6bc6b039349 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -2,7 +2,6 @@ DIST openssh-8.1_p1-glibc-2.31-patches.tar.xz 1752 BLAKE2B ccab53069c0058be7ba78
DIST openssh-8.1p1+x509-12.3.diff.gz 689934 BLAKE2B 57a302a25bec1d630b9c36f74ab490e11c97f9bcbaf8f527e46ae7fd5bade19feb3d8853079870b5c08b70a55e289cf4bf7981c11983973fa588841aeb21e650 SHA512 8d7c321423940f5a78a51a25ad5373f5db17a4a8ca7e85041e503998e0823ad22068bc652e907e9f5787858d45ce438a4bba18240fa72e088eb10b903e96b192
DIST openssh-8.1p1-sctp-1.2.patch.xz 7672 BLAKE2B f1aa0713fcb114d8774bd8d524d106401a9d7c2c73a05fbde200ccbdd2562b3636ddd2d0bc3eae9f04b4d7c729c3dafd814ae8c530a76c4a0190fae71d1edcd2 SHA512 2bffab0bbae5a4c1875e0cc229bfd83d8565bd831309158cd489d8b877556c69b936243888a181bd9ff302e19f2c174156781574294d260b6384c464d003d566
DIST openssh-8.1p1.tar.gz 1625894 BLAKE2B d525be921a6f49420a58df5ac434d43a0c85e0f6bf8428ecebf04117c50f473185933e6e4485e506ac614f71887a513b9962d7b47969ba785da8e3a38f767322 SHA512 b987ea4ffd4ab0c94110723860273b06ed8ffb4d21cbd99ca144a4722dc55f4bf86f6253d500386b6bee7af50f066e2aa2dd095d50746509a10e11221d39d925
-DIST openssh-8.2p1+x509-12.4.2.diff.gz 805574 BLAKE2B 4df31b634308ce074d820df24984d44fdde48e115f8c2ac62afb09f28602acf9e4b080a13e5ba2e6033fe92bc4289ef00ed7adbb4af334462fbc9c82c4e7b64f SHA512 770b269929df0b7c9709fa2d07693a3ae9ebaca12fe463f7eabdaab66ee115fc02afa46dc847493d5050bff105740f2c1453fc456271d723c6e5b98d5bf7fd43
DIST openssh-8.2p1+x509-12.4.3.diff.gz 806905 BLAKE2B 8e0f0f3eeb2aafd9fc9e6eca80c0b51ffedbed9dfc46ff73bb1becd28f6ac013407d03107b59da05d9d56edbf283eef20891086867b79efd8aab81c3e9a4a32f SHA512 51117d7e4df2ff78c4fdfd08c2bb8f1739b1db064df65bab3872e1a956c277a4736c511794aa399061058fea666a76ee07bb50d83a0d077b7fa572d02c030b91
DIST openssh-8.2p1-sctp-1.2.patch.xz 7668 BLAKE2B 717487cffd235a5dfa2d9d3f2c1983f410d400b0d23f71a9b74406ac3d2f448d76381a3b7a3244942bff4e6bdc3bc78d148b9949c78dc297d99c7330179f8176 SHA512 a5fbd827e62e91b762062a29c7bc3bf569a202bdc8c91da7d77566ff8bb958b5b9fb6f8d45df586e0d7ac07a83de6e82996e9c5cdd6b3bf43336c420d3099305
DIST openssh-8.2p1.tar.gz 1701197 BLAKE2B 8b95cdebc87e8d14f655ed13c12b91b122adf47161071aa81d0763f81b12fe4bc3d409c260783d995307d4e4ed2d16080fd74b15e4dc6dcc5648d7e66720c3ed SHA512 c4db64e52a3a4c410de9de49f9cb104dd493b10250af3599b92457dd986277b3fd99a6f51cec94892fd1be5bd0369c5757262ea7805f0de464b245c3d34c120a
diff --git a/net-misc/openssh/openssh-8.2_p1-r5.ebuild b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
deleted file mode 100644
index 83bb3bd37ed..00000000000
--- a/net-misc/openssh/openssh-8.2_p1-r5.ebuild
+++ /dev/null
@@ -1,482 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-HPN_PV="8.1_P1"
-
-HPN_VER="14.20"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.4.2" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp !security-key ssl !xmss )
- xmss? ( || ( ssl libressl ) )
- test? ( ssl )
-"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- security-key? ( dev-libs/libfido2:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/os-headers
-"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix? ( sys-apps/shadow ) )
- X? ( x11-apps/xauth )
-"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf
-"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}" || die
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
- if use X509; then
- # einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # # X509 and AES-CTR-MT don't get along, let's just drop it
- # rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-07-24 21:12 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-07-24 21:12 UTC (permalink / raw
To: gentoo-commits
commit: b9c13abcdabcbde0e879fcff5b650216e8649ebb
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 24 21:10:03 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Jul 24 21:10:11 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b9c13abc
net-misc/openssh-8.3_p1-r3: Add default-off USE flag for scp (bug #733802)
Bug: https://bugs.gentoo.org/733802
Package-Manager: Portage-3.0.0, Repoman-2.3.23
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/metadata.xml | 1 +
net-misc/openssh/openssh-8.3_p1-r3.ebuild | 498 ++++++++++++++++++++++++++++++
2 files changed, 499 insertions(+)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 2a8ac0609ec..9ce34e61070 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -21,6 +21,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
</longdescription>
<use>
<flag name="bindist">Disable EC/RC5 algorithms in OpenSSL for patent reasons.</flag>
+ <flag name="scp">Enable scp command with known security problems. See bug 733802</flag>
<flag name="hpn">Enable high performance ssh</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
diff --git a/net-misc/openssh/openssh-8.3_p1-r3.ebuild b/net-misc/openssh/openssh-8.3_p1-r3.ebuild
new file mode 100644
index 00000000000..6a9b9b724f8
--- /dev/null
+++ b/net-misc/openssh/openssh-8.3_p1-r3.ebuild
@@ -0,0 +1,498 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit user-info flag-o-matic multilib autotools pam systemd toolchain-funcs
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.1_P1"
+
+HPN_VER="14.20"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="12.5.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie scp sctp security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp !security-key ssl !xmss )
+ xmss? ( || ( ssl libressl ) )
+ test? ( ssl )
+"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.4.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ || (
+ (
+ >=dev-libs/openssl-1.0.1:0[bindist=]
+ <dev-libs/openssl-1.1.0:0[bindist=]
+ )
+ >=dev-libs/openssl-1.1.0g:0[bindist=]
+ )
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/os-headers
+"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
+ X? ( x11-apps/xauth )
+"
+BDEPEND="
+ virtual/pkgconfig
+ sys-devel/autoconf
+"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-8.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
+ eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
+ eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-libressl.patch
+ if use X509; then
+ # einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
+ # # X509 and AES-CTR-MT don't get along, let's just drop it
+ # rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
+
+ eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-X509-glue.patch
+ fi
+ use sctp && eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-sctp-glue.patch
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ # stackprotect is broken on musl x86 and ppc
+ use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" TMPDIR="${T}" \
+ SUDO="" SSH_SK_PROVIDER="" \
+ TEST_SSH_UNSAFE_PERMISSIONS=1 \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ # https://bugs.gentoo.org/733802
+ if ! use scp; then
+ rm "${D}"/usr/{bin/scp,share/man/man1/scp.1} \
+ || die "failed to remove scp"
+ fi
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-04-26 14:34 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2020-04-26 14:34 UTC (permalink / raw
To: gentoo-commits
commit: 5040e21f5499477bb02f97fe0310322150f36069
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 26 14:32:58 2020 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Sun Apr 26 14:32:58 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5040e21f
net-misc/openssh: remove overly-specifc maintainer entry
This just confuses bug-wranglers. We can seek input from Robin as
needed.
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/metadata.xml | 4 ----
1 file changed, 4 deletions(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index bc9c3e6e16d..2a8ac0609ec 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -5,10 +5,6 @@
<email>base-system@gentoo.org</email>
<name>Gentoo Base System</name>
</maintainer>
- <maintainer type="person">
- <email>robbat2@gentoo.org</email>
- <description>LPK issues. Only assign if it's a direct LPK issue. Do not directly assign for anything else.</description>
- </maintainer>
<longdescription>
OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools that
increasing numbers of people on the Internet are coming to rely on. Many users of telnet,
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-04-09 1:02 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-04-09 1:02 UTC (permalink / raw
To: gentoo-commits
commit: 88e8f9eebbe207f7903b9c89ed21e3d2688cc338
Author: Roy Yang <royyang <AT> google <DOT> com>
AuthorDate: Wed Apr 8 22:43:34 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Apr 9 01:01:52 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=88e8f9ee
net-misc/openssh: Update CPE Prefix to openbsd:openssh
Signed-off-by: Roy Yang <royyang <AT> google.com>
Closes: https://github.com/gentoo/gentoo/pull/15270
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/metadata.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 6cc1ea78422..22ea5e88361 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -36,7 +36,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="xmss">Enable XMSS post-quantum authentication algorithm</flag>
</use>
<upstream>
- <remote-id type="cpe">cpe:/a:openssh:openssh</remote-id>
+ <remote-id type="cpe">cpe:/a:openbsd:openssh</remote-id>
<remote-id type="sourceforge">hpnssh</remote-id>
</upstream>
</pkgmetadata>
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-04-03 21:35 Mart Raudsepp
0 siblings, 0 replies; 441+ messages in thread
From: Mart Raudsepp @ 2020-04-03 21:35 UTC (permalink / raw
To: gentoo-commits
commit: 7648c5a9dc3822f5dac71f9c9c5b28516298a2c4
Author: Sam James (sam_c) <sam <AT> cmpct <DOT> info>
AuthorDate: Fri Apr 3 20:09:11 2020 +0000
Commit: Mart Raudsepp <leio <AT> gentoo <DOT> org>
CommitDate: Fri Apr 3 21:35:12 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7648c5a9
net-misc/openssh: arm64 stable (bug #710924)
Signed-off-by: Sam James (sam_c) <sam <AT> cmpct.info>
Signed-off-by: Mart Raudsepp <leio <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
index 89cf486c4de..75b805da4dd 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-17 18:00 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-03-17 18:00 UTC (permalink / raw
To: gentoo-commits
commit: 8e690f338c4b1074e4c908e347b84c09043bfad4
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Tue Mar 17 17:39:13 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Mar 17 18:00:14 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e690f33
net-misc/openssh: stable 8.1_p1-r3 for hppa, bug #710924
Package-Manager: Portage-2.3.89, Repoman-2.3.20
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
index 7521d3e20cd..08b2365d6a2 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-16 12:41 Benda XU
0 siblings, 0 replies; 441+ messages in thread
From: Benda XU @ 2020-03-16 12:41 UTC (permalink / raw
To: gentoo-commits
commit: 846c38951ad42771f83af7db9e4d66c6fa31294c
Author: Benda Xu <heroxbd <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 16 12:40:20 2020 +0000
Commit: Benda XU <heroxbd <AT> gentoo <DOT> org>
CommitDate: Mon Mar 16 12:41:25 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=846c3895
net-misc/openssh: no sys-apps/shadow in prefix.
Closes: https://bugs.gentoo.org/712040
Package-Manager: Portage-2.3.88, Repoman-2.3.18
Signed-off-by: Benda Xu <heroxbd <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-7.7_p1-r10.ebuild | 2 +-
net-misc/openssh/openssh-7.9_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-8.0_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-8.1_p1-r3.ebuild | 2 +-
net-misc/openssh/openssh-8.2_p1-r5.ebuild | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r5.ebuild b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
index 5e5f120d02c..863231391d3 100644
--- a/net-misc/openssh/openssh-7.5_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
@@ -67,7 +67,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S=${WORKDIR}/${PARCH}
diff --git a/net-misc/openssh/openssh-7.7_p1-r10.ebuild b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
index 0fa469f8aae..75d4fbb38af 100644
--- a/net-misc/openssh/openssh-7.7_p1-r10.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
@@ -66,7 +66,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-7.9_p1-r5.ebuild b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
index dff08081daa..cebcb4d0ee3 100644
--- a/net-misc/openssh/openssh-7.9_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
@@ -78,7 +78,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.0_p1-r5.ebuild b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
index 486408636fe..bbf251ac7e7 100644
--- a/net-misc/openssh/openssh-8.0_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
@@ -79,7 +79,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
index d29a0e5bfc4..7521d3e20cd 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -87,7 +87,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )
"
BDEPEND="
diff --git a/net-misc/openssh/openssh-8.2_p1-r5.ebuild b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
index b2157fa9bfd..de7168fcee1 100644
--- a/net-misc/openssh/openssh-8.2_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
@@ -86,7 +86,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
+ userland_GNU? ( !prefix? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )
"
BDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-15 13:05 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2020-03-15 13:05 UTC (permalink / raw
To: gentoo-commits
commit: 104d67a976943cb676bdb1f7e8719bed2ae91ce1
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 15 13:04:40 2020 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Mar 15 13:04:40 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=104d67a9
net-misc/openssh: sh stable wrt bug #710924
Package-Manager: Portage-2.3.89, Repoman-2.3.20
RepoMan-Options: --include-arches="sh"
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
index 10288d4581c..d29a0e5bfc4 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-10 12:36 Michael Haubenwallner
0 siblings, 0 replies; 441+ messages in thread
From: Michael Haubenwallner @ 2020-03-10 12:36 UTC (permalink / raw
To: gentoo-commits
commit: dcbc43341eda8aa75b81c1837f7d9dbc04dc613e
Author: Michael Haubenwallner <haubi <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 10 09:55:52 2020 +0000
Commit: Michael Haubenwallner <haubi <AT> gentoo <DOT> org>
CommitDate: Tue Mar 10 12:36:18 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dcbc4334
net-misc/openssh: no sys-apps/shadow in prefix-guest
Closes: https://bugs.gentoo.org/712040
Package-Manager: Portage-2.3.84, Repoman-2.3.20
Signed-off-by: Michael Haubenwallner <haubi <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-7.7_p1-r10.ebuild | 2 +-
net-misc/openssh/openssh-7.9_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-8.0_p1-r5.ebuild | 2 +-
net-misc/openssh/openssh-8.1_p1-r3.ebuild | 2 +-
net-misc/openssh/openssh-8.2_p1-r5.ebuild | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r5.ebuild b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
index b7cbfffe532..5e5f120d02c 100644
--- a/net-misc/openssh/openssh-7.5_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
@@ -67,7 +67,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S=${WORKDIR}/${PARCH}
diff --git a/net-misc/openssh/openssh-7.7_p1-r10.ebuild b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
index 7d0a5204c10..0fa469f8aae 100644
--- a/net-misc/openssh/openssh-7.7_p1-r10.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
@@ -66,7 +66,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-7.9_p1-r5.ebuild b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
index b8112d8b26d..dff08081daa 100644
--- a/net-misc/openssh/openssh-7.9_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
@@ -78,7 +78,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.0_p1-r5.ebuild b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
index be6bd81a689..486408636fe 100644
--- a/net-misc/openssh/openssh-8.0_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
@@ -79,7 +79,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.1_p1-r3.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
index 0416f497f79..10288d4581c 100644
--- a/net-misc/openssh/openssh-8.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -87,7 +87,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )
"
BDEPEND="
diff --git a/net-misc/openssh/openssh-8.2_p1-r5.ebuild b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
index 9aad1e38a38..b2157fa9bfd 100644
--- a/net-misc/openssh/openssh-8.2_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
@@ -86,7 +86,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( sys-apps/shadow )
+ userland_GNU? ( !prefix-guest? ( sys-apps/shadow ) )
X? ( x11-apps/xauth )
"
BDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-07 10:09 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2020-03-07 10:09 UTC (permalink / raw
To: gentoo-commits
commit: d87f94f04c4db1b99e372162fcd16b8b2f99fdaa
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 7 10:08:36 2020 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat Mar 7 10:08:36 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d87f94f0
net-misc/openssh: migrate to sys-apps/shadow
Package-Manager: Portage-2.3.89, Repoman-2.3.20
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
net-misc/openssh/{openssh-7.5_p1-r4.ebuild => openssh-7.5_p1-r5.ebuild} | 2 +-
.../openssh/{openssh-7.7_p1-r9.ebuild => openssh-7.7_p1-r10.ebuild} | 2 +-
net-misc/openssh/{openssh-7.9_p1-r4.ebuild => openssh-7.9_p1-r5.ebuild} | 2 +-
net-misc/openssh/{openssh-8.0_p1-r4.ebuild => openssh-8.0_p1-r5.ebuild} | 2 +-
net-misc/openssh/{openssh-8.1_p1-r2.ebuild => openssh-8.1_p1-r3.ebuild} | 2 +-
net-misc/openssh/{openssh-8.2_p1-r3.ebuild => openssh-8.2_p1-r5.ebuild} | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.5_p1-r4.ebuild
rename to net-misc/openssh/openssh-7.5_p1-r5.ebuild
index 1614b7a9c14..b7cbfffe532 100644
--- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r5.ebuild
@@ -67,7 +67,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )"
S=${WORKDIR}/${PARCH}
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.7_p1-r9.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r10.ebuild
index 675ab6bdd43..7d0a5204c10 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r10.ebuild
@@ -66,7 +66,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.9_p1-r4.ebuild
rename to net-misc/openssh/openssh-7.9_p1-r5.ebuild
index 0a3da9ab28e..b8112d8b26d 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r5.ebuild
@@ -78,7 +78,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.0_p1-r4.ebuild
rename to net-misc/openssh/openssh-8.0_p1-r5.ebuild
index 5153ebc1984..be6bd81a689 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r5.ebuild
@@ -79,7 +79,7 @@ DEPEND="${RDEPEND}
sys-devel/autoconf"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )"
S="${WORKDIR}/${PARCH}"
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.1_p1-r2.ebuild
rename to net-misc/openssh/openssh-8.1_p1-r3.ebuild
index ae7a9465ebf..0416f497f79 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r3.ebuild
@@ -87,7 +87,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
BDEPEND="
diff --git a/net-misc/openssh/openssh-8.2_p1-r3.ebuild b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-8.2_p1-r3.ebuild
rename to net-misc/openssh/openssh-8.2_p1-r5.ebuild
index 0579a0af345..9aad1e38a38 100644
--- a/net-misc/openssh/openssh-8.2_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r5.ebuild
@@ -86,7 +86,7 @@ DEPEND="${RDEPEND}
"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
+ userland_GNU? ( sys-apps/shadow )
X? ( x11-apps/xauth )
"
BDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-02 12:34 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2020-03-02 12:34 UTC (permalink / raw
To: gentoo-commits
commit: ce7497a402bc9b55fe053f04be466fb3b72bc6ff
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 2 12:33:43 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Mar 2 12:33:43 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce7497a4
net-misc/openssh: s390 stable wrt bug #710924
Package-Manager: Portage-2.3.89, Repoman-2.3.20
RepoMan-Options: --include-arches="s390"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 60cffc4b5bd..ae7a9465ebf 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-02 12:28 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2020-03-02 12:28 UTC (permalink / raw
To: gentoo-commits
commit: e5d3087b478ec8e447e3472a0725bac295d14111
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 2 12:28:02 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Mar 2 12:28:02 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e5d3087b
net-misc/openssh: arm stable wrt bug #710924
Package-Manager: Portage-2.3.89, Repoman-2.3.20
RepoMan-Options: --include-arches="arm"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index d59e05ef94e..60cffc4b5bd 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-02 11:34 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-03-02 11:34 UTC (permalink / raw
To: gentoo-commits
commit: 5ed8461650ea2859d6f71889d801a730bd65ebf3
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 2 11:33:09 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Mon Mar 2 11:33:09 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ed84616
net-misc/openssh: stable 8.1_p1-r2 for ppc64, bug #710924
Package-Manager: Portage-2.3.88, Repoman-2.3.20
RepoMan-Options: --include-arches="ppc64"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 84357bdfc31..d59e05ef94e 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-02 11:22 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-03-02 11:22 UTC (permalink / raw
To: gentoo-commits
commit: 6e3fdfea1f5f89c6664aab0913041aa9490d56f9
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 2 11:18:57 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Mon Mar 2 11:18:57 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e3fdfea
net-misc/openssh: stable 8.1_p1-r2 for ppc, bug #710924
Package-Manager: Portage-2.3.88, Repoman-2.3.20
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 8bc15d74c54..84357bdfc31 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-03-02 11:04 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-03-02 11:04 UTC (permalink / raw
To: gentoo-commits
commit: 8f04a8a81de54b534201fee857f18a5b3fe41d9d
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 2 11:03:49 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Mon Mar 2 11:03:49 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f04a8a8
net-misc/openssh: stable 8.1_p1-r2 for ia64, bug #710924
Package-Manager: Portage-2.3.88, Repoman-2.3.20
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 5921f6945b0..8bc15d74c54 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-28 20:40 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2020-02-28 20:40 UTC (permalink / raw
To: gentoo-commits
commit: 9631fed19bf9aae65283dee8e27cf0a02dcb3bfa
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Fri Feb 28 20:28:23 2020 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Fri Feb 28 20:40:25 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9631fed1
net-misc/openssh: stable 8.1_p1-r2 for sparc, bug #710924
Package-Manager: Portage-2.3.84, Repoman-2.3.20
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 6e85d3f256b..5921f6945b0 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-28 17:50 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2020-02-28 17:50 UTC (permalink / raw
To: gentoo-commits
commit: b0d43b466bf62227451d0e6efa517d3c88514052
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 28 17:50:05 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Fri Feb 28 17:50:05 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b0d43b46
net-misc/openssh: x86 stable wrt bug #710924
Package-Manager: Portage-2.3.84, Repoman-2.3.20
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 65b04ec713c..6e85d3f256b 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-27 9:49 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2020-02-27 9:49 UTC (permalink / raw
To: gentoo-commits
commit: 33e77f18b2f8a88bd8052c9a7b112b5b51b3e7ed
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 27 09:49:19 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Feb 27 09:49:19 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33e77f18
net-misc/openssh: amd64 stable wrt bug #710924
Package-Manager: Portage-2.3.84, Repoman-2.3.20
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 7b622cca158..65b04ec713c 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -34,7 +34,7 @@ S="${WORKDIR}/${PARCH}"
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-16 19:05 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-16 19:05 UTC (permalink / raw
To: gentoo-commits
commit: bd05d99800a29426e1fbe5572aec1a887587c854
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 16 19:05:00 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sun Feb 16 19:05:25 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bd05d998
net-misc/openssh-8.2_p1-r1: Refactor upgrade warnings again
Package-Manager: Portage-2.3.89, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.2_p1-r1.ebuild | 88 +++++++++++++++----------------
1 file changed, 44 insertions(+), 44 deletions(-)
diff --git a/net-misc/openssh/openssh-8.2_p1-r1.ebuild b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
index aa9c926b3f7..23a61c4f6d0 100644
--- a/net-misc/openssh/openssh-8.2_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
@@ -415,47 +415,53 @@ src_install() {
}
pkg_preinst() {
- has_version "<${CATEGORY}/${PN}-5.8_p1" && show_ecdsa_warning=1
- has_version "<${CATEGORY}/${PN}-7.0_p1" && show_tcpd_warning=1
- has_version "<${CATEGORY}/${PN}-7.1_p1" && show_dss_warning=1
- has_version "<${CATEGORY}/${PN}-7.6_p1" && show_ssh1_warning=1
- has_version "<${CATEGORY}/${PN}-7.7_p1" && show_ldap_warning=1
- has_version "<${CATEGORY}/${PN}-8.2_p1" && show_restart_warning=1
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
}
pkg_postinst() {
- if [[ -n ${show_ecdsa_warning} ]]; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if [[ -n ${show_tcpd_warning} ]]; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if [[ -n ${show_dss_warning} ]]; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if [[ -n ${show_ssh1_warning} ]] ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if [[ -n ${show_ldap_warning} ]]; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
elog "Be aware that by disabling openssl support in openssh, the server and clients"
elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
elog "and update all clients/servers that utilize them."
@@ -472,10 +478,4 @@ pkg_postinst() {
elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
elog ""
fi
-
- if [[ -n ${show_restart_warning} ]]; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-16 18:30 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-16 18:30 UTC (permalink / raw
To: gentoo-commits
commit: a225fe10e4c21edd8915543c2a4318b00d2144c6
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 16 18:29:52 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sun Feb 16 18:30:41 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a225fe10
net-misc/openssh-8.1_p1-r2: Disable X509 and security-key (bug #709808)
This also makes the warning about restarting sshd actually show when it
is intended to. This refactors all version warnings by using a flag
variable set in pkg_preinst to decide whether to show the warning in
pkg_postinst.
Closes: https://bugs.gentoo.org/709808
Bug: https://bugs.gentoo.org/709748
Package-Manager: Portage-2.3.89, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.2_p1-r1.ebuild | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/net-misc/openssh/openssh-8.2_p1-r1.ebuild b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
index 8f034074203..aa9c926b3f7 100644
--- a/net-misc/openssh/openssh-8.2_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
@@ -41,7 +41,7 @@ REQUIRED_USE="
ldns? ( ssl )
pie? ( !static )
static? ( !kerberos !pam )
- X509? ( !sctp ssl )
+ X509? ( !sctp !security-key ssl )
test? ( ssl )
"
@@ -414,18 +414,27 @@ src_install() {
systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
}
+pkg_preinst() {
+ has_version "<${CATEGORY}/${PN}-5.8_p1" && show_ecdsa_warning=1
+ has_version "<${CATEGORY}/${PN}-7.0_p1" && show_tcpd_warning=1
+ has_version "<${CATEGORY}/${PN}-7.1_p1" && show_dss_warning=1
+ has_version "<${CATEGORY}/${PN}-7.6_p1" && show_ssh1_warning=1
+ has_version "<${CATEGORY}/${PN}-7.7_p1" && show_ldap_warning=1
+ has_version "<${CATEGORY}/${PN}-8.2_p1" && show_restart_warning=1
+}
+
pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ if [[ -n ${show_ecdsa_warning} ]]; then
elog "Starting with openssh-5.8p1, the server will default to a newer key"
elog "algorithm (ECDSA). You are encouraged to manually update your stored"
elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ if [[ -n ${show_tcpd_warning} ]]; then
elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
elog "Make sure to update any configs that you might have. Note that xinetd might"
elog "be an alternative for you as it supports USE=tcpd."
fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ if [[ -n ${show_dss_warning} ]]; then #557388 #555518
elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
elog "adding to your sshd_config or ~/.ssh/config files:"
@@ -436,11 +445,11 @@ pkg_postinst() {
elog "to 'prohibit-password'. That means password auth for root users no longer works"
elog "out of the box. If you need this, please update your sshd_config explicitly."
fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ if [[ -n ${show_ssh1_warning} ]] ; then
elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
elog "Furthermore, rsa keys with less than 1024 bits will be refused."
fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ if [[ -n ${show_ldap_warning} ]]; then
elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
elog "if you need to authenticate against LDAP."
@@ -464,7 +473,7 @@ pkg_postinst() {
elog ""
fi
- if has_version "<${CATEGORY}/${PN}-8.2_p1"; then
+ if [[ -n ${show_restart_warning} ]]; then
ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
ewarn "connection is generally safe."
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-16 6:47 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-16 6:47 UTC (permalink / raw
To: gentoo-commits
commit: 3543f68d6fa8cce8c957e02a2aaae79914f40441
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 16 06:43:05 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sun Feb 16 06:46:40 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3543f68d
net-misc/openssh-8.2_p1-r1: ewarn to restart sshd (bug #709748)
Bug: https://bugs.gentoo.org/709748
Package-Manager: Portage-2.3.89, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.2_p1-r1.ebuild | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net-misc/openssh/openssh-8.2_p1-r1.ebuild b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
index 2d64815e3fe..8f034074203 100644
--- a/net-misc/openssh/openssh-8.2_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
@@ -463,4 +463,10 @@ pkg_postinst() {
elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
elog ""
fi
+
+ if has_version "<${CATEGORY}/${PN}-8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-16 6:32 Michał Górny
0 siblings, 0 replies; 441+ messages in thread
From: Michał Górny @ 2020-02-16 6:32 UTC (permalink / raw
To: gentoo-commits
commit: 506304924951e518b37bffe8f51652ebd5495b26
Author: Michał Górny <mgorny <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 16 06:30:33 2020 +0000
Commit: Michał Górny <mgorny <AT> gentoo <DOT> org>
CommitDate: Sun Feb 16 06:30:33 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=50630492
net-misc/openssh: Retab
Signed-off-by: Michał Górny <mgorny <AT> gentoo.org>
net-misc/openssh/metadata.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index c5d93d8392a..6cc1ea78422 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -29,7 +29,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
- <flag name="security-key">Include builtin U2F/FIDO support</flag>
+ <flag name="security-key">Include builtin U2F/FIDO support</flag>
<flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-16 5:57 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-16 5:57 UTC (permalink / raw
To: gentoo-commits
commit: b8b66fe50c20b425cfcfdcf741c41e30152ab394
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 16 05:54:28 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sun Feb 16 05:57:00 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b8b66fe5
net-misc/openssh-8.2_p1-r1: revbump, add "security-key" USE flag
Package-Manager: Portage-2.3.89, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/metadata.xml | 1 +
net-misc/openssh/{openssh-8.2_p1.ebuild => openssh-8.2_p1-r1.ebuild} | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 7613265c18a..c5d93d8392a 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -29,6 +29,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
+ <flag name="security-key">Include builtin U2F/FIDO support</flag>
<flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
diff --git a/net-misc/openssh/openssh-8.2_p1.ebuild b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-8.2_p1.ebuild
rename to net-misc/openssh/openssh-8.2_p1-r1.ebuild
index 5923c13816e..2d64815e3fe 100644
--- a/net-misc/openssh/openssh-8.2_p1.ebuild
+++ b/net-misc/openssh/openssh-8.2_p1-r1.ebuild
@@ -33,7 +33,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp security-key selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
@@ -54,6 +54,7 @@ LIB_DEPEND="
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ security-key? ( dev-libs/libfido2:=[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
ssl? (
!libressl? (
@@ -295,6 +296,7 @@ src_configure() {
$(use_with pam)
$(use_with pie)
$(use_with selinux)
+ $(use_with security-key security-key-builtin)
$(use_with ssl openssl)
$(use_with ssl md5-passwords)
$(use_with ssl ssl-engine)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-08 16:53 David Seifert
0 siblings, 0 replies; 441+ messages in thread
From: David Seifert @ 2020-02-08 16:53 UTC (permalink / raw
To: gentoo-commits
commit: caf163a81c6792973d322b85a9ec822c2a09492d
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 8 16:52:03 2020 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Sat Feb 8 16:52:03 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=caf163a8
net-misc/openssh: [QA] Fix UnnecessarySlashStrip
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 12 ++++++------
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 14 +++++++-------
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 14 +++++++-------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index 7851cc3b95e..98bf001c684 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -98,7 +98,7 @@ pkg_pretend() {
src_prepare() {
sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
pathnames.h || die
# don't break .ssh/authorized_keys2 for fun
@@ -255,13 +255,13 @@ src_configure() {
--with-ldflags="${LDFLAGS}"
--disable-strip
--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
$(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 9064d66d9fb..828c4a17b8e 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -110,7 +110,7 @@ pkg_pretend() {
src_prepare() {
sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
pathnames.h || die
# don't break .ssh/authorized_keys2 for fun
@@ -279,17 +279,17 @@ src_configure() {
--with-ldflags="${LDFLAGS}"
--disable-strip
--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
$(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index 0b6e431f7e9..1b1d9363437 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -111,7 +111,7 @@ pkg_pretend() {
src_prepare() {
sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
pathnames.h || die
# don't break .ssh/authorized_keys2 for fun
@@ -281,17 +281,17 @@ src_configure() {
--with-ldflags="${LDFLAGS}"
--disable-strip
--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
$(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-07 3:41 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-07 3:41 UTC (permalink / raw
To: gentoo-commits
commit: 49d190feecfdbebcbef1e7c419a42574e6e30b62
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Fri Feb 7 03:38:37 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Feb 7 03:41:12 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49d190fe
net-misc/openssh-8.1_p1-r2: Add dep on virtual/libxcrypt
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 1 +
1 file changed, 1 insertion(+)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index e4e4a8054b5..057f482b572 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -71,6 +71,7 @@ LIB_DEPEND="
)
libressl? ( dev-libs/libressl:0=[static-libs(+)] )
)
+ virtual/libcrypt:=[static-libs(+)]
>=sys-libs/zlib-1.2.3:=[static-libs(+)]
"
RDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-06 21:45 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2020-02-06 21:45 UTC (permalink / raw
To: gentoo-commits
commit: f1e466079d6e6a481562d1ca132728ce86f611dd
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 6 21:44:41 2020 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Thu Feb 6 21:45:01 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1e46607
net-misc/openssh: inherit user-info
Package-Manager: Portage-2.3.86_p1, Repoman-2.3.20_p43
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 3 +--
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index c03912331c5..0b6e431f7e9 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -3,8 +3,7 @@
EAPI=6
-# user.eclass needed for egetshell
-inherit user eapi7-ver flag-o-matic multilib autotools pam systemd
+inherit user-info eapi7-ver flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index 510243d6172..e4e4a8054b5 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -3,8 +3,7 @@
EAPI=7
-# user.eclass needed for egetshell
-inherit user flag-o-matic multilib autotools pam systemd
+inherit user-info flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-05 19:36 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-05 19:36 UTC (permalink / raw
To: gentoo-commits
commit: a0e8fe5cd67fa5bafbe878c13a2b7beeb08f2b3a
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Feb 5 19:35:52 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 19:36:15 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0e8fe5c
net-misc/openssh: Inherit user.eclass for egetshell (bug #708366)
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 3 ++-
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index 2acc872e9cc..c03912331c5 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -3,7 +3,8 @@
EAPI=6
-inherit eapi7-ver flag-o-matic multilib autotools pam systemd
+# user.eclass needed for egetshell
+inherit user eapi7-ver flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index fe7b7fb1bb4..510243d6172 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -3,7 +3,8 @@
EAPI=7
-inherit flag-o-matic multilib autotools pam systemd
+# user.eclass needed for egetshell
+inherit user flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-05 3:02 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-05 3:02 UTC (permalink / raw
To: gentoo-commits
commit: f75f34c03ffcd96a36fa66a1d1c883b4290e82a8
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Feb 5 03:00:11 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 03:01:54 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f75f34c0
net-misc/openssh-8.1_p1-r2: Fix CI issues
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r2.ebuild | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r2.ebuild b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
index ca1b4c29ccf..fe7b7fb1bb4 100644
--- a/net-misc/openssh/openssh-8.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r2.ebuild
@@ -121,7 +121,7 @@ pkg_pretend() {
src_prepare() {
sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
pathnames.h || die
# don't break .ssh/authorized_keys2 for fun
@@ -283,17 +283,17 @@ src_configure() {
--with-ldflags="${LDFLAGS}"
--disable-strip
--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
$(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
# We apply the sctp patch conditionally, so can't pass --without-sctp
# unconditionally else we get unknown flag warnings.
$(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
+ $(use_with ldns ldns "${EPREFIX}"/usr)
$(use_with libedit)
$(use_with pam)
$(use_with pie)
@@ -355,7 +355,7 @@ tweak_ssh_configs() {
)
# First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
# Allow client to pass locale environment variables. #367017
AcceptEnv ${locale_vars[*]}
@@ -365,7 +365,7 @@ tweak_ssh_configs() {
EOF
# Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
# Send locale environment variables. #367017
SendEnv ${locale_vars[*]}
@@ -380,13 +380,13 @@ tweak_ssh_configs() {
-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
+ "${ED}"/etc/ssh/sshd_config || die
fi
if use livecd ; then
sed -i \
-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
+ "${ED}"/etc/ssh/sshd_config || die
fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-05 3:02 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-05 3:02 UTC (permalink / raw
To: gentoo-commits
commit: 1be7ad147bad2fc96728508ba96aa07ae6927295
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Feb 5 03:01:45 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 03:01:55 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1be7ad14
net-misc/openssh-8.0_p1-r4: Actually migrate to GLEP 81
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index 2da7dba8cbc..2acc872e9cc 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -413,11 +413,6 @@ src_install() {
systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
}
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
pkg_postinst() {
if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
elog "Starting with openssh-5.8p1, the server will default to a newer key"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-05 1:55 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-05 1:55 UTC (permalink / raw
To: gentoo-commits
commit: 4fecc27cb2f862b62e359ccc416777828bac7cc5
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Feb 5 01:48:30 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 01:54:52 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4fecc27c
net-misc/openssh-8.0_p1-r4: fix tests in 2020, move to GLEP 81
Bug: https://bugs.gentoo.org/703016
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index 3440c3c9a7a..2da7dba8cbc 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=6
-inherit user eapi7-ver flag-o-matic multilib autotools pam systemd
+inherit eapi7-ver flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
@@ -67,6 +67,8 @@ LIB_DEPEND="
)
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )"
@@ -123,6 +125,7 @@ src_prepare() {
eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
eapply "${FILESDIR}"/${PN}-8.0_p1-fix-integer-overflow-in-XMSS-private-key-parsing.patch
eapply "${FILESDIR}"/${PN}-8.0_p1-fix-an-unreachable-integer-overflow-similar-to-the-XMSS-case.patch
+ eapply "${FILESDIR}"/${PN}-8.1_p1-tests-2020.patch
use X509 || eapply "${FILESDIR}"/${PN}-8.0_p1-tests.patch
[[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2020-02-05 1:55 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2020-02-05 1:55 UTC (permalink / raw
To: gentoo-commits
commit: c4cd89c0abb3b416b746bcdbaac9d92e15dcb3be
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Feb 5 01:49:27 2020 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 01:55:13 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4cd89c0
net-misc/openssh-8.1_p1-r1: Remove old
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.87, Repoman-2.3.20
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r1.ebuild | 463 ------------------------------
1 file changed, 463 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r1.ebuild b/net-misc/openssh/openssh-8.1_p1-r1.ebuild
deleted file mode 100644
index 2469a92fb87..00000000000
--- a/net-misc/openssh/openssh-8.1_p1-r1.ebuild
+++ /dev/null
@@ -1,463 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit user flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/os-headers"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-BDEPEND="
- virtual/pkgconfig
- sys-devel/autoconf"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.1_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" &>/dev/null || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- popd &>/dev/null || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-$(ver_cut 1-2 ${X509_VER})-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}" &>/dev/null || die
- eapply "${FILESDIR}"/${PN}-8.1_p1-hpn-glue.patch
- if use X509; then
- einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # X509 and AES-CTR-MT don't get along, let's just drop it
- rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-7.9_p1-hpn-sctp-glue.patch
- popd &>/dev/null || die
-
- eapply "${hpn_patchdir}"
-
- if ! use X509; then
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
- eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
- fi
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-17 13:40 Alexis Ballier
0 siblings, 0 replies; 441+ messages in thread
From: Alexis Ballier @ 2019-10-17 13:40 UTC (permalink / raw
To: gentoo-commits
commit: 4c52ec2b9caf71306aaf379c0874991098af9174
Author: Alexis Ballier <aballier <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 17 13:39:07 2019 +0000
Commit: Alexis Ballier <aballier <AT> gentoo <DOT> org>
CommitDate: Thu Oct 17 13:40:19 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c52ec2b
net-misc/openssh: improve EAPI7 deps.
pkgconfig and autoconf are certainly BDEPEND.
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Alexis Ballier <aballier <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1-r1.ebuild | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1-r1.ebuild b/net-misc/openssh/openssh-8.1_p1-r1.ebuild
index f91cb6093e5..2469a92fb87 100644
--- a/net-misc/openssh/openssh-8.1_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1-r1.ebuild
@@ -72,13 +72,14 @@ RDEPEND="
kerberos? ( virtual/krb5 )"
DEPEND="${RDEPEND}
static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
+ virtual/os-headers"
RDEPEND="${RDEPEND}
pam? ( >=sys-auth/pambase-20081028 )
userland_GNU? ( virtual/shadow )
X? ( x11-apps/xauth )"
+BDEPEND="
+ virtual/pkgconfig
+ sys-devel/autoconf"
S="${WORKDIR}/${PARCH}"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-12 19:18 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-10-12 19:18 UTC (permalink / raw
To: gentoo-commits
commit: c35d4ec292fc7e5d39c9b3f5bebc75a54b7da427
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 12 19:18:31 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat Oct 12 19:18:31 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c35d4ec2
net-misc/openssh: migrate to sys-libs/pam
Package-Manager: Portage-2.3.76, Repoman-2.3.16
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r4.ebuild | 4 ++--
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 4 ++--
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-8.1_p1.ebuild | 2 +-
5 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
index 1c8a750ca7b..4b4ae5463ae 100644
--- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2019 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="5"
@@ -56,7 +56,7 @@ LIB_DEPEND="
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
+ pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )
ldap? ( net-nds/openldap )"
DEPEND="${RDEPEND}
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index bd32d2c254e..d949654c69e 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2019 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="6"
@@ -57,7 +57,7 @@ LIB_DEPEND="
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
+ pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )"
DEPEND="${RDEPEND}
static? ( ${LIB_DEPEND} )
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 456142ced12..6f95e59ac4b 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -69,7 +69,7 @@ LIB_DEPEND="
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
+ pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )"
DEPEND="${RDEPEND}
static? ( ${LIB_DEPEND} )
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index 1fbed359886..5393ca2b81d 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -68,7 +68,7 @@ LIB_DEPEND="
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
+ pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )"
DEPEND="${RDEPEND}
static? ( ${LIB_DEPEND} )
diff --git a/net-misc/openssh/openssh-8.1_p1.ebuild b/net-misc/openssh/openssh-8.1_p1.ebuild
index f5663b7bd2c..b75fb6f1a88 100644
--- a/net-misc/openssh/openssh-8.1_p1.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1.ebuild
@@ -68,7 +68,7 @@ LIB_DEPEND="
>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
RDEPEND="
!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
+ pam? ( sys-libs/pam )
kerberos? ( virtual/krb5 )"
DEPEND="${RDEPEND}
static? ( ${LIB_DEPEND} )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-11 23:53 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2019-10-11 23:53 UTC (permalink / raw
To: gentoo-commits
commit: d021e8d3f2167e06e9d70667ceee30a5f3235959
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 11 23:53:05 2019 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Fri Oct 11 23:53:05 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d021e8d3
net-misc/openssh: Fixup some minor CI complaints in 8.1_p1
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-8.1_p1.ebuild | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.1_p1.ebuild b/net-misc/openssh/openssh-8.1_p1.ebuild
index edc1b5697ee..f5663b7bd2c 100644
--- a/net-misc/openssh/openssh-8.1_p1.ebuild
+++ b/net-misc/openssh/openssh-8.1_p1.ebuild
@@ -101,9 +101,9 @@ pkg_pretend() {
fi
# Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-09 20:39 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-10-09 20:39 UTC (permalink / raw
To: gentoo-commits
commit: 4c16aa18318891f1224dba19390ae85e22bde6f0
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 9 20:39:25 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Oct 9 20:39:43 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c16aa18
net-misc/openssh: security cleanup
Bug: https://bugs.gentoo.org/697046
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-8.0_p1-r3.ebuild | 463 ------------------------------
2 files changed, 464 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index bd50ff4493c..fb6e51679b2 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -14,7 +14,6 @@ DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
DIST openssh-8.0p1+x509-12.1-gentoo.diff.gz 680853 BLAKE2B b24ee61d6328bf2de8384d6ecbfc5ae0be4719a3c7a2d714be3a144d327bba5038e7e36ffcc313af2a8a94960ce1f56387654d2d21920af51826af61957aa4cc SHA512 178728139473b277fe50a03f37be50b3f8e539cea8f5937ddfe710082944e799d845cdb5994f585c13564c4a89b80ccf75e87753102aebacdb4c590f0b8a1482
-DIST openssh-8.0p1+x509-12.1.diff.gz 680389 BLAKE2B b1e353c496dd6dbd104c32bc5e9a3f055673a7876944d39c80f185cdb589d09b8d509754f04f2e051ceef2b39a3d810ba00b8894a4b67c7a6a0170a4ed0518a5 SHA512 831988d636a19e89a881616e07e38bc6ca44e90443b2bbf290fab3f120877e2eef60f21ad6e0c64098d07e09379f9f73f0ce2e5df975aa1bd43944582f8b8b3e
DIST openssh-8.0p1-sctp-1.2.patch.xz 7348 BLAKE2B bc3d3815f1ef5dbab605b93182a00c2fec258f49d56684defb6564d2b60886429c615a7ab076cc071a590f9df0908b1862ceb0961b7e6f6d1090237fec9035d3 SHA512 2f9f774286db75d0240e6fb01655a8a193fb2a5dc4596ad68ed22d64f97c9c46dad61a06478f2e972fd37cbad4d9aca5829bb91097cc56638601ff94a972b24f
DIST openssh-8.0p1.tar.gz 1597697 BLAKE2B 5ba79872eabb3b3964d95a8cdd690bfe0323f018d7f944d4e1acb52576c9f6d7a1ddac15e88dc42eac6ecbfabfad1c228e303a2262588769e307c38107a4cd54 SHA512 e280fa2d56f550efd37c5d2477670326261aa8b94d991f9eb17aad90e0c6c9c939efa90fe87d33260d0f709485cb05c379f0fd1bd44fc0d5190298b6398c9982
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
diff --git a/net-misc/openssh/openssh-8.0_p1-r3.ebuild b/net-misc/openssh/openssh-8.0_p1-r3.ebuild
deleted file mode 100644
index 9dfce4329c2..00000000000
--- a/net-misc/openssh/openssh-8.0_p1-r3.ebuild
+++ /dev/null
@@ -1,463 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user eapi7-ver flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
- use X509 || eapply "${FILESDIR}"/${PN}-8.0_p1-tests.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- eapply "${FILESDIR}/${P}-X509-dont-make-piddir-"${X509_VER}".patch"
- popd || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-$(ver_cut 1-2 ${X509_VER})-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}"
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-glue.patch
- if use X509; then
- einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # X509 and AES-CTR-MT don't get along, let's just drop it
- rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-7.9_p1-hpn-sctp-glue.patch
- popd
-
- eapply "${hpn_patchdir}"
-
- if ! use X509; then
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
- eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
- fi
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-09 20:39 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-10-09 20:39 UTC (permalink / raw
To: gentoo-commits
commit: 16a48f47227819cfb092a2579f6c4ba50a5dedcf
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 9 20:38:39 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Oct 9 20:39:42 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16a48f47
net-misc/openssh: move stable keywords
Bug: https://bugs.gentoo.org/697046
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r4.ebuild b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
index bb9b0b1209e..77b83fd3629 100644
--- a/net-misc/openssh/openssh-8.0_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r4.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-08 16:06 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-10-08 16:06 UTC (permalink / raw
To: gentoo-commits
commit: a7e4c46578eaafc47e2a090fa0d406c14a66d268
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 8 15:50:48 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Oct 8 15:50:48 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a7e4c465
net-misc/openssh: drop old
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 462 ------------------------------
net-misc/openssh/openssh-8.0_p1.ebuild | 461 -----------------------------
3 files changed, 924 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 748766fdb61..d6d9347cc46 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -13,7 +13,6 @@ DIST openssh-7.9p1-sctp-1.2.patch.xz 7360 BLAKE2B 60e209371ecac24d0b60e48459d4d4
DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b6c00c1e5bd7207bb6d6bf6df0b2e057c1b1de0fee709f58dd159203fdd69fe1473118a6baedebaa0c1c4c55b59 SHA512 0412c9c429c9287f0794023951469c8e6ec833cdb55821bfa0300dd90d0879ff60484f620cffd93372641ab69bf0b032c2d700ccc680950892725fb631b7708e
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
-DIST openssh-8.0p1+x509-12.0.diff.gz 623765 BLAKE2B b1c0d533a58c55b0f8451ce5aa8ee9b462afdc1eee44018f30962d3427c73b12a57c2c88bc8656c09c2b39a2ac72755539eeb29e7060ced5d3e8470647f88c0a SHA512 5f678fd303e39df7a2fb23af682c5a02b33f7fdcafe6171b9db2067098a2048677c415c3bee75225eb9fbaf308cfac7f37b0865951cdb6dda0577908499a8295
DIST openssh-8.0p1+x509-12.1.diff.gz 680389 BLAKE2B b1e353c496dd6dbd104c32bc5e9a3f055673a7876944d39c80f185cdb589d09b8d509754f04f2e051ceef2b39a3d810ba00b8894a4b67c7a6a0170a4ed0518a5 SHA512 831988d636a19e89a881616e07e38bc6ca44e90443b2bbf290fab3f120877e2eef60f21ad6e0c64098d07e09379f9f73f0ce2e5df975aa1bd43944582f8b8b3e
DIST openssh-8.0p1-sctp-1.2.patch.xz 7348 BLAKE2B bc3d3815f1ef5dbab605b93182a00c2fec258f49d56684defb6564d2b60886429c615a7ab076cc071a590f9df0908b1862ceb0961b7e6f6d1090237fec9035d3 SHA512 2f9f774286db75d0240e6fb01655a8a193fb2a5dc4596ad68ed22d64f97c9c46dad61a06478f2e972fd37cbad4d9aca5829bb91097cc56638601ff94a972b24f
DIST openssh-8.0p1.tar.gz 1597697 BLAKE2B 5ba79872eabb3b3964d95a8cdd690bfe0323f018d7f944d4e1acb52576c9f6d7a1ddac15e88dc42eac6ecbfabfad1c228e303a2262588769e307c38107a4cd54 SHA512 e280fa2d56f550efd37c5d2477670326261aa8b94d991f9eb17aad90e0c6c9c939efa90fe87d33260d0f709485cb05c379f0fd1bd44fc0d5190298b6398c9982
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
deleted file mode 100644
index c0a1abeb359..00000000000
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ /dev/null
@@ -1,462 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user eapi7-ver flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 ~arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- use X509 || eapply "${FILESDIR}"/${PN}-8.0_p1-tests.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" || die
- eapply "${FILESDIR}/${P}-X509-glue-"${X509_VER}".patch"
- eapply "${FILESDIR}/${P}-X509-dont-make-piddir-"${X509_VER}".patch"
- popd || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-$(ver_cut 1-2 ${X509_VER})-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}"
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-glue.patch
- if use X509; then
- einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # X509 and AES-CTR-MT don't get along, let's just drop it
- rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-7.9_p1-hpn-sctp-glue.patch
- popd
-
- eapply "${hpn_patchdir}"
-
- if ! use X509; then
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
- eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
- fi
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-8.0_p1.ebuild b/net-misc/openssh/openssh-8.0_p1.ebuild
deleted file mode 100644
index c468c3f26f8..00000000000
--- a/net-misc/openssh/openssh-8.0_p1.ebuild
+++ /dev/null
@@ -1,461 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="12.0" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-8.0_p1-tests.patch
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" || die
- eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
- eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
- popd || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}"
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-glue.patch
- if use X509; then
- einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- # X509 and AES-CTR-MT don't get along, let's just drop it
- rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
- eapply "${FILESDIR}"/${PN}-8.0_p1-hpn-X509-glue.patch
- fi
- use sctp && eapply "${FILESDIR}"/${PN}-7.9_p1-hpn-sctp-glue.patch
- popd
-
- eapply "${hpn_patchdir}"
-
- if ! use X509; then
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
- eapply "${FILESDIR}/openssh-8.0_p1-hpn-version.patch"
- fi
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns ldns "${EPREFIX%/}"/usr)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86 and ppc
- use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" SUDO="" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-10-08 16:06 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-10-08 16:06 UTC (permalink / raw
To: gentoo-commits
commit: b013540990395e21715894f064343e2395781c25
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 8 15:49:59 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Oct 8 15:49:59 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b0135409
net-misc/openssh: arm/m68k/sh stable
Forced stabilization due to bug 696950.
Closes: https://bugs.gentoo.org/691932
Bug: https://bugs.gentoo.org/696950
Package-Manager: Portage-2.3.76, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r3.ebuild b/net-misc/openssh/openssh-8.0_p1-r3.ebuild
index a8b2c56c2ee..9dfce4329c2 100644
--- a/net-misc/openssh/openssh-8.0_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r3.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-09-25 15:43 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-09-25 15:43 UTC (permalink / raw
To: gentoo-commits
commit: 73877ff9e057b8c7a0d1218071fbb01ade294d60
Author: Sergey Alirzaev <zl29ah <AT> gmail <DOT> com>
AuthorDate: Wed Sep 25 13:44:54 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Sep 25 15:43:25 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=73877ff9
net-misc/openssh: add optional support for XMSS key algorithm
Signed-off-by: Sergey Alirzaev <zl29ah <AT> gmail.com>
Closes: https://github.com/gentoo/gentoo/pull/13037
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/metadata.xml | 1 +
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 29134fc060d..7613265c18a 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -32,6 +32,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
+ <flag name="xmss">Enable XMSS post-quantum authentication algorithm</flag>
</use>
<upstream>
<remote-id type="cpe">cpe:/a:openssh:openssh</remote-id>
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index a0936dbd331..c0a1abeb359 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -34,7 +34,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="alpha amd64 ~arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509 xmss"
RESTRICT="!test? ( test )"
REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
@@ -267,6 +267,7 @@ src_configure() {
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
local myconf=(
--with-ldflags="${LDFLAGS}"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-14 18:07 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2019-08-14 18:07 UTC (permalink / raw
To: gentoo-commits
commit: b0c829b10b3278c999e714cd1286d46c667ede4f
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Wed Aug 14 16:21:25 2019 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Wed Aug 14 18:07:23 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b0c829b1
net-misc/openssh: stable 8.0_p1-r2 for hppa, bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 9ab59efeb11..a0936dbd331 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-14 7:34 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-14 7:34 UTC (permalink / raw
To: gentoo-commits
commit: a443e963b156d237a088a2f81dde89b0079d57b9
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 14 07:34:25 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Aug 14 07:34:25 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a443e963
net-misc/openssh: alpha stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="alpha"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 856d7825e8a..9ab59efeb11 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-13 13:51 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-13 13:51 UTC (permalink / raw
To: gentoo-commits
commit: 8f4a733727f8fef05909f16a250e706783502ff2
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 13 13:51:03 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 13 13:51:03 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f4a7337
net-misc/openssh: ia64 stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 6549204f747..856d7825e8a 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-13 11:49 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-13 11:49 UTC (permalink / raw
To: gentoo-commits
commit: 2fd6ff703f68a4c88f2e1a8868124dfb4c95659c
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 13 11:49:37 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 13 11:49:37 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2fd6ff70
net-misc/openssh: ppc64 stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="ppc64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 7cc0bfdb3b3..6549204f747 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-13 11:40 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-13 11:40 UTC (permalink / raw
To: gentoo-commits
commit: cc7ccc63b46ba3ea6764b484bfb508441c66b7db
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 13 11:40:30 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 13 11:40:30 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cc7ccc63
net-misc/openssh: ppc stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index fe41b1a33bd..7cc0bfdb3b3 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-13 10:59 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-13 10:59 UTC (permalink / raw
To: gentoo-commits
commit: a3c3ed82c018f87f686a2679bb6c2610aeb7af37
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 13 10:59:25 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 13 10:59:25 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a3c3ed82
net-misc/openssh: sparc stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index d3489c792b4..fe41b1a33bd 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-13 8:21 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-13 8:21 UTC (permalink / raw
To: gentoo-commits
commit: 6c085d20b307e53d75f1c65ff9890c0e3e720110
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 13 08:21:00 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 13 08:21:00 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c085d20
net-misc/openssh: s390 stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="s390"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 68aa596206e..d3489c792b4 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-12 9:11 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2019-08-12 9:11 UTC (permalink / raw
To: gentoo-commits
commit: b6b1b5d22c6ba9cd9489283b8736ede5b098ce0c
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 12 09:11:29 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Aug 12 09:11:29 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b6b1b5d2
net-misc/openssh: amd64 stable wrt bug #691932
Package-Manager: Portage-2.3.69, Repoman-2.3.16
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index 4a82be52628..68aa596206e 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-11 21:30 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-08-11 21:30 UTC (permalink / raw
To: gentoo-commits
commit: 74c5a25426727933aadee8b2b7ab69a77cca453a
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 11 20:25:32 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Aug 11 21:28:42 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=74c5a254
net-misc/openssh: x86 stable (bug #691932)
Package-Manager: Portage-2.3.71, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index ff2c960a0f0..4a82be52628 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-08-11 21:27 Aaron Bauman
0 siblings, 0 replies; 441+ messages in thread
From: Aaron Bauman @ 2019-08-11 21:27 UTC (permalink / raw
To: gentoo-commits
commit: 1861f7cec94425fe791e5fc1d8d09a0d44224a76
Author: Aaron Bauman <bman <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 11 21:26:48 2019 +0000
Commit: Aaron Bauman <bman <AT> gentoo <DOT> org>
CommitDate: Sun Aug 11 21:26:48 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1861f7ce
net-misc/openssh: arm64 stable (bug #691932)
Signed-off-by: Aaron Bauman <bman <AT> gentoo.org>
Package-Manager: Portage-2.3.71, Repoman-2.3.17
RepoMan-Options: --include-arches="arm64"
net-misc/openssh/openssh-8.0_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r2.ebuild b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
index ef7bd3481fd..ff2c960a0f0 100644
--- a/net-misc/openssh/openssh-8.0_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r2.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-05-04 17:00 Anthony G. Basile
0 siblings, 0 replies; 441+ messages in thread
From: Anthony G. Basile @ 2019-05-04 17:00 UTC (permalink / raw
To: gentoo-commits
commit: e3278c05c4781b31b185b6d8daa0d3e65e413521
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sat May 4 17:00:10 2019 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sat May 4 17:00:10 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3278c05
net-misc/openssh: stackprotector is broken on musl ppc
Signed-off-by: Anthony G. Basile <blueness <AT> gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 4 ++--
net-misc/openssh/openssh-8.0_p1-r1.ebuild | 4 ++--
net-misc/openssh/openssh-8.0_p1.ebuild | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 22614b8fc65..de21ccc51cb 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -300,8 +300,8 @@ src_configure() {
$(use_with !elibc_Cygwin hardening) #659210
)
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+ # stackprotect is broken on musl x86 and ppc
+ use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
diff --git a/net-misc/openssh/openssh-8.0_p1-r1.ebuild b/net-misc/openssh/openssh-8.0_p1-r1.ebuild
index b0bcb15646d..c541630005b 100644
--- a/net-misc/openssh/openssh-8.0_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r1.ebuild
@@ -293,8 +293,8 @@ src_configure() {
$(use_with !elibc_Cygwin hardening) #659210
)
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+ # stackprotect is broken on musl x86 and ppc
+ use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
diff --git a/net-misc/openssh/openssh-8.0_p1.ebuild b/net-misc/openssh/openssh-8.0_p1.ebuild
index 8c02120a21f..c468c3f26f8 100644
--- a/net-misc/openssh/openssh-8.0_p1.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1.ebuild
@@ -293,8 +293,8 @@ src_configure() {
$(use_with !elibc_Cygwin hardening) #659210
)
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+ # stackprotect is broken on musl x86 and ppc
+ use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-05-04 16:01 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-05-04 16:01 UTC (permalink / raw
To: gentoo-commits
commit: ea0a350d163713b099dac2234c3243a070539501
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat May 4 16:00:51 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat May 4 16:00:51 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea0a350d
net-misc/openssh: Add ~riscv keyword
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11
net-misc/openssh/openssh-8.0_p1-r1.ebuild | 2 +-
net-misc/openssh/openssh-8.0_p1.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-8.0_p1-r1.ebuild b/net-misc/openssh/openssh-8.0_p1-r1.ebuild
index 333774349e2..b0bcb15646d 100644
--- a/net-misc/openssh/openssh-8.0_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1-r1.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
diff --git a/net-misc/openssh/openssh-8.0_p1.ebuild b/net-misc/openssh/openssh-8.0_p1.ebuild
index 20540fe239f..8c02120a21f 100644
--- a/net-misc/openssh/openssh-8.0_p1.ebuild
+++ b/net-misc/openssh/openssh-8.0_p1.ebuild
@@ -32,7 +32,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-04-19 12:52 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-04-19 12:52 UTC (permalink / raw
To: gentoo-commits
commit: c0142d6171216047b9bebe59699f5a0beb54e86d
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 19 12:52:22 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Apr 19 12:52:46 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c0142d61
net-misc/openssh: respin SCTP patch for openssh-8.0p1
Bug: https://bugs.gentoo.org/683840
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index c71f5ce7b9f..c37252ba192 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -14,6 +14,6 @@ DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
DIST openssh-8.0p1+x509-12.0.diff.gz 623765 BLAKE2B b1c0d533a58c55b0f8451ce5aa8ee9b462afdc1eee44018f30962d3427c73b12a57c2c88bc8656c09c2b39a2ac72755539eeb29e7060ced5d3e8470647f88c0a SHA512 5f678fd303e39df7a2fb23af682c5a02b33f7fdcafe6171b9db2067098a2048677c415c3bee75225eb9fbaf308cfac7f37b0865951cdb6dda0577908499a8295
-DIST openssh-8.0p1-sctp-1.2.patch.xz 7684 BLAKE2B 5d6af23549a152dabf6a54aab5957fd76f0c78528c58896d4265543b121bc4add483fc465876377554041dc88a290dfd7c42fdcc0b55c5509b403a16f0b63989 SHA512 fb0ed1f37b4f26d27e9f09f67a6368b0a277999e514498203bc09483943e5d6b02bca66becc200c7a44eef4d9a9b296b57678fafe390fd7ab3c3b74be380e9bb
+DIST openssh-8.0p1-sctp-1.2.patch.xz 7348 BLAKE2B bc3d3815f1ef5dbab605b93182a00c2fec258f49d56684defb6564d2b60886429c615a7ab076cc071a590f9df0908b1862ceb0961b7e6f6d1090237fec9035d3 SHA512 2f9f774286db75d0240e6fb01655a8a193fb2a5dc4596ad68ed22d64f97c9c46dad61a06478f2e972fd37cbad4d9aca5829bb91097cc56638601ff94a972b24f
DIST openssh-8.0p1.tar.gz 1597697 BLAKE2B 5ba79872eabb3b3964d95a8cdd690bfe0323f018d7f944d4e1acb52576c9f6d7a1ddac15e88dc42eac6ecbfabfad1c228e303a2262588769e307c38107a4cd54 SHA512 e280fa2d56f550efd37c5d2477670326261aa8b94d991f9eb17aad90e0c6c9c939efa90fe87d33260d0f709485cb05c379f0fd1bd44fc0d5190298b6398c9982
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-19 18:20 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2019-03-19 18:20 UTC (permalink / raw
To: gentoo-commits
commit: 130ae7a7b3d72d77559f2ff0304ab3955162f883
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Tue Mar 19 18:19:41 2019 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Tue Mar 19 18:20:07 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=130ae7a7
net-misc/openssh: Fix SRC_URI for hpn in 7.9_p1-r4 (bug 680942)
Closes: https://bugs.gentoo.org/680942
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 13f4df87840..22614b8fc65 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -27,7 +27,7 @@ HOMEPAGE="https://www.openssh.com/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-15 23:21 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-15 23:21 UTC (permalink / raw
To: gentoo-commits
commit: 767cbd46b027c50cb8131c2870163ebdcdaf6a66
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 15 23:20:50 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Fri Mar 15 23:20:50 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=767cbd46
net-misc/openssh: m68k stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11
RepoMan-Options: --include-arches="m68k"
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index d99b60c8f3c..13f4df87840 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-15 23:21 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-15 23:21 UTC (permalink / raw
To: gentoo-commits
commit: 4c0adc8738fba7a32c7752b8583e72945817b380
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 15 23:20:26 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Fri Mar 15 23:20:26 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c0adc87
net-misc/openssh: sh stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11
RepoMan-Options: --include-arches="sh"
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 4eef50cfdfc..d99b60c8f3c 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-15 23:21 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-15 23:21 UTC (permalink / raw
To: gentoo-commits
commit: ac50dc417f5c0435b9e90db0fdfa0fdfa4bea68d
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 15 23:20:07 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Fri Mar 15 23:20:07 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ac50dc41
net-misc/openssh: s390 stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11
RepoMan-Options: --include-arches="s390"
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 0fdfa8edce6..4eef50cfdfc 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-14 8:31 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2019-03-14 8:31 UTC (permalink / raw
To: gentoo-commits
commit: 7bd5063afc3ae17692c92cdb3d7c821f8cd062f1
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 14 08:31:01 2019 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Mar 14 08:31:01 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7bd5063a
net-misc/openssh: stable 7.9_p1-r4 for ia64, bug #675522
Package-Manager: Portage-2.3.62, Repoman-2.3.12
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 9c2a023026c..0fdfa8edce6 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-10 21:38 Matt Turner
0 siblings, 0 replies; 441+ messages in thread
From: Matt Turner @ 2019-03-10 21:38 UTC (permalink / raw
To: gentoo-commits
commit: 242c7261408dd08cc4de8cf9d46fdccb9803421d
Author: Matt Turner <mattst88 <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 21:17:08 2019 +0000
Commit: Matt Turner <mattst88 <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 21:38:12 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=242c7261
net-misc/openssh-7.9_p1-r4: ppc64 stable, bug 675522
Signed-off-by: Matt Turner <mattst88 <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 877a9546ca6..9c2a023026c 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-10 21:38 Matt Turner
0 siblings, 0 replies; 441+ messages in thread
From: Matt Turner @ 2019-03-10 21:38 UTC (permalink / raw
To: gentoo-commits
commit: 2a312de282c04f719bc7acee3bdc6710bfefd12e
Author: Matt Turner <mattst88 <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 21:17:05 2019 +0000
Commit: Matt Turner <mattst88 <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 21:38:11 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2a312de2
net-misc/openssh-7.9_p1-r4: ppc stable, bug 675522
Signed-off-by: Matt Turner <mattst88 <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index e8afb0fe93a..877a9546ca6 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-10 15:36 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-10 15:36 UTC (permalink / raw
To: gentoo-commits
commit: ea7f3eff1d8f5cd9337cc760f9433733aaaa78af
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 15:36:28 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 15:36:45 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea7f3eff
net-misc/openssh: alpha stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="alpha"
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 5d6e37cbc41..e8afb0fe93a 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-10 14:35 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-10 14:35 UTC (permalink / raw
To: gentoo-commits
commit: c83e92119213990d2be8c6d332a13918cd63cc5a
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 14:34:42 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 14:34:42 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c83e9211
net-misc/openssh: arm stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="arm"
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index abb149c6a93..5d6e37cbc41 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-08 23:01 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-08 23:01 UTC (permalink / raw
To: gentoo-commits
commit: 1f439c0c1276f6312acc9c01f3f22f76e01002ab
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 8 23:00:55 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Mar 8 23:00:55 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1f439c0c
net-misc/openssh: drop old
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-7.9_p1-r2.ebuild | 451 ----------------------------
net-misc/openssh/openssh-7.9_p1-r3.ebuild | 468 ------------------------------
3 files changed, 920 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 11a121a2939..d019cc5b6fd 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -9,7 +9,6 @@ DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
DIST openssh-7.9p1+x509-11.6.diff.gz 655819 BLAKE2B f442bb993f89782b74b0cd28906c91edfcf5b1d42a4c8135a5ccf5045e7eb000eb7aa301685b748f707506ba20e3b842d684db436872ed82b6d9b9c086879515 SHA512 0ff6ed2822aaa43cf352134b90975fb663662c5ea3d73b690601f24342ea207aecda8cdb9c1bdc3e3656fb059d842dfb3bf22646b626c303240808286103d8bc
DIST openssh-7.9p1-patches-1.0.tar.xz 9080 BLAKE2B c14106a875b6ea0672a03f6cb292386daba96da23fed4ebd04a75f712e252bc88a25116b0b3b27446421aadf112451cb3b8a96d2f7d437e6728fe782190bc69e SHA512 7903cdb4ce5be0f1b1b741788fb372e68b0c9c1d6da0d854d8bc62e4743ad7cd13101b867b541828d3786b0857783377457e5e87ba9b63bfd9afcdbfd93ac103
-DIST openssh-7.9p1-sctp-1.1.patch.xz 7552 BLAKE2B 0eeda7c8a50c0c98433b5ee0734b9f79043067be376a9ca724d574d4a595c3f7aed0626342300467b73ad9003392e22fda8abe778158ba5be5a50a57eeef79f8 SHA512 6cad32c40dd3901c4eadb0c463a35ec2d901e61220c333d3df7759f672259f66fc83e2b1ace8b0ef84cbc1a65397f00f9c670ffa23726d8309fa5060512d2c21
DIST openssh-7.9p1-sctp-1.2.patch.xz 7360 BLAKE2B 60e209371ecac24d0b60e48459d4d4044c0f364a2eea748cc4edd1501faec69a3c5b9e0b7db336968399ec684b6c8aceeac9196ba1ecf563ae3d660682cbc9a0 SHA512 d4d37a49cd43a3b9b7b173b0935267b84133b9b0954b7f71714ba781a6129c6d424f8b7a528dd7d4f287784c5517d57b1d6d7c6df8b5d738e34eb6dc7eae7191
DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b6c00c1e5bd7207bb6d6bf6df0b2e057c1b1de0fee709f58dd159203fdd69fe1473118a6baedebaa0c1c4c55b59 SHA512 0412c9c429c9287f0794023951469c8e6ec833cdb55821bfa0300dd90d0879ff60484f620cffd93372641ab69bf0b032c2d700ccc680950892725fb631b7708e
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
diff --git a/net-misc/openssh/openssh-7.9_p1-r2.ebuild b/net-misc/openssh/openssh-7.9_p1-r2.ebuild
deleted file mode 100644
index 0b89a756c78..00000000000
--- a/net-misc/openssh/openssh-7.9_p1-r2.ebuild
+++ /dev/null
@@ -1,451 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-HPN_DISABLE_MTAES=1 # unit tests hang on MT-AES-CTR
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- use X509 || eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" || die
- eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
- eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
- popd || die
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}"
- eapply "${FILESDIR}"/${P}-hpn-glue.patch
- use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
- use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
- popd
-
- eapply "${hpn_patchdir}"
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- [[ -d ${WORKDIR}/patch ]] && eapply "${WORKDIR}"/patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.9_p1-r3.ebuild b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
deleted file mode 100644
index f8a2eb14eef..00000000000
--- a/net-misc/openssh/openssh-7.9_p1-r3.ebuild
+++ /dev/null
@@ -1,468 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-#HPN_PV="${PV^^}"
-HPN_PV="7.8_P1"
-
-HPN_VER="14.16"
-HPN_PATCHES=(
- ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
- ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
-)
-
-SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
-
-PATCH_SET="openssh-7.9p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? (
- !libressl? (
- || (
- (
- >=dev-libs/openssl-1.0.1:0[bindist=]
- <dev-libs/openssl-1.1.0:0[bindist=]
- )
- >=dev-libs/openssl-1.1.0g:0[bindist=]
- )
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_VER)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
- eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
- eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- if use X509 ; then
- # patch doesn't apply due to X509 modifications
- rm \
- "${WORKDIR}"/patches/0001-fix-key-type-check.patch \
- "${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
- || die
- else
- eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
- fi
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- pushd "${WORKDIR}" || die
- eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
- eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
- popd || die
-
- if use hpn ; then
- einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
- HPN_DISABLE_MTAES=1
- fi
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
- mkdir "${hpn_patchdir}"
- cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
- pushd "${hpn_patchdir}"
- eapply "${FILESDIR}"/${P}-hpn-glue.patch
- use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
- use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
- popd
-
- eapply "${hpn_patchdir}"
- eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- $(use_with !elibc_Cygwin hardening) #659210
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-08 23:01 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-08 23:01 UTC (permalink / raw
To: gentoo-commits
commit: 223f00033a0f251c39b2c558a1dc1a8649aa588b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 8 23:00:00 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Mar 8 23:00:00 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=223f0003
net-misc/openssh: move sparc keyword
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 6b14828bd1e..abb149c6a93 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-08 19:52 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2019-03-08 19:52 UTC (permalink / raw
To: gentoo-commits
commit: 393b290c9ee7bd0a8dddcc91dce35abc63e398b6
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Fri Mar 8 15:45:18 2019 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Fri Mar 8 19:52:16 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=393b290c
net-misc/openssh: stable 7.9_p1-r4 for hppa, bug #675522
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="hppa"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index f108a54dd01..6b14828bd1e 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-07 22:02 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2019-03-07 22:02 UTC (permalink / raw
To: gentoo-commits
commit: a3ff8e0b71160088caae3676f9f7b6aae5a63ac2
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Thu Mar 7 20:33:06 2019 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Mar 7 22:02:44 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a3ff8e0b
net-misc/openssh: stable 7.9_p1-r3 for sparc, bug #675522
Signed-off-by: Rolf Eike Beer <eike <AT> sf-mail.de>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r3.ebuild b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
index b951023e464..f8a2eb14eef 100644
--- a/net-misc/openssh/openssh-7.9_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-07 21:50 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-07 21:50 UTC (permalink / raw
To: gentoo-commits
commit: 341602749042079aac6da2bc0f2e1fd8323af4d3
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 7 21:43:49 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Mar 7 21:50:15 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=34160274
net-misc/openssh: x86 stable (bug #675522)
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index 932cb4d10fc..f108a54dd01 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-07 15:04 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-07 15:04 UTC (permalink / raw
To: gentoo-commits
commit: 42beaffe286da80f6a2df5edb0df6ad99cb9a1dd
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 7 15:03:28 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Mar 7 15:03:52 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=42beaffe
net-misc/openssh: move stable keywords
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
index deb47d530d3..932cb4d10fc 100644
--- a/net-misc/openssh/openssh-7.9_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-06 23:56 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-06 23:56 UTC (permalink / raw
To: gentoo-commits
commit: 249dd650a66c66d870bf264aa146dad33c23527b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 6 23:11:53 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Mar 6 23:55:55 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=249dd650
net-misc/openssh: fix ldns overlinking when LibreSSL is used
Link: https://svnweb.freebsd.org/ports?view=revision&revision=452358
Bug: https://bugs.gentoo.org/621428
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r4.ebuild | 468 ++++++++++++++++++++++++++++++
1 file changed, 468 insertions(+)
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
new file mode 100644
index 00000000000..1c475e825c0
--- /dev/null
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -0,0 +1,468 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+#HPN_PV="${PV^^}"
+HPN_PV="7.8_P1"
+
+HPN_VER="14.16"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+PATCH_SET="openssh-7.9p1-patches-1.0"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ || (
+ (
+ >=dev-libs/openssl-1.0.1:0[bindist=]
+ <dev-libs/openssl-1.1.0:0[bindist=]
+ )
+ >=dev-libs/openssl-1.1.0g:0[bindist=]
+ )
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ if use X509 ; then
+ # patch doesn't apply due to X509 modifications
+ rm \
+ "${WORKDIR}"/patches/0001-fix-key-type-check.patch \
+ "${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
+ || die
+ else
+ eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
+ fi
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" || die
+ eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
+ eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
+ popd || die
+
+ if use hpn ; then
+ einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
+ HPN_DISABLE_MTAES=1
+ fi
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}"
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
+ pushd "${hpn_patchdir}"
+ eapply "${FILESDIR}"/${P}-hpn-glue.patch
+ use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
+ popd
+
+ eapply "${hpn_patchdir}"
+ eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns ldns "${EPREFIX%/}"/usr)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-06 19:45 Mart Raudsepp
0 siblings, 0 replies; 441+ messages in thread
From: Mart Raudsepp @ 2019-03-06 19:45 UTC (permalink / raw
To: gentoo-commits
commit: b0447d46de1cbd07a6c39bb1d4ab3ac461f7ad76
Author: Mart Raudsepp <leio <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 6 19:44:30 2019 +0000
Commit: Mart Raudsepp <leio <AT> gentoo <DOT> org>
CommitDate: Wed Mar 6 19:45:02 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b0447d46
net-misc/openssh: arm64 stable (bug #675522)
Package-Manager: Portage-2.3.52, Repoman-2.3.12
Signed-off-by: Mart Raudsepp <leio <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r3.ebuild b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
index 1aabd10c02c..b951023e464 100644
--- a/net-misc/openssh/openssh-7.9_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-06 14:47 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2019-03-06 14:47 UTC (permalink / raw
To: gentoo-commits
commit: 4e13900c650b109391468f8c7e931711ad0adce2
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 6 14:47:08 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Wed Mar 6 14:47:08 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e13900c
net-misc/openssh: amd64 stable wrt bug #675522
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="amd64"
net-misc/openssh/openssh-7.9_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r3.ebuild b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
index ce31e554fdf..1aabd10c02c 100644
--- a/net-misc/openssh/openssh-7.9_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
@@ -33,7 +33,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-03-03 2:46 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2019-03-03 2:46 UTC (permalink / raw
To: gentoo-commits
commit: 40935d5171a88ca21159ee9db7c2d780b4473a22
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 3 02:46:29 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Mar 3 02:46:41 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40935d51
net-misc/openssh: add some patches, including CVE-2019-6111
Bug: https://bugs.gentoo.org/show_bug.cgi?id=675522
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 2 +
net-misc/openssh/openssh-7.9_p1-r3.ebuild | 468 ++++++++++++++++++++++++++++++
2 files changed, 470 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index e0c1d3402c2..42d69025fbd 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -12,7 +12,9 @@ DIST openssh-7.8p1-sctp-1.1.patch.xz 7548 BLAKE2B d74010028f097812f554f9e788aa5e
DIST openssh-7.8p1.tar.gz 1548026 BLAKE2B 938428408596d24d497f245e3662a0cff3d462645683bf75cd29a0ea56fa6c280e7fa866bedf0928dd5bc4085b82d5a4ce74b7eea0b45b86f879b69f74db1642 SHA512 8e5b0c8682a9243e4e8b7c374ec989dccd1a752eb6f84e593b67141e8b23dcc8b9a7322b1f7525d18e2ce8830a767d0d9793f997486339db201a57986b910705
DIST openssh-7.9p1+x509-11.5.diff.gz 594995 BLAKE2B 2c44df224e4114da0473cbbdfdcc4bd84b0b0235f80b43517d70fe1071f219d2631f784015ab1470eebcf8f3b6b5f8744862acebb22f217c6e76f79e6a49c099 SHA512 4d2fd950dee9721add822fdb54ff8c20fd18da85081ce8a2bd2a1050d3ff7900a7213782c479691de9dcfe4e2f91061e124d34b365edb3831e8bfe4aef3744f9
DIST openssh-7.9p1+x509-11.6.diff.gz 655819 BLAKE2B f442bb993f89782b74b0cd28906c91edfcf5b1d42a4c8135a5ccf5045e7eb000eb7aa301685b748f707506ba20e3b842d684db436872ed82b6d9b9c086879515 SHA512 0ff6ed2822aaa43cf352134b90975fb663662c5ea3d73b690601f24342ea207aecda8cdb9c1bdc3e3656fb059d842dfb3bf22646b626c303240808286103d8bc
+DIST openssh-7.9p1-patches-1.0.tar.xz 9080 BLAKE2B c14106a875b6ea0672a03f6cb292386daba96da23fed4ebd04a75f712e252bc88a25116b0b3b27446421aadf112451cb3b8a96d2f7d437e6728fe782190bc69e SHA512 7903cdb4ce5be0f1b1b741788fb372e68b0c9c1d6da0d854d8bc62e4743ad7cd13101b867b541828d3786b0857783377457e5e87ba9b63bfd9afcdbfd93ac103
DIST openssh-7.9p1-sctp-1.1.patch.xz 7552 BLAKE2B 0eeda7c8a50c0c98433b5ee0734b9f79043067be376a9ca724d574d4a595c3f7aed0626342300467b73ad9003392e22fda8abe778158ba5be5a50a57eeef79f8 SHA512 6cad32c40dd3901c4eadb0c463a35ec2d901e61220c333d3df7759f672259f66fc83e2b1ace8b0ef84cbc1a65397f00f9c670ffa23726d8309fa5060512d2c21
+DIST openssh-7.9p1-sctp-1.2.patch.xz 7360 BLAKE2B 60e209371ecac24d0b60e48459d4d4044c0f364a2eea748cc4edd1501faec69a3c5b9e0b7db336968399ec684b6c8aceeac9196ba1ecf563ae3d660682cbc9a0 SHA512 d4d37a49cd43a3b9b7b173b0935267b84133b9b0954b7f71714ba781a6129c6d424f8b7a528dd7d4f287784c5517d57b1d6d7c6df8b5d738e34eb6dc7eae7191
DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b6c00c1e5bd7207bb6d6bf6df0b2e057c1b1de0fee709f58dd159203fdd69fe1473118a6baedebaa0c1c4c55b59 SHA512 0412c9c429c9287f0794023951469c8e6ec833cdb55821bfa0300dd90d0879ff60484f620cffd93372641ab69bf0b032c2d700ccc680950892725fb631b7708e
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
diff --git a/net-misc/openssh/openssh-7.9_p1-r3.ebuild b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
new file mode 100644
index 00000000000..ce31e554fdf
--- /dev/null
+++ b/net-misc/openssh/openssh-7.9_p1-r3.ebuild
@@ -0,0 +1,468 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+#HPN_PV="${PV^^}"
+HPN_PV="7.8_P1"
+
+HPN_VER="14.16"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+PATCH_SET="openssh-7.9p1-patches-1.0"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ || (
+ (
+ >=dev-libs/openssl-1.0.1:0[bindist=]
+ <dev-libs/openssl-1.1.0:0[bindist=]
+ )
+ >=dev-libs/openssl-1.1.0g:0[bindist=]
+ )
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ if use X509 ; then
+ # patch doesn't apply due to X509 modifications
+ rm \
+ "${WORKDIR}"/patches/0001-fix-key-type-check.patch \
+ "${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
+ || die
+ else
+ eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
+ fi
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" || die
+ eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
+ eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
+ popd || die
+
+ if use hpn ; then
+ einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
+ HPN_DISABLE_MTAES=1
+ fi
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}"
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
+ pushd "${hpn_patchdir}"
+ eapply "${FILESDIR}"/${P}-hpn-glue.patch
+ use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
+ popd
+
+ eapply "${hpn_patchdir}"
+ eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2019-01-16 1:34 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2019-01-16 1:34 UTC (permalink / raw
To: gentoo-commits
commit: 3b56f7b9d9af55e9718199e1e1a4bc2ea3168000
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Wed Jan 16 01:33:46 2019 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Jan 16 01:33:46 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3b56f7b9
net-misc/openssh: X509 patch already has CVE-2018-20685 fix in 7.9p1
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.55, Repoman-2.3.12
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1-r2.ebuild b/net-misc/openssh/openssh-7.9_p1-r2.ebuild
index 89010a6ace2..0b89a756c78 100644
--- a/net-misc/openssh/openssh-7.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1-r2.ebuild
@@ -118,7 +118,7 @@ src_prepare() {
eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch
+ use X509 || eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch
local PATCHSET_VERSION_MACROS=()
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-12-10 18:45 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2018-12-10 18:45 UTC (permalink / raw
To: gentoo-commits
commit: 5c04bb34d8b47f34fc23941679988edf971a100a
Author: Patrick McLean <patrick.mclean <AT> sony <DOT> com>
AuthorDate: Mon Dec 10 18:45:20 2018 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Mon Dec 10 18:45:20 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5c04bb34
net-misc/openssh: Remove accidental debug code in 7.9_p1
Reported-By: Arfrever Frehtes Taifersar Arahesis
Copyright: Sony Interactive Entertainment Inc.
Package-Manager: Portage-2.3.52, Repoman-2.3.12
Signed-off-by: Patrick McLean <chutzpah <AT> gentoo.org>
net-misc/openssh/openssh-7.9_p1.ebuild | 1 -
1 file changed, 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.9_p1.ebuild b/net-misc/openssh/openssh-7.9_p1.ebuild
index a8cacd6542e..f39686f32b0 100644
--- a/net-misc/openssh/openssh-7.9_p1.ebuild
+++ b/net-misc/openssh/openssh-7.9_p1.ebuild
@@ -391,7 +391,6 @@ src_install() {
systemd_dounit "${FILESDIR}"/sshd.{service,socket}
systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
- ls -la "${D}"/run
}
pkg_preinst() {
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-10-06 22:31 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-10-06 22:31 UTC (permalink / raw
To: gentoo-commits
commit: fbabae323c3a5684c7886cd4a56cb153ef2b2c17
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 6 22:31:32 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sat Oct 6 22:31:32 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fbabae32
Revert "net-misc/openssh: Security cleanup"
This reverts commit 5091fd8f2b5a7cb0d3e970df404446d3aef8f3c7.
<net-misc/openssh-7.6 is still needed for dev-python/twisted.
Bug: https://bugs.gentoo.org/661258
Bug: https://bugs.gentoo.org/664264
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-misc/openssh/Manifest | 5 +
net-misc/openssh/metadata.xml | 2 +
net-misc/openssh/openssh-7.5_p1-r4.ebuild | 334 ++++++++++++++++++++++++++++++
3 files changed, 341 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 86994d17c7d..73d61beed4a 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,3 +1,7 @@
+DIST openssh-7.4_p1-sctp.patch.xz 8220 BLAKE2B 2d571cacaab342b7950b42ec826bd896edf78780e9ee73fcd441cbc9764eb59e408e295062862db986918824d10498383bf34ae7c93df0da2c056eaec4d2c031 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4
+DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc266d1a450d298563bfc6ce705ec2829b8f9d91af5c5232941d55004b5aea2d3e0fb682a9d4acd9510c9761ba7ede2f2f0e37f SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a
+DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
+DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
DIST openssh-7.7p1-patches-1.2.tar.xz 17584 BLAKE2B 192ec01906c911197abec4606cdf136cf26ac4ab4c405267cd98bafaea409d9d596b2b985eaeda6a1425d587d63b6f403b988f280aff989357586bf232d27712 SHA512 e646ec3674b5ef38abe823406d33c8a47c5f63fa962c41386709a7ad7115d968b70fbcf7a8f3efc67a3e80e0194e8e22a01c2342c830f99970fe02532cdee51b
DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
@@ -8,3 +12,4 @@ DIST openssh-7.8p1-sctp-1.1.patch.xz 7548 BLAKE2B d74010028f097812f554f9e788aa5e
DIST openssh-7.8p1.tar.gz 1548026 BLAKE2B 938428408596d24d497f245e3662a0cff3d462645683bf75cd29a0ea56fa6c280e7fa866bedf0928dd5bc4085b82d5a4ce74b7eea0b45b86f879b69f74db1642 SHA512 8e5b0c8682a9243e4e8b7c374ec989dccd1a752eb6f84e593b67141e8b23dcc8b9a7322b1f7525d18e2ce8830a767d0d9793f997486339db201a57986b910705
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
+DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index ab669d3e59a..29134fc060d 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -26,8 +26,10 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<use>
<flag name="bindist">Disable EC/RC5 algorithms in OpenSSL for patent reasons.</flag>
<flag name="hpn">Enable high performance ssh</flag>
+ <flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
+ <flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
</use>
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
new file mode 100644
index 00000000000..cbe425c4eef
--- /dev/null
+++ b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
+SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
+X509_VER="10.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
+ ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ if use hpn ; then
+ pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
+ popd >/dev/null
+ fi
+ save_version X509
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ fi
+
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+
+ epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ epatch "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+ epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
+ epatch "${FILESDIR}"/${PN}-7.5_p1-CVE-2017-15906.patch
+ use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-s390-seccomp.patch # already included in X509 patch set, #644252
+ use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
+ use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
+ use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
+
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use X509 || use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-10-06 17:42 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2018-10-06 17:42 UTC (permalink / raw
To: gentoo-commits
commit: 5091fd8f2b5a7cb0d3e970df404446d3aef8f3c7
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 6 17:41:43 2018 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat Oct 6 17:42:24 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5091fd8f
net-misc/openssh: Security cleanup
Closes: https://bugs.gentoo.org/664264
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.49, Repoman-2.3.11
net-misc/openssh/Manifest | 5 -
net-misc/openssh/metadata.xml | 2 -
net-misc/openssh/openssh-7.5_p1-r4.ebuild | 334 ------------------------------
3 files changed, 341 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 73d61beed4a..86994d17c7d 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,7 +1,3 @@
-DIST openssh-7.4_p1-sctp.patch.xz 8220 BLAKE2B 2d571cacaab342b7950b42ec826bd896edf78780e9ee73fcd441cbc9764eb59e408e295062862db986918824d10498383bf34ae7c93df0da2c056eaec4d2c031 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4
-DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc266d1a450d298563bfc6ce705ec2829b8f9d91af5c5232941d55004b5aea2d3e0fb682a9d4acd9510c9761ba7ede2f2f0e37f SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a
-DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
-DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
DIST openssh-7.7p1-patches-1.2.tar.xz 17584 BLAKE2B 192ec01906c911197abec4606cdf136cf26ac4ab4c405267cd98bafaea409d9d596b2b985eaeda6a1425d587d63b6f403b988f280aff989357586bf232d27712 SHA512 e646ec3674b5ef38abe823406d33c8a47c5f63fa962c41386709a7ad7115d968b70fbcf7a8f3efc67a3e80e0194e8e22a01c2342c830f99970fe02532cdee51b
DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
@@ -12,4 +8,3 @@ DIST openssh-7.8p1-sctp-1.1.patch.xz 7548 BLAKE2B d74010028f097812f554f9e788aa5e
DIST openssh-7.8p1.tar.gz 1548026 BLAKE2B 938428408596d24d497f245e3662a0cff3d462645683bf75cd29a0ea56fa6c280e7fa866bedf0928dd5bc4085b82d5a4ce74b7eea0b45b86f879b69f74db1642 SHA512 8e5b0c8682a9243e4e8b7c374ec989dccd1a752eb6f84e593b67141e8b23dcc8b9a7322b1f7525d18e2ce8830a767d0d9793f997486339db201a57986b910705
DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
-DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 29134fc060d..ab669d3e59a 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -26,10 +26,8 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<use>
<flag name="bindist">Disable EC/RC5 algorithms in OpenSSL for patent reasons.</flag>
<flag name="hpn">Enable high performance ssh</flag>
- <flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
- <flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
</use>
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
deleted file mode 100644
index cbe425c4eef..00000000000
--- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild
+++ /dev/null
@@ -1,334 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
-X509_VER="10.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- fi
- save_version X509
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-CVE-2017-15906.patch
- use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-s390-seccomp.patch # already included in X509 patch set, #644252
- use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
- use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
- use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-09-14 8:52 Benda XU
0 siblings, 0 replies; 441+ messages in thread
From: Benda XU @ 2018-09-14 8:52 UTC (permalink / raw
To: gentoo-commits
commit: f031aee7218afa882b7b85a588d8118397675f61
Author: Benda Xu <heroxbd <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 14 08:51:15 2018 +0000
Commit: Benda XU <heroxbd <AT> gentoo <DOT> org>
CommitDate: Fri Sep 14 08:52:21 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f031aee7
net-misc/openssh: drop keyword ~arm-linux.
Bug: https://bugs.gentoo.org/664598
Package-Manager: Portage-2.3.49, Repoman-2.3.10
net-misc/openssh/openssh-7.8_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.8_p1.ebuild b/net-misc/openssh/openssh-7.8_p1.ebuild
index 44272213431..3ce6916d6e9 100644
--- a/net-misc/openssh/openssh-7.8_p1.ebuild
+++ b/net-misc/openssh/openssh-7.8_p1.ebuild
@@ -29,7 +29,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-09-13 11:19 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2018-09-13 11:19 UTC (permalink / raw
To: gentoo-commits
commit: c0bd2e6cb7f8259ff8baca3f740ee8f023e6b948
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 13 11:19:36 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Thu Sep 13 11:19:50 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c0bd2e6c
net-misc/openssh: No EAPI-7 in base-system packages yet.
See https://wiki.gentoo.org/wiki/Project:Base#Rules_and_limitations
Package-Manager: Portage-2.3.49, Repoman-2.3.10
net-misc/openssh/openssh-7.8_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.8_p1.ebuild b/net-misc/openssh/openssh-7.8_p1.ebuild
index fd5191f0df9..44272213431 100644
--- a/net-misc/openssh/openssh-7.8_p1.ebuild
+++ b/net-misc/openssh/openssh-7.8_p1.ebuild
@@ -1,7 +1,7 @@
# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-EAPI=7
+EAPI=6
inherit user flag-o-matic multilib autotools pam systemd
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-09-13 3:48 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2018-09-13 3:48 UTC (permalink / raw
To: gentoo-commits
commit: 29fc056508f9377e9a0b9dac03cc9c3f6881979b
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 13 03:47:48 2018 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Thu Sep 13 03:48:26 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=29fc0565
net-misc/openssh: Fix URL for X509 patch in version 7.8_p1
Package-Manager: Portage-2.3.49, Repoman-2.3.10
net-misc/openssh/openssh-7.8_p1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.8_p1.ebuild b/net-misc/openssh/openssh-7.8_p1.ebuild
index be98cf40b88..fd5191f0df9 100644
--- a/net-misc/openssh/openssh-7.8_p1.ebuild
+++ b/net-misc/openssh/openssh-7.8_p1.ebuild
@@ -24,7 +24,7 @@ HOMEPAGE="https://www.openssh.com/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${SCTP_PATCH} )}
${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${PV/_}/%s\n" "${HPN_PATCHES[@]}") )}
- ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_ver}/${X509_PATCH} )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
"
LICENSE="BSD GPL-2"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-24 12:23 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-24 12:23 UTC (permalink / raw
To: gentoo-commits
commit: 03a41c5401c51ae7c55adb8b4de3d58f0d3dbb58
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 24 12:07:58 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Aug 24 12:07:58 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=03a41c54
net-misc/openssh: set "--without-hardening" for Cygwin
Closes: https://bugs.gentoo.org/659210
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 1 +
1 file changed, 1 insertion(+)
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index 008a9853fba..b64d100d14c 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -274,6 +274,7 @@ src_configure() {
$(use_with ssl openssl)
$(use_with ssl md5-passwords)
$(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
)
# stackprotect is broken on musl x86
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-22 20:21 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-22 20:21 UTC (permalink / raw
To: gentoo-commits
commit: 685850bd7fcca67fa7d64a1750b8d2389dd2030c
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 22 20:20:30 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Aug 22 20:21:41 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=685850bd
net-misc/openssh: drop unused versionator eclass
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-misc/openssh/openssh-7.5_p1-r4.ebuild | 2 +-
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
index 3deb8a130f7..be7aea7c888 100644
--- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
@@ -3,7 +3,7 @@
EAPI="5"
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+inherit eutils user flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index 22f28922d6f..008a9853fba 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -3,7 +3,7 @@
EAPI="6"
-inherit user flag-o-matic multilib autotools pam systemd versionator
+inherit user flag-o-matic multilib autotools pam systemd
# Make it more portable between straight releases
# and _p? releases.
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-22 17:52 Mart Raudsepp
0 siblings, 0 replies; 441+ messages in thread
From: Mart Raudsepp @ 2018-08-22 17:52 UTC (permalink / raw
To: gentoo-commits
commit: 6b300aa89ae7afa3f963814a5c6e3b264e683bd5
Author: Mart Raudsepp <leio <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 22 17:51:49 2018 +0000
Commit: Mart Raudsepp <leio <AT> gentoo <DOT> org>
CommitDate: Wed Aug 22 17:51:49 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6b300aa8
net-misc/openssh-7.7_p1-r9: arm64 stable (bug #664264)
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index 5c0fa41cfe7..22f28922d6f 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -26,7 +26,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-22 15:00 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-22 15:00 UTC (permalink / raw
To: gentoo-commits
commit: 419a4fbd29c45b46b5caffa4d8c775693f596a27
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 22 14:57:16 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Aug 22 15:00:07 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=419a4fbd
net-misc/openssh: move stable keywords
Bug: https://bugs.gentoo.org/664264
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-misc/openssh/openssh-7.7_p1-r9.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r9.ebuild b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
index 586cd326821..5c0fa41cfe7 100644
--- a/net-misc/openssh/openssh-7.7_p1-r9.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r9.ebuild
@@ -26,7 +26,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
RESTRICT="!test? ( test )"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-22 15:00 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-22 15:00 UTC (permalink / raw
To: gentoo-commits
commit: bd4e2c022dec6fedeabe2613d8968b3931766432
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 22 14:59:53 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Aug 22 15:00:09 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bd4e2c02
net-misc/openssh: partial security cleanup
Bug: https://bugs.gentoo.org/664264
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-misc/openssh/Manifest | 6 -
net-misc/openssh/openssh-7.6_p1-r5.ebuild | 342 ----------------------
net-misc/openssh/openssh-7.7_p1-r6.ebuild | 460 ------------------------------
net-misc/openssh/openssh-7.7_p1-r7.ebuild | 444 ----------------------------
net-misc/openssh/openssh-7.7_p1-r8.ebuild | 444 ----------------------------
5 files changed, 1696 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 7baaf9672f0..fe07f89b363 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -2,15 +2,9 @@ DIST openssh-7.4_p1-sctp.patch.xz 8220 BLAKE2B 2d571cacaab342b7950b42ec826bd896e
DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc266d1a450d298563bfc6ce705ec2829b8f9d91af5c5232941d55004b5aea2d3e0fb682a9d4acd9510c9761ba7ede2f2f0e37f SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a
DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
-DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e774ac7423e2f4439f2adf585aae18fcf55d63f7f5421e716d76e2dd0205b186b6fea1f53132453ea82f0821cea3124c SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151
-DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
-DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
-DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
-DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
DIST openssh-7.7p1-patches-1.2.tar.xz 17584 BLAKE2B 192ec01906c911197abec4606cdf136cf26ac4ab4c405267cd98bafaea409d9d596b2b985eaeda6a1425d587d63b6f403b988f280aff989357586bf232d27712 SHA512 e646ec3674b5ef38abe823406d33c8a47c5f63fa962c41386709a7ad7115d968b70fbcf7a8f3efc67a3e80e0194e8e22a01c2342c830f99970fe02532cdee51b
DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
-DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 BLAKE2B a31dcb15848d3a22306108a4e181b1d52b195e6adcd2a78d5c7bf57f33c8ed62c3affa434c8d31c07eae84b59f1a3968a3f2a92e702f9225b121127616cb9d61 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974
diff --git a/net-misc/openssh/openssh-7.6_p1-r5.ebuild b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
deleted file mode 100644
index 35d4f26e7bd..00000000000
--- a/net-misc/openssh/openssh-7.6_p1-r5.ebuild
+++ /dev/null
@@ -1,342 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12-r1.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~chutzpah/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~chutzpah/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
- eapply "${FILESDIR}/${P}-permitopen.patch"
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- save_version X509
- fi
- # remove this with the next version bump
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}/${P}-permitopen-x509-glue.patch"
- popd >/dev/null
-
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
deleted file mode 100644
index 2c9745079e5..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ /dev/null
@@ -1,460 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r7.ebuild b/net-misc/openssh/openssh-7.7_p1-r7.ebuild
deleted file mode 100644
index 90c537b121a..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r7.ebuild
+++ /dev/null
@@ -1,444 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r8.ebuild b/net-misc/openssh/openssh-7.7_p1-r8.ebuild
deleted file mode 100644
index e9af1d2b782..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r8.ebuild
+++ /dev/null
@@ -1,444 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.2"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the sctp patch conditionally, so can't pass --without-sctp
- # unconditionally else we get unknown flag warnings.
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-16 15:03 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-16 15:03 UTC (permalink / raw
To: gentoo-commits
commit: f1972d34210086aa07183ca4b412b7d1888c3971
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 16 15:02:47 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Aug 16 15:03:23 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1972d34
net-misc/openssh: add patch to prevent username enumeration
Link: http://seclists.org/oss-sec/2018/q3/124
Package-Manager: Portage-2.3.46, Repoman-2.3.10
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.7_p1-r8.ebuild | 444 ++++++++++++++++++++++++++++++
2 files changed, 445 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 533bb4cbc5c..7baaf9672f0 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -8,6 +8,7 @@ DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
+DIST openssh-7.7p1-patches-1.2.tar.xz 17584 BLAKE2B 192ec01906c911197abec4606cdf136cf26ac4ab4c405267cd98bafaea409d9d596b2b985eaeda6a1425d587d63b6f403b988f280aff989357586bf232d27712 SHA512 e646ec3674b5ef38abe823406d33c8a47c5f63fa962c41386709a7ad7115d968b70fbcf7a8f3efc67a3e80e0194e8e22a01c2342c830f99970fe02532cdee51b
DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
diff --git a/net-misc/openssh/openssh-7.7_p1-r8.ebuild b/net-misc/openssh/openssh-7.7_p1-r8.ebuild
new file mode 100644
index 00000000000..e9af1d2b782
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r8.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.2"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ else
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-07 21:38 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-07 21:38 UTC (permalink / raw
To: gentoo-commits
commit: 8daf2a7aa0db6e8001341d590df53b5a8a9f1eeb
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 7 21:37:26 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Aug 7 21:38:47 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8daf2a7a
net-misc/openssh: drop experimental revision used to test LDAP migration
Revision no longer needed. Migration completed.
Package-Manager: Portage-2.3.44, Repoman-2.3.10
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-7.7_p1-r103.ebuild | 472 ----------------------------
2 files changed, 473 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 5c547da1d81..533bb4cbc5c 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,7 +7,6 @@ DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
-DIST openssh-7.7p1-ldap-20180327.patch.xz 19760 BLAKE2B f316ea65de3415b9ee19a621f36c5ce7e4bda7e1fe06e9edbc1e96e9d7296facf1a59dc79822939035c333a07b04a21d33c116fb74f36f1a93ac6849a4182166 SHA512 6439057839341169f9a198b25fdcbbddd50b0db0834aa762c16fb9b9b2e6b95b4ee9b4c6ad1cf2723750aacded4e6cba7f6036cdd91cf8d5e88eb21ea83790dd
DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
diff --git a/net-misc/openssh/openssh-7.7_p1-r103.ebuild b/net-misc/openssh/openssh-7.7_p1-r103.ebuild
deleted file mode 100644
index 3a2abed912e..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r103.ebuild
+++ /dev/null
@@ -1,472 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-LDAP_VER="20180327" LDAP_PATCH="${PARCH}-ldap-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use ldap ; then
- sed -i \
- -e "s/ -lfipscheck//" \
- "${WORKDIR}"/${LDAP_PATCH%.*} || die "Failed to remove fipscheck from LDAP patch"
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- doins openssh-lpk-{sun,openldap}.schema
-
- # Set the same libexec directory as in src_configure
- sed -i \
- -e "s:libexec/openssh:$(get_libdir)/misc:" \
- "${ED%/}/usr/$(get_libdir)/misc/ssh-ldap-wrapper" || die
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] && has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7_p1, the LDAP implementation was changed."
- elog "You must revise your configuration or your previous LDAP setup will stop working."
- elog ""
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for migration details."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-08-07 21:38 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-08-07 21:38 UTC (permalink / raw
To: gentoo-commits
commit: 89ffd7e286e781050307fbe62c0cc83d4fbd9b29
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 7 21:36:56 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Aug 7 21:38:45 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=89ffd7e2
net-misc/openssh: drop USE=ldap in favor of sys-auth/ssh-ldap-pubkey
We no longer patch net-misc/openssh to include LDAP functionality.
If you need to authenticate against LDAP, please install
sys-auth/ssh-ldap-pubkey and use OpenSSH's "AuthorizedKeysCommand"
option.
See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details.
Closes: https://bugs.gentoo.org/658044
Closes: https://github.com/gentoo/gentoo/pull/9400
Package-Manager: Portage-2.3.44, Repoman-2.3.10
net-misc/openssh/openssh-7.7_p1-r7.ebuild | 444 ++++++++++++++++++++++++++++++
1 file changed, 444 insertions(+)
diff --git a/net-misc/openssh/openssh-7.7_p1-r7.ebuild b/net-misc/openssh/openssh-7.7_p1-r7.ebuild
new file mode 100644
index 00000000000..90c537b121a
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r7.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.1"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ else
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-07-28 19:17 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-07-28 19:17 UTC (permalink / raw
To: gentoo-commits
commit: 506eaa6bdcc641668ad11d201bd156d1acd28fd2
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sat Jul 28 19:13:21 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sat Jul 28 19:16:57 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=506eaa6b
net-misc/openssh: Copy stable keywords from previous revision
The actual changes between thw two revisions were small and don't
require new stabilization.
Package-Manager: Portage-2.3.43, Repoman-2.3.10
RepoMan-Options: --force
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 441 ------------------------------
net-misc/openssh/openssh-7.7_p1-r6.ebuild | 2 +-
2 files changed, 1 insertion(+), 442 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
deleted file mode 100644
index 88b05334bf7..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ /dev/null
@@ -1,441 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
index 2d068fd5c8e..2c9745079e5 100644
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-07-15 21:51 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2018-07-15 21:51 UTC (permalink / raw
To: gentoo-commits
commit: 34e2a5a67f38ecdfd1ff25b59442bf345df18df4
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 15 21:51:43 2018 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Jul 15 21:51:43 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=34e2a5a6
net-misc/openssh: m68k/sh stable wrt bug #657366
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index bed23d9a603..88b05334bf7 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-07-02 22:35 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-07-02 22:35 UTC (permalink / raw
To: gentoo-commits
commit: 12d29e46359700c563ed2f064bb895535d76a749
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 2 22:35:08 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Jul 2 22:35:46 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=12d29e46
net-misc/openssh: fix libexec directory in ldap wrapper
Reported-by: Sergey Popov <pinkbyte <AT> gentoo.org>
Package-Manager: Portage-2.3.40, Repoman-2.3.9
.../{openssh-7.7_p1-r102.ebuild => openssh-7.7_p1-r103.ebuild} | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net-misc/openssh/openssh-7.7_p1-r102.ebuild b/net-misc/openssh/openssh-7.7_p1-r103.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-7.7_p1-r102.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r103.ebuild
index 83b9dd34711..3a2abed912e 100644
--- a/net-misc/openssh/openssh-7.7_p1-r102.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r103.ebuild
@@ -393,6 +393,11 @@ src_install() {
if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
insinto /etc/openldap/schema/
doins openssh-lpk-{sun,openldap}.schema
+
+ # Set the same libexec directory as in src_configure
+ sed -i \
+ -e "s:libexec/openssh:$(get_libdir)/misc:" \
+ "${ED%/}/usr/$(get_libdir)/misc/ssh-ldap-wrapper" || die
fi
doman contrib/ssh-copy-id.1
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-30 20:59 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2018-06-30 20:59 UTC (permalink / raw
To: gentoo-commits
commit: 22a4204c118ff09bf2fbeab26f1d10a00e205f0d
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 30 20:59:12 2018 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sat Jun 30 20:59:12 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=22a4204c
net-misc/openssh: s390 stable wrt bug #657366
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index 3fd5fceb737..bed23d9a603 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-28 20:00 Anthony G. Basile
0 siblings, 0 replies; 441+ messages in thread
From: Anthony G. Basile @ 2018-06-28 20:00 UTC (permalink / raw
To: gentoo-commits
commit: b28378fc2358c24785f41fdf92c00d617998ea3d
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 28 20:00:21 2018 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Thu Jun 28 20:00:21 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b28378fc
net-misc/openssh: stackprotector is broken on musl x86
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r102.ebuild | 3 +++
net-misc/openssh/openssh-7.7_p1-r6.ebuild | 3 +++
2 files changed, 6 insertions(+)
diff --git a/net-misc/openssh/openssh-7.7_p1-r102.ebuild b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
index c4747a2597e..83b9dd34711 100644
--- a/net-misc/openssh/openssh-7.7_p1-r102.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
@@ -293,6 +293,9 @@ src_configure() {
$(use_with ssl ssl-engine)
)
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
index e84b7d126a3..2d068fd5c8e 100644
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
@@ -293,6 +293,9 @@ src_configure() {
$(use_with ssl ssl-engine)
)
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-26 20:33 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2018-06-26 20:33 UTC (permalink / raw
To: gentoo-commits
commit: de8320fbdc1b7e668c99d1fe543672af1b5b72be
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 26 20:33:08 2018 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Tue Jun 26 20:33:32 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de8320fb
net-misc/openssh: Stable for HPPA too.
Package-Manager: Portage-2.3.40, Repoman-2.3.9
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.7_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
index a8c8b20d4c2..e84b7d126a3 100644
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-26 15:55 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2018-06-26 15:55 UTC (permalink / raw
To: gentoo-commits
commit: 8376f3456d9938cd2fe4413d4b1104ccf1e936db
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 26 15:55:25 2018 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Tue Jun 26 15:55:25 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8376f345
net-misc/openssh: arm stable wrt bug #657366
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.6_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.6_p1-r5.ebuild b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
index 4c84767d116..35d4f26e7bd 100644
--- a/net-misc/openssh/openssh-7.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-26 8:22 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2018-06-26 8:22 UTC (permalink / raw
To: gentoo-commits
commit: 4db7e4be4eb444afc5c074bed7b68dcfc8954c3f
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 20 22:03:17 2018 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Jun 26 08:18:50 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4db7e4be
net-misc/openssh: send & accept COLORTERM env var #658540
For terminal emulators that set this variable, pass it along.
Url: https://gist.github.com/XVilka/8346728
Bug: https://bugs.gentoo.org/658540
net-misc/openssh/openssh-7.7_p1-r102.ebuild | 6 ++++++
net-misc/openssh/openssh-7.7_p1-r6.ebuild | 6 ++++++
2 files changed, 12 insertions(+)
diff --git a/net-misc/openssh/openssh-7.7_p1-r102.ebuild b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
index 5bea8702b07..c4747a2597e 100644
--- a/net-misc/openssh/openssh-7.7_p1-r102.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
@@ -345,6 +345,9 @@ tweak_ssh_configs() {
# Allow client to pass locale environment variables. #367017
AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
EOF
# Then the client config.
@@ -352,6 +355,9 @@ tweak_ssh_configs() {
# Send locale environment variables. #367017
SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
EOF
if use pam ; then
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
index 3e0ed629bbc..a8c8b20d4c2 100644
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
@@ -345,6 +345,9 @@ tweak_ssh_configs() {
# Allow client to pass locale environment variables. #367017
AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
EOF
# Then the client config.
@@ -352,6 +355,9 @@ tweak_ssh_configs() {
# Send locale environment variables. #367017
SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
EOF
if use pam ; then
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-26 8:22 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2018-06-26 8:22 UTC (permalink / raw
To: gentoo-commits
commit: 6fdefd62aefe48e72cb5939f38b6421a30e4d5c5
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 20 21:47:41 2018 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Jun 26 08:18:50 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6fdefd62
net-misc/openssh: update set of locale vars #367017
Rather than glob all LC_* env vars, hardcode the list based on what
POSIX defines and the GNU extensions. In practice, this means we
additionally send LANGUAGE, and unregistered or unrelated env vars
that happen to start with "LC_" are no longer sent. If someone has
a locale related variable that they want to include, they can file
a new request for it.
We continue to omit POSIX's NLSPATH as that is much more likely to
be system specific and have no useful meaning on the remote side.
Bug: https://bugs.gentoo.org/367017
...7_p1-r101.ebuild => openssh-7.7_p1-r102.ebuild} | 18 ++++++++---
...7.7_p1-r101.ebuild => openssh-7.7_p1-r6.ebuild} | 37 ++++++++++++----------
2 files changed, 34 insertions(+), 21 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r101.ebuild b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
similarity index 96%
copy from net-misc/openssh/openssh-7.7_p1-r101.ebuild
copy to net-misc/openssh/openssh-7.7_p1-r102.ebuild
index d330358e032..5bea8702b07 100644
--- a/net-misc/openssh/openssh-7.7_p1-r101.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r102.ebuild
@@ -330,18 +330,28 @@ src_test() {
# Gentoo tweaks to default config files.
tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
# First the server config.
cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
EOF
# Then the client config.
cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
- # Send locale environment variables #367017
- SendEnv LANG LC_*
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
EOF
if use pam ; then
diff --git a/net-misc/openssh/openssh-7.7_p1-r101.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
similarity index 92%
rename from net-misc/openssh/openssh-7.7_p1-r101.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r6.ebuild
index d330358e032..3e0ed629bbc 100644
--- a/net-misc/openssh/openssh-7.7_p1-r101.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
@@ -12,7 +12,10 @@ PARCH=${P/_}
HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-LDAP_VER="20180327" LDAP_PATCH="${PARCH}-ldap-${LDAP_VER}.patch.xz"
+
+# Disable LDAP support until someone will rewrite the patch,
+# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
+#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
PATCH_SET="openssh-7.7p1-patches-1.1"
@@ -28,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
@@ -146,9 +149,6 @@ src_prepare() {
fi
if use ldap ; then
- sed -i \
- -e "s/ -lfipscheck//" \
- "${WORKDIR}"/${LDAP_PATCH%.*} || die "Failed to remove fipscheck from LDAP patch"
eapply "${WORKDIR}"/${LDAP_PATCH%.*}
einfo "Patching version.h to expose LDAP patch set ..."
@@ -330,18 +330,28 @@ src_test() {
# Gentoo tweaks to default config files.
tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
# First the server config.
cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
EOF
# Then the client config.
cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
- # Send locale environment variables #367017
- SendEnv LANG LC_*
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
EOF
if use pam ; then
@@ -373,7 +383,7 @@ src_install() {
if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
insinto /etc/openldap/schema/
- doins openssh-lpk-{sun,openldap}.schema
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
fi
doman contrib/ssh-copy-id.1
@@ -438,11 +448,4 @@ pkg_postinst() {
elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
elog ""
fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] && has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
- elog "Starting with openssh-7.7_p1, the LDAP implementation was changed."
- elog "You must revise your configuration or your previous LDAP setup will stop working."
- elog ""
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for migration details."
- fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-25 20:43 Tobias Klausmann
0 siblings, 0 replies; 441+ messages in thread
From: Tobias Klausmann @ 2018-06-25 20:43 UTC (permalink / raw
To: gentoo-commits
commit: 21d75e51e6520c64defe23c519c8d0f03ebb6e07
Author: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 25 20:43:35 2018 +0000
Commit: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
CommitDate: Mon Jun 25 20:43:35 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=21d75e51
net-misc/openssh-7.7_p1-r5: alpha stable
Gentoo-Bug: http://bugs.gentoo.org/657366
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index 41b557e80b0..3fd5fceb737 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-21 12:10 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2018-06-21 12:10 UTC (permalink / raw
To: gentoo-commits
commit: bf5102cf4f7ff1087f60e3d146658fefcc34859e
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 21 12:10:38 2018 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Thu Jun 21 12:10:38 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bf5102cf
net-misc/openssh: Stable for HPPA too.
Package-Manager: Portage-2.3.40, Repoman-2.3.9
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index cadc2109835..225b5cc04f0 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-21 2:36 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2018-06-21 2:36 UTC (permalink / raw
To: gentoo-commits
commit: 3b9f17df19b6c64674257cf039d647ed6a2b99aa
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 20 21:34:49 2018 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Thu Jun 21 02:25:39 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3b9f17df
net-misc/openssh: move ssh{,d}_config tweaks to a sep func
No functional changes here. Should make managing src_install easier
as all the sshd_config/ssh_config changes are kept separate.
net-misc/openssh/openssh-7.7_p1-r101.ebuild | 44 +++++++++++++++++------------
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 44 +++++++++++++++++------------
2 files changed, 52 insertions(+), 36 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r101.ebuild b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
index 69618e6b249..d330358e032 100644
--- a/net-misc/openssh/openssh-7.7_p1-r101.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
@@ -328,40 +328,48 @@ src_test() {
[[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
}
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ # First the server config.
cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
# Allow client to pass locale environment variables #367017
AcceptEnv LANG LC_*
EOF
+
+ # Then the client config.
cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
# Send locale environment variables #367017
SendEnv LANG LC_*
EOF
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
if use livecd ; then
sed -i \
-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
"${ED%/}"/etc/ssh/sshd_config || die
fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
insinto /etc/openldap/schema/
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index 8ce813c89ca..cadc2109835 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -328,40 +328,48 @@ src_test() {
[[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
}
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ # First the server config.
cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
# Allow client to pass locale environment variables #367017
AcceptEnv LANG LC_*
EOF
+
+ # Then the client config.
cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
# Send locale environment variables #367017
SendEnv LANG LC_*
EOF
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
if use livecd ; then
sed -i \
-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
"${ED%/}"/etc/ssh/sshd_config || die
fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
insinto /etc/openldap/schema/
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-20 0:31 Anthony G. Basile
0 siblings, 0 replies; 441+ messages in thread
From: Anthony G. Basile @ 2018-06-20 0:31 UTC (permalink / raw
To: gentoo-commits
commit: 9143e1a3ae0fbe2e2fcfd11f476a5b1250ababf0
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 20 00:29:53 2018 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jun 20 00:29:53 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9143e1a3
net-misc/openssh: fix white space
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r101.ebuild | 2 +-
net-misc/openssh/openssh-7.7_p1-r5.ebuild | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r101.ebuild b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
index 6552cd1ac5f..69618e6b249 100644
--- a/net-misc/openssh/openssh-7.7_p1-r101.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
@@ -191,7 +191,7 @@ src_prepare() {
einfo "Disabling known non-working MT AES cipher per default ..."
cat > "${T}"/disable_mtaes.conf <<- EOF
-
+
# HPN's Multi-Threaded AES CTR cipher is currently known to be broken
# and therefore disabled per default.
DisableMTAES yes
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
index b9a58b2abe5..8ce813c89ca 100644
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -191,7 +191,7 @@ src_prepare() {
einfo "Disabling known non-working MT AES cipher per default ..."
cat > "${T}"/disable_mtaes.conf <<- EOF
-
+
# HPN's Multi-Threaded AES CTR cipher is currently known to be broken
# and therefore disabled per default.
DisableMTAES yes
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-18 23:33 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-06-18 23:33 UTC (permalink / raw
To: gentoo-commits
commit: e1a1048cb7a8810473fbead4eca8cd963be976d1
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 18 23:30:43 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Jun 18 23:33:38 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e1a1048c
net-misc/openssh: bump to address multiple issues
- Fix building on x86 due to undefined socketcall when "hpn" USE
flag was set. [Bug 658232]
- Fix segfault when using sshd with "sctp" USE flag. [Bug 658308]
Closes: https://bugs.gentoo.org/658232
Closes: https://bugs.gentoo.org/658308
Package-Manager: Portage-2.3.40, Repoman-2.3.9
RepoMan-Options: --force
net-misc/openssh/Manifest | 4 ++--
.../{openssh-7.7_p1-r100.ebuild => openssh-7.7_p1-r101.ebuild} | 4 ++--
.../openssh/{openssh-7.7_p1-r4.ebuild => openssh-7.7_p1-r5.ebuild} | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index c673bcf6687..5c547da1d81 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -6,10 +6,10 @@ DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e
DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
-DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
+DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
DIST openssh-7.7p1-ldap-20180327.patch.xz 19760 BLAKE2B f316ea65de3415b9ee19a621f36c5ce7e4bda7e1fe06e9edbc1e96e9d7296facf1a59dc79822939035c333a07b04a21d33c116fb74f36f1a93ac6849a4182166 SHA512 6439057839341169f9a198b25fdcbbddd50b0db0834aa762c16fb9b9b2e6b95b4ee9b4c6ad1cf2723750aacded4e6cba7f6036cdd91cf8d5e88eb21ea83790dd
DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
-DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
+DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
diff --git a/net-misc/openssh/openssh-7.7_p1-r100.ebuild b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.7_p1-r100.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r101.ebuild
index 8aa36a58819..6552cd1ac5f 100644
--- a/net-misc/openssh/openssh-7.7_p1-r100.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r101.ebuild
@@ -9,8 +9,8 @@ inherit user flag-o-matic multilib autotools pam systemd versionator
# and _p? releases.
PARCH=${P/_}
-HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
LDAP_VER="20180327" LDAP_PATCH="${PARCH}-ldap-${LDAP_VER}.patch.xz"
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.7_p1-r4.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r5.ebuild
index d48f8313520..b9a58b2abe5 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
@@ -9,8 +9,8 @@ inherit user flag-o-matic multilib autotools pam systemd versionator
# and _p? releases.
PARCH=${P/_}
-HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
# Disable LDAP support until someone will rewrite the patch,
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-13 15:25 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-06-13 15:25 UTC (permalink / raw
To: gentoo-commits
commit: 780c17bca1d4ef4b7374f4fd3758e6352e622106
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 13 15:23:27 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Jun 13 15:25:44 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=780c17bc
net-misc/openssh: add test ebuild for new LDAP implementation
We switched from dead openssh-lpk patch to Red Hat's rewritten
LDAP patch which makes use of "AuthorizedKeysCommand".
Warning:
Default LDAP scheme isn't compatible. Migration is needed.
Bug: https://bugs.gentoo.org/658044
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.7_p1-r100.ebuild | 440 ++++++++++++++++++++++++++++
2 files changed, 441 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index b0fcdb7976a..c673bcf6687 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,6 +7,7 @@ DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
+DIST openssh-7.7p1-ldap-20180327.patch.xz 19760 BLAKE2B f316ea65de3415b9ee19a621f36c5ce7e4bda7e1fe06e9edbc1e96e9d7296facf1a59dc79822939035c333a07b04a21d33c116fb74f36f1a93ac6849a4182166 SHA512 6439057839341169f9a198b25fdcbbddd50b0db0834aa762c16fb9b9b2e6b95b4ee9b4c6ad1cf2723750aacded4e6cba7f6036cdd91cf8d5e88eb21ea83790dd
DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
diff --git a/net-misc/openssh/openssh-7.7_p1-r100.ebuild b/net-misc/openssh/openssh-7.7_p1-r100.ebuild
new file mode 100644
index 00000000000..8aa36a58819
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r100.ebuild
@@ -0,0 +1,440 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+LDAP_VER="20180327" LDAP_PATCH="${PARCH}-ldap-${LDAP_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.1"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ else
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ fi
+
+ if use ldap ; then
+ sed -i \
+ -e "s/ -lfipscheck//" \
+ "${WORKDIR}"/${LDAP_PATCH%.*} || die "Failed to remove fipscheck from LDAP patch"
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+
+ einfo "Patching version.h to expose LDAP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in LDAP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use ldap || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
+ insinto /etc/openldap/schema/
+ doins openssh-lpk-{sun,openldap}.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+
+ if use ldap && [[ -n ${LDAP_PATCH} ]] && has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7_p1, the LDAP implementation was changed."
+ elog "You must revise your configuration or your previous LDAP setup will stop working."
+ elog ""
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for migration details."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-12 20:48 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2018-06-12 20:48 UTC (permalink / raw
To: gentoo-commits
commit: aeacb0583effdf7185695a064b1b9b09b399ebd2
Author: Rolf Eike Beer <eike <AT> sf-mail <DOT> de>
AuthorDate: Tue Jun 12 18:47:19 2018 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Jun 12 20:47:46 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aeacb058
net-misc/openssh: stable 7.7_p1-r4 for sparc
Bug: https://bugs.gentoo.org/657366
Package-Manager: Portage-2.3.24, Repoman-2.3.6
RepoMan-Options: --include-arches="sparc"
net-misc/openssh/openssh-7.7_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
index 3fe9972c170..d48f8313520 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-12 15:17 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2018-06-12 15:17 UTC (permalink / raw
To: gentoo-commits
commit: 7dcb81ace42ed7a27c311deac1504baa8eb1c49e
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 12 15:08:05 2018 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Tue Jun 12 15:17:30 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7dcb81ac
net-misc/openssh: amd64 stable wrt bug #657366
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
index a34f0561184..3fe9972c170 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-12 11:36 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-06-12 11:36 UTC (permalink / raw
To: gentoo-commits
commit: 1341d8b9177af9855df124b8e89365c64b72d3c8
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 12 11:32:31 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Jun 12 11:32:31 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1341d8b9
net-misc/openssh: x86 stable (bug #657366)
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/openssh-7.7_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
index 19020e24099..a34f0561184 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-12 9:32 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2018-06-12 9:32 UTC (permalink / raw
To: gentoo-commits
commit: f1f43e82ad8aaca9b199a54ede1325222eaa0712
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 12 09:31:54 2018 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Jun 12 09:31:59 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1f43e82
net-misc/openssh: stable 7.7_p1-r4 for ia64, bug #657366
Bug: https://bugs.gentoo.org/657366
Package-Manager: Portage-2.3.40, Repoman-2.3.9
RepoMan-Options: --include-arches="ia64"
net-misc/openssh/openssh-7.7_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
index 8c98892dfd2..19020e24099 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-11 22:47 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-06-11 22:47 UTC (permalink / raw
To: gentoo-commits
commit: 7d7ff6f0c26e07ab5dcf45b5bdd5f2fb8b67cfc7
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 11 22:45:47 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Jun 11 22:46:59 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7d7ff6f0
net-misc/openssh: drop old
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/Manifest | 2 -
net-misc/openssh/openssh-7.6_p1-r4.ebuild | 336 -----------------------
net-misc/openssh/openssh-7.7_p1-r1.ebuild | 414 -----------------------------
net-misc/openssh/openssh-7.7_p1-r2.ebuild | 426 -----------------------------
net-misc/openssh/openssh-7.7_p1-r3.ebuild | 427 ------------------------------
5 files changed, 1605 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 16fa1505ca1..b0fcdb7976a 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -6,9 +6,7 @@ DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e
DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
-DIST openssh-7.7p1-hpnssh14v14-gentoo1.patch.xz 21448 BLAKE2B 51d9324990d8098707359f355b9212679db38569e566f47659ffdae8046bdbb4e6873bd67ecb7da0b5706c5243f44f82089f08ecbc59c7e39062fceb4be78316 SHA512 63d2ffbcfe121ddedaa07955b1025d2c6e196ea694464610437368835cf46dd507d4d17361548cae93db53a1e3d93d9c409910620bbd0cd619d82b6215c833b5
DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
-DIST openssh-7.7p1-patches-1.0.tar.xz 8176 BLAKE2B 196b756f72bb3fccc927e31ae1b94adc3c9116de25258ac599c3653cd1234ff33f3dc608515a5ef56bea05191621974342bdb164b721c94d2c29a0de74731742 SHA512 9d56e306a5886a19d58c7a42389a82d8b912bb9250f97f64e9bf9752fc92e671539b24b0568f21072fb1ba7185e6bd1ec33511a39d26d48a699a911b910121c9
DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
diff --git a/net-misc/openssh/openssh-7.6_p1-r4.ebuild b/net-misc/openssh/openssh-7.6_p1-r4.ebuild
deleted file mode 100644
index 68ad3c2a252..00000000000
--- a/net-misc/openssh/openssh-7.6_p1-r4.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12-r1.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~chutzpah/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~chutzpah/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- save_version X509
- fi
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r1.ebuild b/net-misc/openssh/openssh-7.7_p1-r1.ebuild
deleted file mode 100644
index cfcfc30327f..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r1.ebuild
+++ /dev/null
@@ -1,414 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v14-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" HPN_DISABLE_MTAES=1
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r2.ebuild b/net-misc/openssh/openssh-7.7_p1-r2.ebuild
deleted file mode 100644
index cb49cc970e0..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r2.ebuild
+++ /dev/null
@@ -1,426 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v14-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" HPN_DISABLE_MTAES=1
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r3.ebuild b/net-misc/openssh/openssh-7.7_p1-r3.ebuild
deleted file mode 100644
index b06772ba1b8..00000000000
--- a/net-misc/openssh/openssh-7.7_p1-r3.ebuild
+++ /dev/null
@@ -1,427 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-06-05 15:42 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-06-05 15:42 UTC (permalink / raw
To: gentoo-commits
commit: 65f8a6f69479f569df5eb024e1a652bdada7ce15
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 5 15:42:01 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Jun 5 15:42:49 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65f8a6f6
net-misc/openssh: add more upstream patches
- Pick: "Use includes.h instead of config.h." [Link 1]
- Pick: "upstream: Since the previous commit, ssh regress test" [Link 2]
- Pick: "upstream: implement EMFILE mitigation for ssh-agent" [Link 3]
- Pick: "fix key-options.sh on platforms without openpty(3)" [Link 4]
- Pick: "sync fmt_scaled.c" [Link 5]
- Pick: "upstream: Emphasise that -w implicitly sets
Tunnel=point-to-point" [Link 6]
- Pick: "upstream: correct keyowrd name (permitemptypasswords)" [Link 7]
- Pick: "Permit getuid()/geteuid() syscalls." [Link 8]
- Pick: "upstream: If select() fails in ssh_packet_read_seqnr go directly
to the error path" [Link 9]
- Pick: "upstream: Fix return value confusion in several
functions" [Link 10]
- Pick: "upstream: Do not ban PTY allocation when a sshd session is
restricted" [Link 11]
- Pick: "upstream: prefer argv0 to "ssh" when re-executing ssh for
ProxyJump" [Link 12]
- Pick: "upstream: return correct exit code when searching for and hashing
known_hosts entries in a single operatio" [Link 13]
- Pick: "upstream: make ssh_remote_ipaddr() capable of being called after
the ssh->state has been torn down" [Link 14]
- Pick: "upstream: whitespace" [Link 15]
- Pick: "upstream: Adapt to extra default verboisity from ssh-keygen when
searching for and hashing known_hosts entries in a single
operation" [Link 16]
- Pick: "upstream: Apply umask to all incoming files and directories not
just file" [Link 17]
Link 1: https://github.com/openssh/openssh-portable/commit/7c15301841e2e9d37cae732400de63ae9c0961d6
Link 2: https://github.com/openssh/openssh-portable/commit/e7751aa4094d51a9bc00778aa8d07e22934c55ee
Link 3: https://github.com/openssh/openssh-portable/commit/b2140a739be4c3b43cc1dc08322dca39a1e39d20
Link 4: https://github.com/openssh/openssh-portable/commit/54268d589e85ecc43d3eba8d83f327bdada9d696
Link 5: https://github.com/openssh/openssh-portable/commit/32e4e94e1511fe0020fbfbb62399d31b2d22a801
Link 6: https://github.com/openssh/openssh-portable/commit/f18bc97151340127859634d20d79fd39ec8a7f39
Link 7: https://github.com/openssh/openssh-portable/commit/f41bcd70f55b4f0fc4d8e1039cb361ac922b23fb
Link 8: https://github.com/openssh/openssh-portable/commit/4ef75926ef517d539f2c7aac3188b09f315c86a7
Link 9: https://github.com/openssh/openssh-portable/commit/1da5934b860ac0378d52d3035b22b6670f6a967e
Link 10: https://github.com/openssh/openssh-portable/commit/f6a59a22b0c157c4c4e5fd7232f868138223be64
Link 11: https://github.com/openssh/openssh-portable/commit/fbb4b5fd4f8e0bb89732670a01954e18b69e15ba
Link 12: https://github.com/openssh/openssh-portable/commit/d8748b91d1d6c108c0c260ed41fa55f37b9ef34b
Link 13: https://github.com/openssh/openssh-portable/commit/3e088aaf236ef35beeef3c9be93fd53700df5861
Link 14: https://github.com/openssh/openssh-portable/commit/854ae209f992465a276de0b5f10ef770510c2418
Link 15: https://github.com/openssh/openssh-portable/commit/01b048c8eba3b021701bd0ab26257fc82903cba8
Link 16: https://github.com/openssh/openssh-portable/commit/a1dcafc41c376332493b9385ee39f9754dc145ec
Link 17: https://github.com/openssh/openssh-portable/commit/e5019da3c5a31e6e729a565f2b886a80c4be96cc
Package-Manager: Portage-2.3.40, Repoman-2.3.9
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.7_p1-r4.ebuild | 432 ++++++++++++++++++++++++++++++
2 files changed, 433 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index c6a2fbd76c4..16fa1505ca1 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -9,6 +9,7 @@ DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c
DIST openssh-7.7p1-hpnssh14v14-gentoo1.patch.xz 21448 BLAKE2B 51d9324990d8098707359f355b9212679db38569e566f47659ffdae8046bdbb4e6873bd67ecb7da0b5706c5243f44f82089f08ecbc59c7e39062fceb4be78316 SHA512 63d2ffbcfe121ddedaa07955b1025d2c6e196ea694464610437368835cf46dd507d4d17361548cae93db53a1e3d93d9c409910620bbd0cd619d82b6215c833b5
DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
DIST openssh-7.7p1-patches-1.0.tar.xz 8176 BLAKE2B 196b756f72bb3fccc927e31ae1b94adc3c9116de25258ac599c3653cd1234ff33f3dc608515a5ef56bea05191621974342bdb164b721c94d2c29a0de74731742 SHA512 9d56e306a5886a19d58c7a42389a82d8b912bb9250f97f64e9bf9752fc92e671539b24b0568f21072fb1ba7185e6bd1ec33511a39d26d48a699a911b910121c9
+DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
new file mode 100644
index 00000000000..e884e0b9d3e
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -0,0 +1,432 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+
+# Disable LDAP support until someone will rewrite the patch,
+# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
+#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.1"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ else
+ rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+ rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+ fi
+
+ if use ldap ; then
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+
+ einfo "Patching version.h to expose LDAP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in LDAP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use ldap || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-05-08 13:35 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-05-08 13:35 UTC (permalink / raw
To: gentoo-commits
commit: 21eeec4e3734c2be39deae084f765d422bbc2fa3
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue May 8 13:35:08 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue May 8 13:35:30 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=21eeec4e
net-misc/openssh: bump HPN patch set; re-enable MT AES cipher
Package-Manager: Portage-2.3.34, Repoman-2.3.9
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.7_p1-r3.ebuild | 427 ++++++++++++++++++++++++++++++
2 files changed, 428 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 13eb2d7780d..c6a2fbd76c4 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,6 +7,7 @@ DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v14-gentoo1.patch.xz 21448 BLAKE2B 51d9324990d8098707359f355b9212679db38569e566f47659ffdae8046bdbb4e6873bd67ecb7da0b5706c5243f44f82089f08ecbc59c7e39062fceb4be78316 SHA512 63d2ffbcfe121ddedaa07955b1025d2c6e196ea694464610437368835cf46dd507d4d17361548cae93db53a1e3d93d9c409910620bbd0cd619d82b6215c833b5
+DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
DIST openssh-7.7p1-patches-1.0.tar.xz 8176 BLAKE2B 196b756f72bb3fccc927e31ae1b94adc3c9116de25258ac599c3653cd1234ff33f3dc608515a5ef56bea05191621974342bdb164b721c94d2c29a0de74731742 SHA512 9d56e306a5886a19d58c7a42389a82d8b912bb9250f97f64e9bf9752fc92e671539b24b0568f21072fb1ba7185e6bd1ec33511a39d26d48a699a911b910121c9
DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
diff --git a/net-misc/openssh/openssh-7.7_p1-r3.ebuild b/net-misc/openssh/openssh-7.7_p1-r3.ebuild
new file mode 100644
index 00000000000..b06772ba1b8
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r3.ebuild
@@ -0,0 +1,427 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
+SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+
+# Disable LDAP support until someone will rewrite the patch,
+# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
+#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.0"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ fi
+
+ if use ldap ; then
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+
+ einfo "Patching version.h to expose LDAP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in LDAP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use ldap || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-04-22 17:13 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-04-22 17:13 UTC (permalink / raw
To: gentoo-commits
commit: a2c265c28007211dd1ee4096259a8f0aa6d48ef0
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 22 17:13:30 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Apr 22 17:13:46 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a2c265c2
net-misc/openssh: Rev bump to add patches
Ebuild changes:
===============
- Added patches for various upstream issues like
bug 2840, 2835, 2851, 2837, 2855, 2719.
Closes: https://bugs.gentoo.org/653750
Closes: https://bugs.gentoo.org/653008
Package-Manager: Portage-2.3.31, Repoman-2.3.9
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.7_p1-r2.ebuild | 426 ++++++++++++++++++++++++++++++
2 files changed, 427 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 7817efe9f09..13eb2d7780d 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,6 +7,7 @@ DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-7.7p1-hpnssh14v14-gentoo1.patch.xz 21448 BLAKE2B 51d9324990d8098707359f355b9212679db38569e566f47659ffdae8046bdbb4e6873bd67ecb7da0b5706c5243f44f82089f08ecbc59c7e39062fceb4be78316 SHA512 63d2ffbcfe121ddedaa07955b1025d2c6e196ea694464610437368835cf46dd507d4d17361548cae93db53a1e3d93d9c409910620bbd0cd619d82b6215c833b5
+DIST openssh-7.7p1-patches-1.0.tar.xz 8176 BLAKE2B 196b756f72bb3fccc927e31ae1b94adc3c9116de25258ac599c3653cd1234ff33f3dc608515a5ef56bea05191621974342bdb164b721c94d2c29a0de74731742 SHA512 9d56e306a5886a19d58c7a42389a82d8b912bb9250f97f64e9bf9752fc92e671539b24b0568f21072fb1ba7185e6bd1ec33511a39d26d48a699a911b910121c9
DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
diff --git a/net-misc/openssh/openssh-7.7_p1-r2.ebuild b/net-misc/openssh/openssh-7.7_p1-r2.ebuild
new file mode 100644
index 00000000000..cb49cc970e0
--- /dev/null
+++ b/net-misc/openssh/openssh-7.7_p1-r2.ebuild
@@ -0,0 +1,426 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_VER="14v14-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" HPN_DISABLE_MTAES=1
+SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+
+# Disable LDAP support until someone will rewrite the patch,
+# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
+#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
+
+PATCH_SET="openssh-7.7p1-patches-1.0"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+
+ einfo "Disabling broken X.509 agent test ..."
+ sed -i \
+ -e "/^ agent$/d" \
+ "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
+
+ # The following patches don't apply on top of X509 patch
+ rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
+ rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+ fi
+
+ if use ldap ; then
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+
+ einfo "Patching version.h to expose LDAP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in LDAP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ eapply "${WORKDIR}"/${HPN_PATCH%.*}
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching packet.c for X509 and/or HPN patch set ..."
+ sed -i \
+ -e "s/const struct sshcipher/struct sshcipher/" \
+ "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
+ fi
+
+ if use X509 || use sctp || use ldap || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+ eapply "${WORKDIR}"/patch/*.patch
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use sctp && use_with sctp)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.5 sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-04-11 23:54 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-04-11 23:54 UTC (permalink / raw
To: gentoo-commits
commit: a9911ca75fca79e9f8e36d3c25f7e5f504b2c32b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 11 23:53:46 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Apr 11 23:53:59 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a9911ca7
net-misc/openssh: Fix X.509 support
The X.509 part in sshd only accepts specific PACKAGE VERSION values or will
reject a X.509 ssh client. Because we cannot fix all X.509 sshd servers
we patched the exposed PACKAGE VERSION to pass the "requirement".
Package-Manager: Portage-2.3.28, Repoman-2.3.9
.../{openssh-7.7_p1.ebuild => openssh-7.7_p1-r1.ebuild} | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-7.7_p1.ebuild b/net-misc/openssh/openssh-7.7_p1-r1.ebuild
similarity index 96%
rename from net-misc/openssh/openssh-7.7_p1.ebuild
rename to net-misc/openssh/openssh-7.7_p1-r1.ebuild
index ba76b889200..cfcfc30327f 100644
--- a/net-misc/openssh/openssh-7.7_p1.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r1.ebuild
@@ -20,7 +20,7 @@ X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="https://www.openssh.com/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH}}
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
@@ -115,6 +115,14 @@ src_prepare() {
if use X509 ; then
eapply "${WORKDIR}"/${X509_PATCH%.*}
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
einfo "Patching version.h to expose X.509 patch set ..."
sed -i \
-e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
@@ -209,6 +217,8 @@ src_prepare() {
"${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
fi
+ eapply_user #473004
+
tc-export PKG_CONFIG
local sed_args=(
-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
@@ -229,8 +239,6 @@ src_prepare() {
)
sed -i "${sed_args[@]}" configure{.ac,} || die
- eapply_user #473004
-
eautoreconf
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-03-12 15:51 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2018-03-12 15:51 UTC (permalink / raw
To: gentoo-commits
commit: 5708895e5642db959606727c10376da3660df5fa
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 12 15:51:47 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Mon Mar 12 15:51:47 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5708895e
net-misc/openssh: Removed old.
Package-Manager: Portage-2.3.24, Repoman-2.3.6
net-misc/openssh/Manifest | 3 -
net-misc/openssh/openssh-7.6_p1-r2.ebuild | 336 ------------------------------
net-misc/openssh/openssh-7.6_p1-r3.ebuild | 336 ------------------------------
net-misc/openssh/openssh-7.6_p1.ebuild | 336 ------------------------------
4 files changed, 1011 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index e1e0dbe4f79..299ae83a14c 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -3,11 +3,8 @@ DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc2
DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e774ac7423e2f4439f2adf585aae18fcf55d63f7f5421e716d76e2dd0205b186b6fea1f53132453ea82f0821cea3124c SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151
-DIST openssh-7.6p1+x509-11.0.diff.gz 440219 BLAKE2B 9329a7cf8575c21c31ec73f8ca1084708de34a5b530699d8be2a2a75e1ce0d37210a897c894ab75ee8e2ad0f0802d483d041b1bf3cf3ea46a4a423f1350f42d2 SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a
-DIST openssh-7.6p1+x509-11.1.diff.gz 451725 BLAKE2B 1397c05539ce7532f5e6bf33fc16d5661c32365e127ab1134c0a12c70f0645b05eb05d3ebd9bf64ed59cb94a63cbe8466ac87c9831605230d1ccd578a736904b SHA512 8d445911d8b28fb922a2a0ddb4b7783f81bc258af708148541d30cb79012789cc319bc2031b4584c4c5504480b70077e675be01070fd3065dc4f5ddee89ad8f1
DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
-DIST openssh-7.6p1-hpnssh14v12.tar.xz 15392 BLAKE2B 6888ea4054a470116b2ab3d115f54e3ee54e0d05a24d3331613c241e684a43354b6100ee2be76e5b2dcc8f0444fbae5d146830d634e53a85124d5e553759a552 SHA512 0e2c62cdec360090b359edfd5bbe894fb25d22e387677e8a5d6cf6a0807b0572fda30b90c30390d5b68e359e9958cb1c65abae4afd9af5892c3f64f6f8001956
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 BLAKE2B a31dcb15848d3a22306108a4e181b1d52b195e6adcd2a78d5c7bf57f33c8ed62c3affa434c8d31c07eae84b59f1a3968a3f2a92e702f9225b121127616cb9d61 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974
diff --git a/net-misc/openssh/openssh-7.6_p1-r2.ebuild b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
deleted file mode 100644
index ce99373986b..00000000000
--- a/net-misc/openssh/openssh-7.6_p1-r2.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
- popd >/dev/null
- fi
- save_version X509
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.6_p1-r3.ebuild b/net-misc/openssh/openssh-7.6_p1-r3.ebuild
deleted file mode 100644
index 131e6e1da0d..00000000000
--- a/net-misc/openssh/openssh-7.6_p1-r3.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12-r1.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~chutzpah/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~chutzpah/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
- popd >/dev/null
- save_version X509
- fi
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
deleted file mode 100644
index ff5b2fc3ad5..00000000000
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
- popd >/dev/null
- fi
- save_version X509
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-02-12 21:13 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2018-02-12 21:13 UTC (permalink / raw
To: gentoo-commits
commit: 50ccbb3251ea10558847f973ce0a8af5cdad4fba
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 12 21:13:27 2018 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Mon Feb 12 21:13:45 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=50ccbb32
net-misc/openssh: Manifest update for X509 11.2
I forgot about the wget gzip silliness.. oops
Package-Manager: Portage-2.3.24, Repoman-2.3.6
net-misc/openssh/Manifest | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 46bd6e354ab..e1e0dbe4f79 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -5,7 +5,7 @@ DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551
DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e774ac7423e2f4439f2adf585aae18fcf55d63f7f5421e716d76e2dd0205b186b6fea1f53132453ea82f0821cea3124c SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151
DIST openssh-7.6p1+x509-11.0.diff.gz 440219 BLAKE2B 9329a7cf8575c21c31ec73f8ca1084708de34a5b530699d8be2a2a75e1ce0d37210a897c894ab75ee8e2ad0f0802d483d041b1bf3cf3ea46a4a423f1350f42d2 SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a
DIST openssh-7.6p1+x509-11.1.diff.gz 451725 BLAKE2B 1397c05539ce7532f5e6bf33fc16d5661c32365e127ab1134c0a12c70f0645b05eb05d3ebd9bf64ed59cb94a63cbe8466ac87c9831605230d1ccd578a736904b SHA512 8d445911d8b28fb922a2a0ddb4b7783f81bc258af708148541d30cb79012789cc319bc2031b4584c4c5504480b70077e675be01070fd3065dc4f5ddee89ad8f1
-DIST openssh-7.6p1+x509-11.2.diff.gz 451725 BLAKE2B 1397c05539ce7532f5e6bf33fc16d5661c32365e127ab1134c0a12c70f0645b05eb05d3ebd9bf64ed59cb94a63cbe8466ac87c9831605230d1ccd578a736904b SHA512 8d445911d8b28fb922a2a0ddb4b7783f81bc258af708148541d30cb79012789cc319bc2031b4584c4c5504480b70077e675be01070fd3065dc4f5ddee89ad8f1
+DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
DIST openssh-7.6p1-hpnssh14v12.tar.xz 15392 BLAKE2B 6888ea4054a470116b2ab3d115f54e3ee54e0d05a24d3331613c241e684a43354b6100ee2be76e5b2dcc8f0444fbae5d146830d634e53a85124d5e553759a552 SHA512 0e2c62cdec360090b359edfd5bbe894fb25d22e387677e8a5d6cf6a0807b0572fda30b90c30390d5b68e359e9958cb1c65abae4afd9af5892c3f64f6f8001956
DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-24 20:50 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2018-01-24 20:50 UTC (permalink / raw
To: gentoo-commits
commit: 9727acf437bf1b7cf3f44c7ed4b7dc443da7af0b
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 24 20:50:21 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Wed Jan 24 20:50:36 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9727acf4
net-misc/openssh: Revbump to reflect --dynamic-deps=n change in portage.
Closes: https://bugs.gentoo.org/645372
Package-Manager: Portage-2.3.20, Repoman-2.3.6
net-misc/openssh/{openssh-7.5_p1-r3.ebuild => openssh-7.5_p1-r4.ebuild} | 0
1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
similarity index 100%
rename from net-misc/openssh/openssh-7.5_p1-r3.ebuild
rename to net-misc/openssh/openssh-7.5_p1-r4.ebuild
^ permalink raw reply [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-23 23:58 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2018-01-23 23:58 UTC (permalink / raw
To: gentoo-commits
commit: f6d73a3f9bc20eb812ea0b6f3da6f14aeabcdbcd
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 23 23:58:39 2018 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Tue Jan 23 23:58:39 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f6d73a3f
net-misc/openssh: Update SRC_URI for hpn patchset so it is fetchable
Package-Manager: Portage-2.3.20, Repoman-2.3.6
net-misc/openssh/openssh-7.6_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.6_p1-r3.ebuild b/net-misc/openssh/openssh-7.6_p1-r3.ebuild
index d68f65f1d37..0fb4aa2b639 100644
--- a/net-misc/openssh/openssh-7.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r3.ebuild
@@ -18,7 +18,7 @@ DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="http://www.openssh.org/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
+ ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~chutzpah/${HPN_PATCH} )}
${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
${X509_PATCH:+X509? ( https://dev.gentoo.org/~chutzpah/${X509_PATCH} )}
"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-22 9:22 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2018-01-22 9:22 UTC (permalink / raw
To: gentoo-commits
commit: d3b054fa3752653efb16ba2823831b3084589e43
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 22 09:22:00 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Mon Jan 22 09:22:00 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d3b054fa
net-misc/openssh: Revbump without messing with HPN.
@zmedico: Please leave openssh to base-system team.
Package-Manager: Portage-2.3.20, Repoman-2.3.6
net-misc/openssh/{openssh-7.6_p1-r1.ebuild => openssh-7.6_p1-r2.ebuild} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.6_p1-r1.ebuild b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.6_p1-r1.ebuild
rename to net-misc/openssh/openssh-7.6_p1-r2.ebuild
index 6cc76cb2541..1b63bd1c5b7 100644
--- a/net-misc/openssh/openssh-7.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=6
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-22 9:22 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2018-01-22 9:22 UTC (permalink / raw
To: gentoo-commits
commit: c39f238a2a542775be7c258de23beeef708d97e2
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 22 09:19:07 2018 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Mon Jan 22 09:19:07 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c39f238a
Revert "net-misc/openssh: revbumps for net-libs/ldns dep change"
This reverts commit de02520f0c9d660af8a2cd0317648f69177f57c1.
.../openssh/{openssh-7.5_p1-r4.ebuild => openssh-7.5_p1-r3.ebuild} | 0
.../openssh/{openssh-7.6_p1-r2.ebuild => openssh-7.6_p1-r1.ebuild} | 6 +++---
.../openssh/{openssh-7.6_p1-r2.ebuild => openssh-7.6_p1.ebuild} | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
similarity index 100%
rename from net-misc/openssh/openssh-7.5_p1-r4.ebuild
rename to net-misc/openssh/openssh-7.5_p1-r3.ebuild
diff --git a/net-misc/openssh/openssh-7.6_p1-r2.ebuild b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
similarity index 97%
copy from net-misc/openssh/openssh-7.6_p1-r2.ebuild
copy to net-misc/openssh/openssh-7.6_p1-r1.ebuild
index 85aa2df1bc1..6cc76cb2541 100644
--- a/net-misc/openssh/openssh-7.6_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=6
@@ -9,7 +9,7 @@ inherit user flag-o-matic multilib autotools pam systemd versionator
# and _p? releases.
PARCH=${P/_}
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
+#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
@@ -27,7 +27,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
static? ( !kerberos !pam )
diff --git a/net-misc/openssh/openssh-7.6_p1-r2.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-7.6_p1-r2.ebuild
rename to net-misc/openssh/openssh-7.6_p1.ebuild
index 85aa2df1bc1..490a91163fa 100644
--- a/net-misc/openssh/openssh-7.6_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=6
@@ -27,7 +27,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
static? ( !kerberos !pam )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-22 2:22 Zac Medico
0 siblings, 0 replies; 441+ messages in thread
From: Zac Medico @ 2018-01-22 2:22 UTC (permalink / raw
To: gentoo-commits
commit: de02520f0c9d660af8a2cd0317648f69177f57c1
Author: Zac Medico <zmedico <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 22 02:10:08 2018 +0000
Commit: Zac Medico <zmedico <AT> gentoo <DOT> org>
CommitDate: Mon Jan 22 02:18:16 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de02520f
net-misc/openssh: revbumps for net-libs/ldns dep change
Since sys-apps/portage-2.3.20 defaults to --dynamic-deps=n, this revbump
is needed in order to correct the dependencies of installed instances of
openssh.
It's not possible to revbump the 7.6_p1 ebuild to 7.6_p1-r1, since the
7.6_p1-r1 ebuild already exists with the only difference being that
the HPN_PATCH variable is commented out. As a compromise, make 7.6_p1-r2
include HPN_PATCH but also remove the default IUSE setting for hpn in
order to suppress bug 634594 by default.
Fixes: a71042d76cb4 ("net-misc/openssh: Fix net-libs/ldns dependency")
Bug: https://bugs.gentoo.org/645310
Bug: https://bugs.gentoo.org/634594
Package-Manager: Portage-2.3.20, Repoman-2.3.6
RepoMan-Options: --force
...h-7.5_p1-r3.ebuild => openssh-7.5_p1-r4.ebuild} | 0
net-misc/openssh/openssh-7.6_p1-r1.ebuild | 336 ---------------------
...nssh-7.6_p1.ebuild => openssh-7.6_p1-r2.ebuild} | 4 +-
3 files changed, 2 insertions(+), 338 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
similarity index 100%
rename from net-misc/openssh/openssh-7.5_p1-r3.ebuild
rename to net-misc/openssh/openssh-7.5_p1-r4.ebuild
diff --git a/net-misc/openssh/openssh-7.6_p1-r1.ebuild b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
deleted file mode 100644
index 6cc76cb2541..00000000000
--- a/net-misc/openssh/openssh-7.6_p1-r1.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- eapply "${FILESDIR}/${P}-warnings.patch"
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
- popd >/dev/null
- fi
- save_version X509
- eapply "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
- use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- elog "Applying HPN patchset ..."
- eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eapply_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- # remove this if aes-ctr-mt gets fixed
- if use hpn; then
- elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
- elog "set since it does not (yet) work with >=openssh-7.6p1."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
similarity index 98%
rename from net-misc/openssh/openssh-7.6_p1.ebuild
rename to net-misc/openssh/openssh-7.6_p1-r2.ebuild
index 490a91163fa..85aa2df1bc1 100644
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=6
@@ -27,7 +27,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
static? ( !kerberos !pam )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-12 13:31 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2018-01-12 13:31 UTC (permalink / raw
To: gentoo-commits
commit: 16d75c9f2126651d2d65ab9bdbd7dacfbe1065c8
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 12 13:30:34 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Jan 12 13:30:34 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16d75c9f
net-misc/openssh: Exclude s390-seccomp.patch w/ USE=X509 - already in X509 patch set
Closes: https://bugs.gentoo.org/644252
Package-Manager: Portage-2.3.19, Repoman-2.3.6
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 1f173bc6211..a3c62aa567f 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI="5"
@@ -132,7 +132,7 @@ src_prepare() {
epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
epatch "${FILESDIR}"/${PN}-7.5_p1-CVE-2017-15906.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-s390-seccomp.patch
+ use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-s390-seccomp.patch # already included in X509 patch set, #644252
use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2018-01-10 8:35 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2018-01-10 8:35 UTC (permalink / raw
To: gentoo-commits
commit: e65003579e31be4ff949cfa66df2511ecd4c44a0
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 10 08:28:35 2018 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Wed Jan 10 08:34:18 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e6500357
net-misc/openssh: mark 7.5_p1-r3 m68k/s390/sh stable
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 83dcb1db429..1f173bc6211 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-12-24 9:46 Mart Raudsepp
0 siblings, 0 replies; 441+ messages in thread
From: Mart Raudsepp @ 2017-12-24 9:46 UTC (permalink / raw
To: gentoo-commits
commit: 40862f831832067cfadff5ba850be85b94008794
Author: Mart Raudsepp <leio <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 24 09:29:53 2017 +0000
Commit: Mart Raudsepp <leio <AT> gentoo <DOT> org>
CommitDate: Sun Dec 24 09:29:53 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40862f83
net-misc/openssh-7.5_p1-r3: arm64 stable
Package-Manager: Portage-2.3.19, Repoman-2.3.6
RepoMan-Options: --include-arches="arm64"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 5ae4d45a76f..0dbe3c7fa22 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-12-18 19:01 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2017-12-18 19:01 UTC (permalink / raw
To: gentoo-commits
commit: 8dbe1ec73a60071f840ea0df9a45514db797f448
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 18 18:48:39 2017 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Dec 18 19:00:47 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8dbe1ec7
net-misc/openssh: Security cleanup (bug #633428)
Package-Manager: Portage-2.3.19, Repoman-2.3.6
net-misc/openssh/Manifest | 1 -
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 332 ------------------------------
net-misc/openssh/openssh-7.5_p1-r2.ebuild | 331 -----------------------------
3 files changed, 664 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 7e3951e9553..c8d339eba7b 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,5 +1,4 @@
DIST openssh-7.4_p1-sctp.patch.xz 8220 BLAKE2B 2d571cacaab342b7950b42ec826bd896edf78780e9ee73fcd441cbc9764eb59e408e295062862db986918824d10498383bf34ae7c93df0da2c056eaec4d2c031 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4
-DIST openssh-7.5p1+x509-10.1.diff.gz 460721 BLAKE2B e3bd5f6539647327d35c90bf0ebf86559a00bf426f49dca4d7d0580d02e0727fe78177974ccddb6103c0e75752165cf51a96f721203dd9c23dce6648431c501e SHA512 d3b5a8f5e3a88eda7989b002236811867b7e2c39bf7cd29a6dbbce277fca3fbedbfdbeaf1fba7d8c19f3dea32a17790e90604765f18576bcc5627a9c1d39109c
DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc266d1a450d298563bfc6ce705ec2829b8f9d91af5c5232941d55004b5aea2d3e0fb682a9d4acd9510c9761ba7ede2f2f0e37f SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a
DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
deleted file mode 100644
index 553f37b620d..00000000000
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ /dev/null
@@ -1,332 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
-X509_VER="10.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- fi
- save_version X509
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- use libressl && epatch "${FILESDIR}"/${PN}-7.5p1-x509-libressl.patch
- fi
-
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
- use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
- use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
- use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.5_p1-r2.ebuild b/net-misc/openssh/openssh-7.5_p1-r2.ebuild
deleted file mode 100644
index c5d657ba7c1..00000000000
--- a/net-misc/openssh/openssh-7.5_p1-r2.ebuild
+++ /dev/null
@@ -1,331 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
-X509_VER="10.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- fi
- save_version X509
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- fi
-
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
- use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
- use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
- use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-12-18 19:01 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2017-12-18 19:01 UTC (permalink / raw
To: gentoo-commits
commit: a71042d76cb47d5e92ab5b0092a5cef0a1593a1d
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 18 19:00:31 2017 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Mon Dec 18 19:00:49 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a71042d7
net-misc/openssh: Fix net-libs/ldns dependency
Closes: https://bugs.gentoo.org/641266
Package-Manager: Portage-2.3.19, Repoman-2.3.6
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 4 ++--
net-misc/openssh/openssh-7.6_p1-r1.ebuild | 4 ++--
net-misc/openssh/openssh-7.6_p1.ebuild | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 23a802dd3e3..5ae4d45a76f 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -39,8 +39,8 @@ LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
diff --git a/net-misc/openssh/openssh-7.6_p1-r1.ebuild b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
index 8bf58476566..6cc76cb2541 100644
--- a/net-misc/openssh/openssh-7.6_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
@@ -38,8 +38,8 @@ LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
index a932f59b746..490a91163fa 100644
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1.ebuild
@@ -38,8 +38,8 @@ LIB_DEPEND="
audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
)
libedit? ( dev-libs/libedit:=[static-libs(+)] )
sctp? ( net-misc/lksctp-tools[static-libs(+)] )
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-19 19:57 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-11-19 19:57 UTC (permalink / raw
To: gentoo-commits
commit: 691fd0b9cd4a71dc6e0a05e44e8c4b01ca25a6ca
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 19 19:57:35 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sun Nov 19 19:57:43 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=691fd0b9
net-misc/openssh: stable 7.5_p1-r3 for hppa, bug #633428
Package-Manager: Portage-2.3.14, Repoman-2.3.6
RepoMan-Options: --include-arches="hppa"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 94ecf1c62fe..23a802dd3e3 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-19 19:47 Markus Meier
0 siblings, 0 replies; 441+ messages in thread
From: Markus Meier @ 2017-11-19 19:47 UTC (permalink / raw
To: gentoo-commits
commit: e454d334cb1c07d4214bb703332f34a1f84c74b6
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 19 19:45:52 2017 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Sun Nov 19 19:45:52 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e454d334
net-misc/openssh: arm stable, bug #633428
Package-Manager: Portage-2.3.13, Repoman-2.3.3
RepoMan-Options: --include-arches="arm"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 0599615e5f4..94ecf1c62fe 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-19 18:48 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-11-19 18:48 UTC (permalink / raw
To: gentoo-commits
commit: 2bad8079296c46c4d46a1947eefa1926da7087f4
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 19 18:46:49 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sun Nov 19 18:48:32 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2bad8079
net-misc/openssh: stable 7.5_p1-r3 for ppc, bug #633428
Package-Manager: Portage-2.3.14, Repoman-2.3.6
RepoMan-Options: --include-arches="ppc"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 7ec593e326e..0599615e5f4 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-18 12:42 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-11-18 12:42 UTC (permalink / raw
To: gentoo-commits
commit: 86f9cf341c4271371dc59a115cccc4f5fc1fd760
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 18 10:35:48 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sat Nov 18 12:42:11 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=86f9cf34
net-misc/openssh: stable 7.5_p1-r3 for ppc64, bug #633428
Package-Manager: Portage-2.3.14, Repoman-2.3.6
RepoMan-Options: --include-arches="ppc64"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 112076e908f..7ec593e326e 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-18 10:32 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-11-18 10:32 UTC (permalink / raw
To: gentoo-commits
commit: 53e114e61ab891a87c2a1dd8cf2017409dd60dda
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 18 10:32:30 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sat Nov 18 10:32:35 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=53e114e6
net-misc/openssh: stable 7.5_p1-r3 for sparc, bug #633428 (thanks to Rolf Eike Beer)
Package-Manager: Portage-2.3.14, Repoman-2.3.6
RepoMan-Options: --include-arches="sparc"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 7cbd2d82f79..112076e908f 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-17 11:18 Tobias Klausmann
0 siblings, 0 replies; 441+ messages in thread
From: Tobias Klausmann @ 2017-11-17 11:18 UTC (permalink / raw
To: gentoo-commits
commit: 67c6ffd250d10628d32f537cb96e8c43323dc32d
Author: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 17 11:17:54 2017 +0000
Commit: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
CommitDate: Fri Nov 17 11:17:54 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=67c6ffd2
net-misc/openssh-7.5_p1-r3: alpha stable
Gentoo-Bug: http://bugs.gentoo.org/633428
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index e08de17a714..7cbd2d82f79 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-16 19:43 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-11-16 19:43 UTC (permalink / raw
To: gentoo-commits
commit: 0cf68927f8072ddc7fec23d971b72e7539b5a004
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 16 19:38:24 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Thu Nov 16 19:43:16 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0cf68927
net-misc/openssh: stable 7.5_p1-r3 for ia64, bug #633428
Package-Manager: Portage-2.3.14, Repoman-2.3.6
RepoMan-Options: --include-arches="ia64"
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index f4089727b01..e08de17a714 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-16 1:36 Thomas Deutschmann
0 siblings, 0 replies; 441+ messages in thread
From: Thomas Deutschmann @ 2017-11-16 1:36 UTC (permalink / raw
To: gentoo-commits
commit: 730dc47fba6a138b214256f95bd3d89556272f4c
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 16 01:26:09 2017 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Nov 16 01:26:09 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=730dc47f
net-misc/openssh: x86 stable (bug #633428)
Package-Manager: Portage-2.3.13, Repoman-2.3.4
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index 2294d5a005b..f4089727b01 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-15 21:01 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2017-11-15 21:01 UTC (permalink / raw
To: gentoo-commits
commit: 61f68e048abab1e13bce36e6165adbba88755b54
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 15 21:01:23 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Nov 15 21:01:23 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=61f68e04
net-misc/openssh: amd64 stable wrt bug #633428
Package-Manager: Portage-2.3.13, Repoman-2.3.3
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r3.ebuild b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
index d9cb2ffe89b..2294d5a005b 100644
--- a/net-misc/openssh/openssh-7.5_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r3.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-07 18:42 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2017-11-07 18:42 UTC (permalink / raw
To: gentoo-commits
commit: 9cd0550422415ec40e4bf7c04acca139e9dee75c
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 7 18:42:10 2017 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Tue Nov 7 18:42:10 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9cd05504
net-misc/openssh: Restore 7.6_p1-r0 ebuild
Some users aren't affected by bug #634594, rather than forcing them
to downgrade or fork, we should keep the ebuild with hpn around.
Bug: https://bugs.gentoo.org/634594
Package-Manager: Portage-2.3.13, Repoman-2.3.4
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.6_p1.ebuild | 336 +++++++++++++++++++++++++++++++++
2 files changed, 337 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index df01594ce28..c9efd08b421 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -5,6 +5,7 @@ DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 SHA256 8a1ed99c121a4ad21d7a26cd32627
DIST openssh-7.5p1.tar.gz 1510857 SHA256 9846e3c5fab9f0547400b4d2c017992f914222b3fd1f8eee6c7dc6bc5e59f9f0 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81 WHIRLPOOL 1a42c68d8e350bc4790dd4c1a98dd6571bfa353ad6871b1462c53b6412f752719daabd1a13bb4434d294de966a00428ac66334bab45f371420029b5e34a6914c
DIST openssh-7.6_p1-sctp.patch.xz 6996 SHA256 ca61f0b015d2f7131620a2a4901800b70026755a52a7b882d437cd9813c2652d SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151 WHIRLPOOL 27125d4a7d45f0bc67f424598542cf97e123824bce7911732891531b6a0aa37b7598f636e1643a6114626c2ccc622a50928ffcdb4357c7dc3d9c3d8c161d9626
DIST openssh-7.6p1+x509-11.0.diff.gz 440219 SHA256 bc4175ed8efce14579f10e242b25a23c959b1ff0e63b7c15493503eb654a960e SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a WHIRLPOOL 1b324f72a6cb0c895b3994d59f3505ff2a4a0529829cea07344a33a68ee4d43c22ba534a55454792618cd9f766cd40fa5af73cc054ee3a08bccdb6e8d0073b29
+DIST openssh-7.6p1-hpnssh14v12.tar.xz 15392 SHA256 4ccb05096556233d81b68b330463ef2bd84384734ff3a8693ad28ac2d4681227 SHA512 0e2c62cdec360090b359edfd5bbe894fb25d22e387677e8a5d6cf6a0807b0572fda30b90c30390d5b68e359e9958cb1c65abae4afd9af5892c3f64f6f8001956 WHIRLPOOL c7bdc79d849bacaf1a6fb262a11b3b6cf905e95c11e9818c4434559fcea3bc5273496bb8d29e3a5edb116420b4dabc3ef17789e66864c488006c660331c18bc4
DIST openssh-7.6p1.tar.gz 1489788 SHA256 a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72 WHIRLPOOL 537b94555c7b36b2f7ef2ecd89e6671028f7cff9be758e631690ecd068510d59d6518077bf951e779e3c8a39706adb1682c6d5305edd6fc611ec19ce7953c751
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93
DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 SHA256 fd877cf084d4eb682c503b6e5f363b0564da2b50561367558a50ab239adf4017 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974 WHIRLPOOL 8410dc9dad24d8b3065ba85e7a7a66322b4d37eac0ef68e72143afa3aba2706e91c324798236b9d3e320e6903d27a7e426621bde92ded89ce26a16535e8c3d3c
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
new file mode 100644
index 00000000000..a932f59b746
--- /dev/null
+++ b/net-misc/openssh/openssh-7.6_p1.ebuild
@@ -0,0 +1,336 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
+SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
+X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
+ ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ eapply "${FILESDIR}/${P}-warnings.patch"
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ if use hpn ; then
+ pushd "${WORKDIR}" >/dev/null
+ eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
+ eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
+ popd >/dev/null
+ fi
+ save_version X509
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ fi
+
+ if use ldap ; then
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+
+ eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+ use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
+
+ if use hpn ; then
+ elog "Applying HPN patchset ..."
+ eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eapply_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use X509 || use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ # remove this if aes-ctr-mt gets fixed
+ if use hpn; then
+ elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
+ elog "set since it does not (yet) work with >=openssh-7.6p1."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-11-07 13:34 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2017-11-07 13:34 UTC (permalink / raw
To: gentoo-commits
commit: c550123e50c1cad20d35758dfe3ba9fb29b9af3a
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 7 13:34:10 2017 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Tue Nov 7 13:34:34 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c550123e
net-misc/openssh: Revbump to remove hpn support (breaks scp transfers)
Bug: https://bugs.gentoo.org/634594
Package-Manager: Portage-2.3.13, Repoman-2.3.4
net-misc/openssh/Manifest | 1 -
net-misc/openssh/{openssh-7.6_p1.ebuild => openssh-7.6_p1-r1.ebuild} | 2 +-
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index c9efd08b421..df01594ce28 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -5,7 +5,6 @@ DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 SHA256 8a1ed99c121a4ad21d7a26cd32627
DIST openssh-7.5p1.tar.gz 1510857 SHA256 9846e3c5fab9f0547400b4d2c017992f914222b3fd1f8eee6c7dc6bc5e59f9f0 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81 WHIRLPOOL 1a42c68d8e350bc4790dd4c1a98dd6571bfa353ad6871b1462c53b6412f752719daabd1a13bb4434d294de966a00428ac66334bab45f371420029b5e34a6914c
DIST openssh-7.6_p1-sctp.patch.xz 6996 SHA256 ca61f0b015d2f7131620a2a4901800b70026755a52a7b882d437cd9813c2652d SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151 WHIRLPOOL 27125d4a7d45f0bc67f424598542cf97e123824bce7911732891531b6a0aa37b7598f636e1643a6114626c2ccc622a50928ffcdb4357c7dc3d9c3d8c161d9626
DIST openssh-7.6p1+x509-11.0.diff.gz 440219 SHA256 bc4175ed8efce14579f10e242b25a23c959b1ff0e63b7c15493503eb654a960e SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a WHIRLPOOL 1b324f72a6cb0c895b3994d59f3505ff2a4a0529829cea07344a33a68ee4d43c22ba534a55454792618cd9f766cd40fa5af73cc054ee3a08bccdb6e8d0073b29
-DIST openssh-7.6p1-hpnssh14v12.tar.xz 15392 SHA256 4ccb05096556233d81b68b330463ef2bd84384734ff3a8693ad28ac2d4681227 SHA512 0e2c62cdec360090b359edfd5bbe894fb25d22e387677e8a5d6cf6a0807b0572fda30b90c30390d5b68e359e9958cb1c65abae4afd9af5892c3f64f6f8001956 WHIRLPOOL c7bdc79d849bacaf1a6fb262a11b3b6cf905e95c11e9818c4434559fcea3bc5273496bb8d29e3a5edb116420b4dabc3ef17789e66864c488006c660331c18bc4
DIST openssh-7.6p1.tar.gz 1489788 SHA256 a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72 WHIRLPOOL 537b94555c7b36b2f7ef2ecd89e6671028f7cff9be758e631690ecd068510d59d6518077bf951e779e3c8a39706adb1682c6d5305edd6fc611ec19ce7953c751
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93
DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 SHA256 fd877cf084d4eb682c503b6e5f363b0564da2b50561367558a50ab239adf4017 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974 WHIRLPOOL 8410dc9dad24d8b3065ba85e7a7a66322b4d37eac0ef68e72143afa3aba2706e91c324798236b9d3e320e6903d27a7e426621bde92ded89ce26a16535e8c3d3c
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
similarity index 99%
rename from net-misc/openssh/openssh-7.6_p1.ebuild
rename to net-misc/openssh/openssh-7.6_p1-r1.ebuild
index a932f59b746..8bf58476566 100644
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r1.ebuild
@@ -9,7 +9,7 @@ inherit user flag-o-matic multilib autotools pam systemd versionator
# and _p? releases.
PARCH=${P/_}
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
+#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-10-11 7:57 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2017-10-11 7:57 UTC (permalink / raw
To: gentoo-commits
commit: 5d83548d5c351de391e187c02a8ec10102a0c890
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 11 07:57:38 2017 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Wed Oct 11 07:57:38 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5d83548d
net-misc/openssh: Added revised ldap patch (bug #633942).
Thanks to Thomas (Whissi) Deutschmann for the fix.
Package-Manager: Portage-2.3.11, Repoman-2.3.3
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.6_p1.ebuild | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 7f5afd1e1c2..df01594ce28 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,3 +7,4 @@ DIST openssh-7.6_p1-sctp.patch.xz 6996 SHA256 ca61f0b015d2f7131620a2a4901800b700
DIST openssh-7.6p1+x509-11.0.diff.gz 440219 SHA256 bc4175ed8efce14579f10e242b25a23c959b1ff0e63b7c15493503eb654a960e SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a WHIRLPOOL 1b324f72a6cb0c895b3994d59f3505ff2a4a0529829cea07344a33a68ee4d43c22ba534a55454792618cd9f766cd40fa5af73cc054ee3a08bccdb6e8d0073b29
DIST openssh-7.6p1.tar.gz 1489788 SHA256 a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72 WHIRLPOOL 537b94555c7b36b2f7ef2ecd89e6671028f7cff9be758e631690ecd068510d59d6518077bf951e779e3c8a39706adb1682c6d5305edd6fc611ec19ce7953c751
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93
+DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 SHA256 fd877cf084d4eb682c503b6e5f363b0564da2b50561367558a50ab239adf4017 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974 WHIRLPOOL 8410dc9dad24d8b3065ba85e7a7a66322b4d37eac0ef68e72143afa3aba2706e91c324798236b9d3e320e6903d27a7e426621bde92ded89ce26a16535e8c3d3c
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
index ab6ae787886..1c315b793a6 100644
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1.ebuild
@@ -11,7 +11,7 @@ PARCH=${P/_}
#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
DESCRIPTION="Port of OpenBSD's free SSH release"
@@ -19,7 +19,7 @@ HOMEPAGE="http://www.openssh.org/"
SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-10-10 13:26 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2017-10-10 13:26 UTC (permalink / raw
To: gentoo-commits
commit: aaa37b169cf5b8c7d913cfcdbad7dcb2bf895b08
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 10 13:21:42 2017 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Tue Oct 10 13:25:44 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aaa37b16
net-misc/openssh: Bump to version 7.6_p1
(without hpn patch for now as that requires bigger rewrites due to
ssh1 removal)
Package-Manager: Portage-2.3.11, Repoman-2.3.3
net-misc/openssh/Manifest | 3 +
net-misc/openssh/openssh-7.6_p1.ebuild | 327 +++++++++++++++++++++++++++++++++
2 files changed, 330 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index fea58b79229..981be351b29 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -10,6 +10,9 @@ DIST openssh-7.5p1+x509-10.1.diff.gz 460721 SHA256 e7abe401e7f651779c680491cfefb
DIST openssh-7.5p1+x509-10.2.diff.gz 467040 SHA256 24d5c1949d245b432abf2db6c28554a09bcffdcb4f4247826c0a33bdbee8b92c SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a WHIRLPOOL 3291a3e39b1a47efe149cdf805de11217fd55c4260477f2a6c6cc0bfa376b98a5dc7f56a49ae184fb57bae6226c73d1794db7b2285e3ea26a8fea4bc9304655b
DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 SHA256 8a1ed99c121a4ad21d7a26cd32627a8dd51595fd3ee9f95dc70e6b50fe779ce2 SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9 WHIRLPOOL 6089ad8ae16c112a6f15d168c092e7f057b9e6d815724346b5a6a1cd0de932f779d5f410d48c904d935fcb3bad3f597fa4de075ab1f49cadc9842ce7bd8fdf42
DIST openssh-7.5p1.tar.gz 1510857 SHA256 9846e3c5fab9f0547400b4d2c017992f914222b3fd1f8eee6c7dc6bc5e59f9f0 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81 WHIRLPOOL 1a42c68d8e350bc4790dd4c1a98dd6571bfa353ad6871b1462c53b6412f752719daabd1a13bb4434d294de966a00428ac66334bab45f371420029b5e34a6914c
+DIST openssh-7.6_p1-sctp.patch.xz 6996 SHA256 ca61f0b015d2f7131620a2a4901800b70026755a52a7b882d437cd9813c2652d SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151 WHIRLPOOL 27125d4a7d45f0bc67f424598542cf97e123824bce7911732891531b6a0aa37b7598f636e1643a6114626c2ccc622a50928ffcdb4357c7dc3d9c3d8c161d9626
+DIST openssh-7.6p1+x509-11.0.diff.gz 440219 SHA256 bc4175ed8efce14579f10e242b25a23c959b1ff0e63b7c15493503eb654a960e SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a WHIRLPOOL 1b324f72a6cb0c895b3994d59f3505ff2a4a0529829cea07344a33a68ee4d43c22ba534a55454792618cd9f766cd40fa5af73cc054ee3a08bccdb6e8d0073b29
+DIST openssh-7.6p1.tar.gz 1489788 SHA256 a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72 WHIRLPOOL 537b94555c7b36b2f7ef2ecd89e6671028f7cff9be758e631690ecd068510d59d6518077bf951e779e3c8a39706adb1682c6d5305edd6fc611ec19ce7953c751
DIST openssh-lpk-7.3p1-0.3.14.patch.xz 17800 SHA256 cf1f60235cb8b0e561cd36cbf9e4f437e16fd748c2616d3f511c128c02deb76c SHA512 e9a73c5f13e41f6e11c744fdbcdb2e399c394479f79249e901cb3c101efb06f23d51d3ba4869db872184fa034a5910fc93a730fe906266c8d7409e39ad5b1ecd WHIRLPOOL bbdeadbed8f901148713bd9e4a082a4be2992c3151f995febd8be89bbb85d91185e1f0413b5a94a9340f2f404d18c9cee2aa6e032adaee0306aa1c624f6cc09c
DIST openssh-lpk-7.4p1-0.3.14.patch.xz 17076 SHA256 3a5e4104507d259ad15391136322ea5d067d7932199bbafde5cb478daf3595ad SHA512 1c91de291816ee0bb29ed3a2ffc42fb6fb4ba27a8616f8bd50accdf31d1fecc9b4fb3de6fb1ea6e722b69eb8cab68030ade87e126a4112667d14f3c2ef07d6cd WHIRLPOOL ea27224da952c6fe46b974a0e73d01e872a963e7e7cc7e9887a423357fb4ff82f4513ce48b6bbf7136afa8447bc6d93daa817cf5b2e24cb39dba15cbcff6d2cc
DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
new file mode 100644
index 00000000000..ab6ae787886
--- /dev/null
+++ b/net-misc/openssh/openssh-7.6_p1.ebuild
@@ -0,0 +1,327 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
+SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
+X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
+ ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !ldap !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-1.0.1:0=[bindist=]
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ if use hpn ; then
+ pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
+ eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
+ popd >/dev/null
+ fi
+ save_version X509
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ fi
+
+ if use ldap ; then
+ eapply "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+
+ eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+ use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
+
+ if use hpn ; then
+ elog "Applying HPN patchset ..."
+ eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eapply_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use X509 || use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-09-26 22:21 Sergei Trofimovich
0 siblings, 0 replies; 441+ messages in thread
From: Sergei Trofimovich @ 2017-09-26 22:21 UTC (permalink / raw
To: gentoo-commits
commit: dffa193c43f53fe2494308bccb6954c10e84738c
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 26 22:17:21 2017 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Tue Sep 26 22:21:17 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dffa193c
net-misc/openssh: stable 7.5_p1-r1 for hppa, bug #603100
Package-Manager: Portage-2.3.10, Repoman-2.3.3
RepoMan-Options: --include-arches="hppa"
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index 647f2448697..553f37b620d 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-09-06 21:00 Michał Górny
0 siblings, 0 replies; 441+ messages in thread
From: Michał Górny @ 2017-09-06 21:00 UTC (permalink / raw
To: gentoo-commits
commit: 0283264069cec143d7c559ef3533c243b2f65f37
Author: Francesco Turco <fturco <AT> fastmail <DOT> fm>
AuthorDate: Sun Sep 3 16:25:39 2017 +0000
Commit: Michał Górny <mgorny <AT> gentoo <DOT> org>
CommitDate: Wed Sep 6 20:59:11 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=02832640
net-misc/openssh: use HTTPS for links to dev.gentoo.org
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index 2773666ec4a..419efd3205b 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -22,7 +22,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
${HPN_PATCH:+hpn? (
mirror://gentoo/${HPN_PATCH}.xz
- http://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz
+ https://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz
)}
${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-27 1:26 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2017-06-27 1:26 UTC (permalink / raw
To: gentoo-commits
commit: dab716d567737f341d4bdbc64f81f4a3f6bfe260
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 27 01:26:26 2017 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Tue Jun 27 01:26:47 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dab716d5
net-misc/openssh: Drop libressl patch as it is no longer needed
Gentoo-Bug: 622660
Package-Manager: Portage-2.3.6, Repoman-2.3.2
net-misc/openssh/openssh-7.5_p1-r2.ebuild | 1 -
1 file changed, 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r2.ebuild b/net-misc/openssh/openssh-7.5_p1-r2.ebuild
index 4a79f547cf7..c5d657ba7c1 100644
--- a/net-misc/openssh/openssh-7.5_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r2.ebuild
@@ -121,7 +121,6 @@ src_prepare() {
fi
save_version X509
epatch "${WORKDIR}"/${X509_PATCH%.*}
- use libressl && epatch "${FILESDIR}"/${PN}-7.5p1-x509-libressl.patch
fi
if use ldap ; then
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-13 18:24 Markus Meier
0 siblings, 0 replies; 441+ messages in thread
From: Markus Meier @ 2017-06-13 18:24 UTC (permalink / raw
To: gentoo-commits
commit: c829fb10f45150a154b63ad3768a221a201fa4f6
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 13 18:24:00 2017 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Tue Jun 13 18:24:00 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c829fb10
net-misc/openssh: arm stable, bug #603100
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="arm"
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index 979eff65e7e..7156479c59a 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-13 12:31 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2017-06-13 12:31 UTC (permalink / raw
To: gentoo-commits
commit: 7b32b1ed5a1c02a530b94f4f5e5f3683d0259dbc
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 13 12:30:08 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Jun 13 12:31:33 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7b32b1ed
net-misc/openssh: ppc64 stable wrt bug #603100
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="ppc64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index f489805ca41..979eff65e7e 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-10 15:10 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2017-06-10 15:10 UTC (permalink / raw
To: gentoo-commits
commit: ea2aa27959eca3b9b15e9b49dc42a05dd1d657b4
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 10 15:09:45 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sat Jun 10 15:09:45 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea2aa279
net-misc/openssh: ia64 stable wrt bug #603100
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index 1b317ed4a37..f489805ca41 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-10 13:45 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2017-06-10 13:45 UTC (permalink / raw
To: gentoo-commits
commit: 812e3723bdfcf7f0e38617e9ad4d7d857f3ca48e
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 10 13:42:50 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sat Jun 10 13:42:50 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=812e3723
net-misc/openssh: sparc stable wrt bug #603100
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index 9abe3afa4fd..1b317ed4a37 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-06-09 12:41 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2017-06-09 12:41 UTC (permalink / raw
To: gentoo-commits
commit: 1a69f760875ca343774a866063a0418212978eaa
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 9 12:41:42 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Fri Jun 9 12:41:42 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1a69f760
net-misc/openssh: amd64 stable wrt bug #603100
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.5_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
index 4edbdffc4bb..9abe3afa4fd 100644
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
@@ -25,7 +25,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-02-10 1:49 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2017-02-10 1:49 UTC (permalink / raw
To: gentoo-commits
commit: e7693d34d59e51dc7fb767c9d06a2cbe75680586
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 10 01:48:29 2017 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Feb 10 01:48:45 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e7693d34
net-misc/openssh: add USE=audit support #607408
net-misc/openssh/openssh-7.4_p1.ebuild | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.4_p1.ebuild b/net-misc/openssh/openssh-7.4_p1.ebuild
index a21ea916d4..279169754d 100644
--- a/net-misc/openssh/openssh-7.4_p1.ebuild
+++ b/net-misc/openssh/openssh-7.4_p1.ebuild
@@ -27,7 +27,7 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
+IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
ssh1? ( ssl )
@@ -36,6 +36,7 @@ REQUIRED_USE="ldns? ( ssl )
test? ( ssl )"
LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
ldns? (
net-libs/ldns[static-libs(+)]
!bindist? ( net-libs/ldns[ecdsa,ssl] )
@@ -183,6 +184,7 @@ src_configure() {
--datadir="${EPREFIX}"/usr/share/openssh
--with-privsep-path="${EPREFIX}"/var/empty
--with-privsep-user=sshd
+ $(use_with audit audit linux)
$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
# We apply the ldap patch conditionally, so can't pass --without-ldap
# unconditionally else we get unknown flag warnings.
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-01-18 8:55 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2017-01-18 8:55 UTC (permalink / raw
To: gentoo-commits
commit: 4793a104771be5e982cbc628efbe8883d6576640
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 18 08:52:49 2017 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Wed Jan 18 08:55:30 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4793a104
net-misc/openssh: mark 7.3_p1-r7 arm64/m68k/s390/sh stable
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index 6c9b324..cfe459f 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-01-09 21:09 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2017-01-09 21:09 UTC (permalink / raw
To: gentoo-commits
commit: 72c64a401d9595aa1da76ae25eda2b9e13b5234a
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 9 19:36:50 2017 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Mon Jan 9 21:09:25 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=72c64a40
net-misc/openssh: Security cleanup (bug #597360)
Package-Manager: Portage-2.3.3, Repoman-2.3.1
Closes: https://github.com/gentoo/gentoo/pull/3405
net-misc/openssh/Manifest | 4 -
net-misc/openssh/openssh-7.2_p2-r1.ebuild | 334 ----------------------------
net-misc/openssh/openssh-7.2_p2.ebuild | 324 ---------------------------
net-misc/openssh/openssh-7.3_p1-r5.ebuild | 349 -----------------------------
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 351 ------------------------------
5 files changed, 1362 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index bf4a52a..a1a9c19 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,6 +1,3 @@
-DIST openssh-7.2_p1-sctp.patch.xz 8088 SHA256 b9cc21336e23d44548e87964da9ff85ac83ce84693162abb172afb46be4a666e SHA512 b287684337a101a26ab8df6894b679b063cdaa7dfc7b78fcc0ce8350c27526f150a6463c515019beb0af2ff005cc109d2913998f95f828e553b835a4df8b64df WHIRLPOOL 16646a896f746946af84961974be08418b951c80249dce2fd4ae533a4d66e79d4372fd979aeda9c51aff51b86edf4178af18379e948195696a6fa114e2757306
-DIST openssh-7.2p2+x509-8.9.diff.gz 449308 SHA256 bd77fcd285d10a86fb2934e90776fe39e4cd2da043384ec2ca45296a60669589 SHA512 c7ed07aae72fd4f967ab5717831c51ad639ca59633c3768f6930bab0947f5429391e3911a7570288a1c688c8c21747f3cb722538ae96de6b50a021010e1506fa WHIRLPOOL 7c1328e471b0e5e9576117ec563b66fea142886b0666b6d51ac9b8ec09286ba7a965b62796c32206e855e484180797a2c31d500c27289f3bc8c7db2d3af95e6f
-DIST openssh-7.2p2.tar.gz 1499808 SHA256 a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c SHA512 44f62b3a7bc50a0735d496a5aedeefb71550d8c10ad8f22b94e29fcc8084842db96e8c4ca41fced17af69e1aab09ed1182a12ad8650d9a46fd8743a0344df95b WHIRLPOOL 95e16af6d1d82f4a660b56854b8e9da947b89e47775c06fe277a612cd1a7cabe7454087eb45034aedfb9b08096ce4aa427b9a37f43f70ccf1073664bdec13386
DIST openssh-7.3_p1-hpn-14.10-r1.patch.xz 20584 SHA256 0bbbfeb1f9f975ad591ed4ec74927172c5299ec1a76210197c14575204efa85d SHA512 f0a1c84af85f7cfc7cb58b5117b3d0f57fc25ae0dd608e38b48ef42da43780fd5cf243d26ff9b3fbd6f4cb1567852b87bcb75f98791cf3ad1892e8579a7834d3 WHIRLPOOL b1a8bae14c8189745056c15c9ed45207aa06af1f4c598a1af7dc3cc56e47bd0211a63989a920727e20311a148bbcf3202c202eae94cd1512c7d87816a9f44bcb
DIST openssh-7.3_p1-sctp.patch.xz 9968 SHA256 18c3db45ed1e5495db29626938d8432aee509e88057494f052cfc09d40824c7f SHA512 f249b76898af0c6f1f65f2a1cfb422648aa712818d0dc051b85a171f26bdddf7980fff5de7761161aa41c309e528b3801b4234f5cdd9f79f8eef173ae83f1e3c WHIRLPOOL 1d92b969154b77d8ce9e3a6d0302aa17ec95e2d5ea4de72c0fb5680a8ee12f518ee5b1c47f22ad5d1a923a74c43829ed36cf478fe75fe400de967ab48d93dc99
DIST openssh-7.3p1+x509-9.2.diff.gz 588078 SHA256 45f054cbb2b77ac8cc7ab01439e34083382137d47b840ca274555b7e2cf7098b SHA512 fab0da148b0833a651e8a7c36f344aacecef6fa92f8f1cb6302272d98c1ab018831f5850dcaa8f54a39f9ada9b7d5b0a0ea01defc3c6f603bbe211f6bff6a841 WHIRLPOOL 53f63d879f563909c57d23ced273e23eda1eace2a2ddfd54edf5f2ef15218cc7e5d927e54714b6850db541f361c459de50d79b0a4516b43ce4cba8eb66b49485
@@ -9,6 +6,5 @@ DIST openssh-7.3p1.tar.gz 1522617 SHA256 3ffb989a6dcaa69594c3b550d4855a5a2e1718c
DIST openssh-7.4_p1-sctp.patch.xz 8220 SHA256 18fa77f79ccae8b9a76bc877e9602113d91953bd487b6cc8284bfd1217438a23 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4 WHIRLPOOL 0f0ea1d36523b35d3be33d22fb84daa05fd14c464d69c19695235f81d26326bc53d6804bf34d0cc0c2584f412bfdac361d2b018032447d1033a4ff4fd9458a09
DIST openssh-7.4p1+x509-9.3.diff.gz 446572 SHA256 1d3fd23b3d02a3baad50890bf5498ef01af6dab6375da0aeb00a0d59fd3ac9ee SHA512 7ebc8d1f6ec36d652bbb6fb13d6d86f7db1abf8710af7b56c52fad9a18d73c9028a3307daabfdda26483a3bd9196120f6d18b6fb2c89b597b0a9ad0554161dfc WHIRLPOOL f878346a3154b7dbb01de41830d5857064af96d3a709aed40a112fe9aaadbe4801e5c3a22a1d2c8437b74a890596211be37e26d691ff611981d7375d262598c1
DIST openssh-7.4p1.tar.gz 1511780 SHA256 1b1fc4a14e2024293181924ed24872e6f2e06293f3e8926a376b8aec481f19d1 SHA512 4f3256f461f01366c5d5e0e45285eec65016e2643b3284b407f48f53d81087bf2c1caf7d5f7530d307a15c91c64de91446e1cba948e8fc68f82098290fe3b292 WHIRLPOOL 4ed9a277287d1f5c2fd371b53394d6dde36b25adf92d4b6b5b486a9d448648f2ecfbb721ae39ba8a129913c1148aa4db1e99f7960a7c69fa215dfa7b3b126029
-DIST openssh-lpk-7.2p2-0.3.14.patch.xz 17692 SHA256 2cd4108d60112bd97402f9c27aac2c24d334a37afe0933ad9c6377a257a68aee SHA512 e6a25f8f0106fadcb799300452d6f22034d3fc69bd1c95a3365884873861f41b1e9d49f2c5223dde6fcd00562c652ba466bc8c48833ce5ab353af3a041f75b15 WHIRLPOOL 237343b320772a1588b64c4135758af840199214129d7e8cfa9798f976c32902ca5493ee0c33b16003854fea243556997bc688640a9872b82c06f72c86f2586d
DIST openssh-lpk-7.3p1-0.3.14.patch.xz 17800 SHA256 cf1f60235cb8b0e561cd36cbf9e4f437e16fd748c2616d3f511c128c02deb76c SHA512 e9a73c5f13e41f6e11c744fdbcdb2e399c394479f79249e901cb3c101efb06f23d51d3ba4869db872184fa034a5910fc93a730fe906266c8d7409e39ad5b1ecd WHIRLPOOL bbdeadbed8f901148713bd9e4a082a4be2992c3151f995febd8be89bbb85d91185e1f0413b5a94a9340f2f404d18c9cee2aa6e032adaee0306aa1c624f6cc09c
DIST openssh-lpk-7.4p1-0.3.14.patch.xz 17076 SHA256 3a5e4104507d259ad15391136322ea5d067d7932199bbafde5cb478daf3595ad SHA512 1c91de291816ee0bb29ed3a2ffc42fb6fb4ba27a8616f8bd50accdf31d1fecc9b4fb3de6fb1ea6e722b69eb8cab68030ade87e126a4112667d14f3c2ef07d6cd WHIRLPOOL ea27224da952c6fe46b974a0e73d01e872a963e7e7cc7e9887a423357fb4ff82f4513ce48b6bbf7136afa8447bc6d93daa817cf5b2e24cb39dba15cbcff6d2cc
diff --git a/net-misc/openssh/openssh-7.2_p2-r1.ebuild b/net-misc/openssh/openssh-7.2_p2-r1.ebuild
deleted file mode 100644
index 282823e..00000000
--- a/net-misc/openssh/openssh-7.2_p2-r1.ebuild
+++ /dev/null
@@ -1,334 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Id$
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
-LDAP_PATCH="${PN}-lpk-7.2p2-0.3.14.patch.xz"
-X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- mirror://gentoo/${PN}-7.2_p1-sctp.patch.xz
- ${HPN_PATCH:+hpn? (
- mirror://gentoo/${HPN_PATCH}
- mirror://sourceforge/hpnssh/${HPN_PATCH}
- )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap ssl )"
-
-LIB_DEPEND="
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl:0[static-libs(+)]
- )
- libressl? ( dev-libs/libressl[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_setup() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- pushd .. >/dev/null
- if use hpn ; then
- pushd ${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
- popd >/dev/null
- fi
- epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch
- popd >/dev/null
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
- #save_version X509
- fi
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
- epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${WORKDIR}"/${PN}-7.2_p1-sctp.patch
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
- keepdir /var/empty
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- # Allow root password logins for live-cds
- if use livecd ; then
- sed -i \
- -e "/PermitRootLogin/c\\
-\\
-# By popular demand, we're allowing root login with password on livecds\\
-PermitRootLogin Yes\\
-" "${ED}"/etc/ssh/sshd_config
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t tests skipped failed passed shell
- tests="interop-tests compat-tests"
- skipped=""
- shell=$(egetshell ${UID})
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite"
- elog "requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped="${skipped} tests"
- else
- tests="${tests} tests"
- fi
- # It will also attempt to write to the homedir .ssh
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in ${tests} ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed="${passed}${t} " \
- || failed="${failed}${t} "
- done
- einfo "Passed tests: ${passed}"
- ewarn "Skipped tests: ${skipped}"
- if [[ -n ${failed} ]] ; then
- ewarn "Failed tests: ${failed}"
- die "Some tests failed: ${failed}"
- else
- einfo "Failed tests: ${failed}"
- return 0
- fi
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
deleted file mode 100644
index 62f1026..00000000
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ /dev/null
@@ -1,324 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Id$
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
-LDAP_PATCH="${PN}-lpk-7.2p2-0.3.14.patch.xz"
-X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- mirror://gentoo/${PN}-7.2_p1-sctp.patch.xz
- ${HPN_PATCH:+hpn? (
- mirror://gentoo/${HPN_PATCH}
- mirror://sourceforge/hpnssh/${HPN_PATCH}
- )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap ssl )"
-
-LIB_DEPEND="
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl:0[static-libs(+)]
- )
- libressl? ( dev-libs/libressl[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_setup() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- pushd .. >/dev/null
- if use hpn ; then
- pushd ${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
- popd >/dev/null
- fi
- epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch
- popd >/dev/null
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
- #save_version X509
- fi
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
- epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${WORKDIR}"/${PN}-7.2_p1-sctp.patch
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
- keepdir /var/empty
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t tests skipped failed passed shell
- tests="interop-tests compat-tests"
- skipped=""
- shell=$(egetshell ${UID})
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite"
- elog "requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped="${skipped} tests"
- else
- tests="${tests} tests"
- fi
- # It will also attempt to write to the homedir .ssh
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in ${tests} ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed="${passed}${t} " \
- || failed="${failed}${t} "
- done
- einfo "Passed tests: ${passed}"
- ewarn "Skipped tests: ${skipped}"
- if [[ -n ${failed} ]] ; then
- ewarn "Failed tests: ${failed}"
- die "Some tests failed: ${failed}"
- else
- einfo "Failed tests: ${failed}"
- return 0
- fi
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.3_p1-r5.ebuild b/net-misc/openssh/openssh-7.3_p1-r5.ebuild
deleted file mode 100644
index 7e320b5..00000000
--- a/net-misc/openssh/openssh-7.3_p1-r5.ebuild
+++ /dev/null
@@ -1,349 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Id$
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-HPN_PV="${PV}"
-HPN_VER="14.10"
-
-HPN_PATCH="${PN}-${HPN_PV}-hpn-14.10-r1.patch"
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz"
-X509_VER="9.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? (
- mirror://gentoo/${HPN_PATCH}.xz
- http://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz
- )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl:0[static-libs(+)]
- )
- libressl? ( dev-libs/libressl[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_setup() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- pushd .. >/dev/null
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-9.2-glue.patch
- popd >/dev/null
- fi
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch
- sed -i 's:PKIX_VERSION:SSH_X509:g' "${WORKDIR}"/${X509_PATCH%.*} || die
- popd >/dev/null
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- epatch "${FILESDIR}"/${P}-x509-9.2-warnings.patch
- save_version X509
- else
- # bug #592122, fixed by X509 patch
- epatch "${FILESDIR}"/${P}-fix-ssh1-with-no-ssh1-host-key.patch
- fi
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${WORKDIR}"/${SCTP_PATCH%.*}
-
- if use hpn ; then
- #EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- # EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- # epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- epatch "${WORKDIR}"/${HPN_PATCH}
- epatch "${FILESDIR}"/${P}-hpn-cipher-ctr-mt-no-deadlocks.patch
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- # 7.3 added seccomp support to MIPS, but failed to handled the N32
- # case. This patch is temporary until upstream fixes. See
- # Gentoo bug #591392 or upstream #2590.
- [[ ${CHOST} == mips64*-linux-* && ${ABI} == "n32" ]] \
- && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
- keepdir /var/empty
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t tests skipped failed passed shell
- tests="interop-tests compat-tests"
- skipped=""
- shell=$(egetshell ${UID})
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite"
- elog "requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped="${skipped} tests"
- else
- tests="${tests} tests"
- fi
- # It will also attempt to write to the homedir .ssh
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in ${tests} ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed="${passed}${t} " \
- || failed="${failed}${t} "
- done
- einfo "Passed tests: ${passed}"
- ewarn "Skipped tests: ${skipped}"
- if [[ -n ${failed} ]] ; then
- ewarn "Failed tests: ${failed}"
- die "Some tests failed: ${failed}"
- else
- einfo "Failed tests: ${failed}"
- return 0
- fi
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
deleted file mode 100644
index 88ffff6..00000000
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ /dev/null
@@ -1,351 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Id$
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-HPN_PV="${PV}"
-HPN_VER="14.10"
-
-HPN_PATCH="${PN}-${HPN_PV}-hpn-14.10-r1.patch"
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz"
-X509_VER="9.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? (
- mirror://gentoo/${HPN_PATCH}.xz
- http://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz
- )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl:0[static-libs(+)]
- )
- libressl? ( dev-libs/libressl[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_setup() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- pushd .. >/dev/null
- if use hpn ; then
- pushd "${WORKDIR}" >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-9.2-glue.patch
- popd >/dev/null
- fi
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch
- sed -i 's:PKIX_VERSION:SSH_X509:g' "${WORKDIR}"/${X509_PATCH%.*} || die
- popd >/dev/null
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- epatch "${FILESDIR}"/${P}-x509-9.2-warnings.patch
- save_version X509
- else
- # bug #592122, fixed by X509 patch
- epatch "${FILESDIR}"/${P}-fix-ssh1-with-no-ssh1-host-key.patch
- fi
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${WORKDIR}"/${SCTP_PATCH%.*}
-
- if use hpn ; then
- #EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- # EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- # epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- epatch "${WORKDIR}"/${HPN_PATCH}
- epatch "${FILESDIR}"/${P}-hpn-cipher-ctr-mt-no-deadlocks.patch
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- # 7.3 added seccomp support to MIPS, but failed to handled the N32
- # case. This patch is temporary until upstream fixes. See
- # Gentoo bug #591392 or upstream #2590.
- [[ ${CHOST} == mips64*-linux-* && ${ABI} == "n32" ]] \
- && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- epatch "${FILESDIR}"/${P}-NEWKEYS_null_deref.patch # 595342
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
- keepdir /var/empty
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t tests skipped failed passed shell
- tests="interop-tests compat-tests"
- skipped=""
- shell=$(egetshell ${UID})
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite"
- elog "requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped="${skipped} tests"
- else
- tests="${tests} tests"
- fi
- # It will also attempt to write to the homedir .ssh
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in ${tests} ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed="${passed}${t} " \
- || failed="${failed}${t} "
- done
- einfo "Passed tests: ${passed}"
- ewarn "Skipped tests: ${skipped}"
- if [[ -n ${failed} ]] ; then
- ewarn "Failed tests: ${failed}"
- die "Some tests failed: ${failed}"
- else
- einfo "Failed tests: ${failed}"
- return 0
- fi
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2017-01-07 21:35 Robin H. Johnson
0 siblings, 0 replies; 441+ messages in thread
From: Robin H. Johnson @ 2017-01-07 21:35 UTC (permalink / raw
To: gentoo-commits
commit: 2b7df23399d7b274f8029aedf7df00ee69243c13
Author: Bertrand Jacquin <bertrand <AT> jacquin <DOT> bzh>
AuthorDate: Thu Jan 5 21:40:41 2017 +0000
Commit: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org>
CommitDate: Sat Jan 7 21:35:09 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2b7df233
net-misc/openssh: Use pkg_pretend() to detect earlier unsupported features
Package-Manager: portage-2.3.0
(cherry picked from commit 4862b9b82b4722272da4639999f757d733d67335)
Signed-off-by: Robin H. Johnson <robbat2 <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 4 ++--
net-misc/openssh/openssh-7.3_p1-r8.ebuild | 4 ++--
net-misc/openssh/openssh-7.4_p1.ebuild | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index 0f8d774..6c9b324 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$
@@ -76,7 +76,7 @@ RDEPEND="${RDEPEND}
S=${WORKDIR}/${PARCH}
-pkg_setup() {
+pkg_pretend() {
# this sucks, but i'd rather have people unable to `emerge -u openssh`
# than not be able to log in to their server any more
maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
diff --git a/net-misc/openssh/openssh-7.3_p1-r8.ebuild b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
index f886839..164f4e1 100644
--- a/net-misc/openssh/openssh-7.3_p1-r8.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$
@@ -71,7 +71,7 @@ RDEPEND="${RDEPEND}
S=${WORKDIR}/${PARCH}
-pkg_setup() {
+pkg_pretend() {
# this sucks, but i'd rather have people unable to `emerge -u openssh`
# than not be able to log in to their server any more
maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
diff --git a/net-misc/openssh/openssh-7.4_p1.ebuild b/net-misc/openssh/openssh-7.4_p1.ebuild
index 110f1bf..4f6efad 100644
--- a/net-misc/openssh/openssh-7.4_p1.ebuild
+++ b/net-misc/openssh/openssh-7.4_p1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI="5"
@@ -70,7 +70,7 @@ RDEPEND="${RDEPEND}
S=${WORKDIR}/${PARCH}
-pkg_setup() {
+pkg_pretend() {
# this sucks, but i'd rather have people unable to `emerge -u openssh`
# than not be able to log in to their server any more
maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-12-26 18:47 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-12-26 18:47 UTC (permalink / raw
To: gentoo-commits
commit: c4f141d88c8d955ecbe86554ef21892b0aec762a
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 26 18:46:29 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Mon Dec 26 18:47:44 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4f141d8
net-misc/openssh: remove more X509 compat logic #603100#7
net-misc/openssh/openssh-7.4_p1.ebuild | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/net-misc/openssh/openssh-7.4_p1.ebuild b/net-misc/openssh/openssh-7.4_p1.ebuild
index 616265a..110f1bf 100644
--- a/net-misc/openssh/openssh-7.4_p1.ebuild
+++ b/net-misc/openssh/openssh-7.4_p1.ebuild
@@ -113,11 +113,9 @@ src_prepare() {
sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
if use X509 ; then
- pushd .. >/dev/null
- sed -i 's:PKIX_VERSION:SSH_X509:g' "${WORKDIR}"/${X509_PATCH%.*} || die
- popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
- save_version X509
+ # We no longer allow X509 to be used with anything else.
+ #save_version X509
fi
if use ldap ; then
@@ -193,7 +191,7 @@ src_configure() {
$(use_with libedit)
$(use_with pam)
$(use_with pie)
- $(use_with sctp)
+ $(use X509 || use_with sctp)
$(use_with selinux)
$(use_with skey)
$(use_with ssh1)
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-12-24 8:05 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-12-24 8:05 UTC (permalink / raw
To: gentoo-commits
commit: 02381c768910f0ac57d397a8b199761cadac8616
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 24 08:02:00 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Sat Dec 24 08:05:07 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=02381c76
net-misc/openssh: drop X509 glue #603610
Upstream X509 insists on stuffing their patchset full of unrelated crap
and have no interest in fixing their misbehavior. Maintaining glue layers
to work with other features (like sctp or hpn) is not worth our time.
This is one step away from purging X509 entirely.
net-misc/openssh/openssh-7.4_p1.ebuild | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/net-misc/openssh/openssh-7.4_p1.ebuild b/net-misc/openssh/openssh-7.4_p1.ebuild
index db314b2..616265a 100644
--- a/net-misc/openssh/openssh-7.4_p1.ebuild
+++ b/net-misc/openssh/openssh-7.4_p1.ebuild
@@ -32,7 +32,7 @@ REQUIRED_USE="ldns? ( ssl )
pie? ( !static )
ssh1? ( ssl )
static? ( !kerberos !pam )
- X509? ( !ldap ssl )
+ X509? ( !hpn !ldap !sctp ssl )
test? ( ssl )"
LIB_DEPEND="
@@ -114,16 +114,9 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
- if use hpn ; then
- pushd ${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-12-x509-9.2-glue.patch
- popd >/dev/null
- fi
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch
sed -i 's:PKIX_VERSION:SSH_X509:g' "${WORKDIR}"/${X509_PATCH%.*} || die
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
- epatch "${FILESDIR}"/${P}-x509-9.2-warnings.patch
save_version X509
fi
@@ -134,7 +127,7 @@ src_prepare() {
epatch "${FILESDIR}"/${PN}-7.4_p1-GSSAPI-dns.patch #165444 integrated into gsskex
epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${WORKDIR}"/${SCTP_PATCH%.*}
+ use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
epatch "${FILESDIR}"/${P}-test-bashism.patch
use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-12-20 22:21 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-12-20 22:21 UTC (permalink / raw
To: gentoo-commits
commit: 59211623564fe3e7636eeab5255cd732d9f1aee8
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 20 20:08:07 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Dec 20 22:21:07 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=59211623
net-misc/openssh: clean up test code a bit
Use arrays instead of a flat scalar, and clean up the warning/error output.
net-misc/openssh/openssh-7.3_p1-r8.ebuild | 37 +++++++++++++------------------
1 file changed, 16 insertions(+), 21 deletions(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r8.ebuild b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
index a03905c..f886839 100644
--- a/net-misc/openssh/openssh-7.3_p1-r8.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
@@ -272,37 +272,32 @@ src_install() {
}
src_test() {
- local t tests skipped failed passed shell
- tests="interop-tests compat-tests"
- skipped=""
- shell=$(egetshell ${UID})
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite"
- elog "requires a usable shell for the 'portage'"
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
elog "user, so we will run a subset only."
- skipped="${skipped} tests"
+ skipped+=( tests )
else
- tests="${tests} tests"
+ tests+=( tests )
fi
- # It will also attempt to write to the homedir .ssh
+
+ # It will also attempt to write to the homedir .ssh.
local sshhome=${T}/homedir
mkdir -p "${sshhome}"/.ssh
- for t in ${tests} ; do
+ for t in "${tests[@]}" ; do
# Some tests read from stdin ...
HOMEDIR="${sshhome}" HOME="${sshhome}" \
emake -k -j1 ${t} </dev/null \
- && passed="${passed}${t} " \
- || failed="${failed}${t} "
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
done
- einfo "Passed tests: ${passed}"
- ewarn "Skipped tests: ${skipped}"
- if [[ -n ${failed} ]] ; then
- ewarn "Failed tests: ${failed}"
- die "Some tests failed: ${failed}"
- else
- einfo "Failed tests: ${failed}"
- return 0
- fi
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
}
pkg_preinst() {
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-12-20 8:28 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2016-12-20 8:28 UTC (permalink / raw
To: gentoo-commits
commit: 6557d42ab43f296d11ce0b249614b3b41ea1cf9e
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 20 08:27:40 2016 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Tue Dec 20 08:28:08 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6557d42a
net-misc/openssh: fix compilation on Solaris
Package-Manager: portage-2.3.0
net-misc/openssh/openssh-7.3_p1-r8.ebuild | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net-misc/openssh/openssh-7.3_p1-r8.ebuild b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
index 29bbe50..a03905c 100644
--- a/net-misc/openssh/openssh-7.3_p1-r8.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r8.ebuild
@@ -162,6 +162,10 @@ src_prepare() {
-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
)
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
sed -i "${sed_args[@]}" configure{.ac,} || die
epatch_user #473004
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-28 9:38 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-28 9:38 UTC (permalink / raw
To: gentoo-commits
commit: 04a6d065a40ba2fd13df8ae2d7b641b732f3c295
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Nov 28 09:38:04 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Nov 28 09:38:04 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04a6d065
net-misc/openssh: ia64 stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index ca2a6d0..0f8d774 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-28 9:35 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-28 9:35 UTC (permalink / raw
To: gentoo-commits
commit: 682bc04c8257cbcfc08990e3c7e6b4c9ddac3c82
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Nov 28 09:34:50 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Nov 28 09:34:50 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=682bc04c
net-misc/openssh: sparc stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index cc687b5..ca2a6d0 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-27 11:40 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-27 11:40 UTC (permalink / raw
To: gentoo-commits
commit: c83e983bc86538eb967752044456587460c502fb
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 27 11:39:35 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Nov 27 11:39:35 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c83e983b
net-misc/openssh: ppc stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index 41a5659..cc687b5 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-27 11:37 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-27 11:37 UTC (permalink / raw
To: gentoo-commits
commit: a4e413f5c9df6b7ae8232617f6c5cf2d7a3e1da0
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 27 11:37:06 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Nov 27 11:37:06 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a4e413f5
net-misc/openssh: arm stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="arm"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index 8629c74..41a5659 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-17 8:03 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2016-11-17 8:03 UTC (permalink / raw
To: gentoo-commits
commit: 8a1b150895222667e1f6a111b618ce87492b0184
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 17 08:01:44 2016 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Thu Nov 17 08:01:44 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8a1b1508
net-misc/openssh: Stable for HPPA PPC64 (bug #597360).
Package-Manager: portage-2.3.2
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index d4a19ef..8629c74 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-14 16:48 Tobias Klausmann
0 siblings, 0 replies; 441+ messages in thread
From: Tobias Klausmann @ 2016-11-14 16:48 UTC (permalink / raw
To: gentoo-commits
commit: ae18d973ff741b69db31ba4ccf1dac97731a5ceb
Author: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
AuthorDate: Mon Nov 14 16:48:06 2016 +0000
Commit: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
CommitDate: Mon Nov 14 16:48:06 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae18d973
net-misc/openssh-7.3_p1-r7: stable on alpha
Gentoo-Bug: 597360
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index d127451..d4a19ef 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-13 13:09 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-13 13:09 UTC (permalink / raw
To: gentoo-commits
commit: a354e9249d9b90e6547fc1205d8b95d16d9f92e9
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 13 13:08:36 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Nov 13 13:08:36 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a354e924
net-misc/openssh: x86 stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index ae5b51b..d127451 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-13 13:07 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-11-13 13:07 UTC (permalink / raw
To: gentoo-commits
commit: ae61fbbe261c8b66e09c463de569373417efd871
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 13 13:06:43 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Nov 13 13:06:43 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae61fbbe
net-misc/openssh: amd64 stable wrt bug #597360
Package-Manager: portage-2.3.0
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r7.ebuild b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
index ad0950f..ae5b51b 100644
--- a/net-misc/openssh/openssh-7.3_p1-r7.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r7.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-11-12 16:55 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-11-12 16:55 UTC (permalink / raw
To: gentoo-commits
commit: 0f3fa3f031750f19de58c111ebbad020de943075
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 12 16:48:06 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Sat Nov 12 16:49:05 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0f3fa3f0
net-misc/openssh: mark 7.3_p1-r6 arm64/m68k/s390/sh stable #597360
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 3e93f13..88ffff6 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 13:28 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-29 13:28 UTC (permalink / raw
To: gentoo-commits
commit: 2e7a29caafa27dccd7d7d41bfc17de61c7c593e7
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 13:27:53 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 13:28:25 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2e7a29ca
net-misc/openssh: ia64 stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="ia64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index e8a063f..3e93f13 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 13:14 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-29 13:14 UTC (permalink / raw
To: gentoo-commits
commit: 4941d84f503544107a1b802c04e2c0bf53131c3d
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 13:14:41 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 13:14:41 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4941d84f
net-misc/openssh: arm stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="arm"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 38a9889..e8a063f 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 12:35 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-29 12:35 UTC (permalink / raw
To: gentoo-commits
commit: 8e8341a8fdc10903ca8d9832612b66dece42cdd5
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 12:34:58 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 12:34:58 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e8341a8
net-misc/openssh: ppc stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 9db990c..38a9889 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 9:41 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-29 9:41 UTC (permalink / raw
To: gentoo-commits
commit: 37e99e3a456495e0e13acd70c9ec9c03edf0cb7b
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 09:41:50 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 09:41:50 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=37e99e3a
net-misc/openssh: sparc stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="sparc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 6f33456..9db990c 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 9:09 Tobias Klausmann
0 siblings, 0 replies; 441+ messages in thread
From: Tobias Klausmann @ 2016-09-29 9:09 UTC (permalink / raw
To: gentoo-commits
commit: 8fc45a2e758ece9db098f0710ed81f0777322b8e
Author: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 09:08:24 2016 +0000
Commit: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 09:08:24 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8fc45a2e
net-misc/openssh-7.3_p1-r6: stable on alpha
Gentoo-Bug: 595342
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 8b5440f..6f33456 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-29 3:36 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2016-09-29 3:36 UTC (permalink / raw
To: gentoo-commits
commit: 24c1e967c7d856d381da8777532a99527a78b432
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 29 03:36:01 2016 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Thu Sep 29 03:36:01 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=24c1e967
net-misc/openssh: Stable for HPPA PPC64 (bug #595342).
Package-Manager: portage-2.3.1
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 58ef89b..8b5440f 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-28 17:28 Fabian Groffen
0 siblings, 0 replies; 441+ messages in thread
From: Fabian Groffen @ 2016-09-28 17:28 UTC (permalink / raw
To: gentoo-commits
commit: 1dacef5b27486d6eaf388d411e865bc67526c0af
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 17:28:01 2016 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 17:28:13 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1dacef5b
net-misc/openssh: added Prefix keywords
Package-Manager: portage-2.2.28
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 1fe0d3d..58ef89b 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-28 12:32 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-28 12:32 UTC (permalink / raw
To: gentoo-commits
commit: f914661347298938a10a19af1ae1c38b1cda2d71
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 12:32:50 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 12:32:50 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f9146613
net-misc/openssh: x86 stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 2c86afb..1fe0d3d 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-28 12:32 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-09-28 12:32 UTC (permalink / raw
To: gentoo-commits
commit: f61a61d3dcab473b566cde0545e315e0c4f1a18b
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 12:32:23 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 12:32:23 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f61a61d3
net-misc/openssh: amd64 stable wrt bug #595342
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1-r6.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r6.ebuild b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
index 1a8bb12..2c86afb 100644
--- a/net-misc/openssh/openssh-7.3_p1-r6.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r6.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-09-14 18:51 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2016-09-14 18:51 UTC (permalink / raw
To: gentoo-commits
commit: 8fa7b67683e14c9df951294bf6542ddf647285f1
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 14 18:50:48 2016 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Wed Sep 14 18:50:48 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8fa7b676
net-misc/openssh: Fix compile failure with USE="-hpn X509 sctp"
Gentoo-Bug: 593704
Package-Manager: portage-2.3.0
net-misc/openssh/openssh-7.3_p1-r4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.3_p1-r4.ebuild b/net-misc/openssh/openssh-7.3_p1-r4.ebuild
index 9ba9ac0..27291c9 100644
--- a/net-misc/openssh/openssh-7.3_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1-r4.ebuild
@@ -129,7 +129,7 @@ src_prepare() {
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
epatch "${FILESDIR}"/${P}-fix-segfault-with-x509.patch
- save_version X509
+ #save_version X509
fi
if use ldap ; then
epatch "${WORKDIR}"/${LDAP_PATCH%.*}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-08-27 18:34 Patrick McLean
0 siblings, 0 replies; 441+ messages in thread
From: Patrick McLean @ 2016-08-27 18:34 UTC (permalink / raw
To: gentoo-commits
commit: 540dbda686e517a25e75fbd576a993a040dfb1c8
Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
AuthorDate: Sat Aug 27 18:33:16 2016 +0000
Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org>
CommitDate: Sat Aug 27 18:34:17 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=540dbda6
net-misc/openssh: Revision bump to update X509 patch to version 9.1
Package-Manager: portage-2.3.0
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.3_p1-r2.ebuild | 332 ++++++++++++++++++++++++++++++
2 files changed, 333 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 958961b..7e2535f 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -7,6 +7,7 @@ DIST openssh-7.2p2+x509-8.9.diff.gz 449308 SHA256 bd77fcd285d10a86fb2934e90776fe
DIST openssh-7.2p2.tar.gz 1499808 SHA256 a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c SHA512 44f62b3a7bc50a0735d496a5aedeefb71550d8c10ad8f22b94e29fcc8084842db96e8c4ca41fced17af69e1aab09ed1182a12ad8650d9a46fd8743a0344df95b WHIRLPOOL 95e16af6d1d82f4a660b56854b8e9da947b89e47775c06fe277a612cd1a7cabe7454087eb45034aedfb9b08096ce4aa427b9a37f43f70ccf1073664bdec13386
DIST openssh-7.3_p1-sctp.patch.xz 9968 SHA256 18c3db45ed1e5495db29626938d8432aee509e88057494f052cfc09d40824c7f SHA512 f249b76898af0c6f1f65f2a1cfb422648aa712818d0dc051b85a171f26bdddf7980fff5de7761161aa41c309e528b3801b4234f5cdd9f79f8eef173ae83f1e3c WHIRLPOOL 1d92b969154b77d8ce9e3a6d0302aa17ec95e2d5ea4de72c0fb5680a8ee12f518ee5b1c47f22ad5d1a923a74c43829ed36cf478fe75fe400de967ab48d93dc99
DIST openssh-7.3p1+x509-9.0.diff.gz 571918 SHA256 ed468fe2e6220065b2bf3e2ed9eb0c7c8183f32f50fa50d64505d5feaef2d900 SHA512 b6183f4441eb036a6e70e35290454faa67da411b60315f6d51779c187abdef377895d5ecfc4fbebac08d5a7a49ce16378b2ed208aee701337f256fd66f779dcd WHIRLPOOL 91107f0040a7d9e09340a1c67547df34c9ed2e7a61d0ca59161574d9e9db90d2a99b1f2a7fa1edf0f820db5712695287c5731cc46cc9264297b5d348d4ce53c4
+DIST openssh-7.3p1+x509-9.1.diff.gz 584945 SHA256 1ce361813d585fb543f632d19f73a583e257a404c013587a2ee7a1c57710ae95 SHA512 11165544513eaff2b2e1f6dd11b9fb2870e59eb7e16377cf8fc1bf7e459cf8d09a91cf52f0d252df1bf618423ea8fb93099b96670cebc42aa2523dd439e59a89 WHIRLPOOL 8732cc52ef851a35c0dc8b35e8b6666d347f40ee60792aa23bae8e193ec6fa24928b67e6d8ebfc2c52090e78c525e908596020071495452965fa6244df1e459e
DIST openssh-7.3p1.tar.gz 1522617 SHA256 3ffb989a6dcaa69594c3b550d4855a5a2e1718ccdde7f5e36387b424220fbecc SHA512 7ba2d6140f38bd359ebf32ef17626e0ae1c00c3a38c01877b7c6b0317d030f10a8f82a0a51fc3b6273619de9ed73e24b8cf107b1e968f927053a3bedf97ff801 WHIRLPOOL f852026638d173d455f74e3fce16673fc4b10f32d954d5bb8c7c65df8d1ca7efd0938177dd9fb6e1f7354383f21c7bca8a2f01e89793e32f8ca68c30456a611c
DIST openssh-lpk-7.1p2-0.3.14.patch.xz 17704 SHA256 fbf2e1560cac707f819a539999c758a444ba6bfe140ef80d1af7ef1c9a95f0df SHA512 95851baa699da16720358249d54d2f6a3c57b0ae082375bef228b97697c501c626ab860916c5b17e3c649b44f14f4009ff369962597438dfd60480a0e4882471 WHIRLPOOL 4629b3a7d1f373a678935e889a6cd0d66d70b420e93e40ae0ad19aa7f91be7dcf2169fb797d89df93005a885d54ebaa0d46c2e5418bd2d0a77ad64e65897b518
DIST openssh-lpk-7.2p2-0.3.14.patch.xz 17692 SHA256 2cd4108d60112bd97402f9c27aac2c24d334a37afe0933ad9c6377a257a68aee SHA512 e6a25f8f0106fadcb799300452d6f22034d3fc69bd1c95a3365884873861f41b1e9d49f2c5223dde6fcd00562c652ba466bc8c48833ce5ab353af3a041f75b15 WHIRLPOOL 237343b320772a1588b64c4135758af840199214129d7e8cfa9798f976c32902ca5493ee0c33b16003854fea243556997bc688640a9872b82c06f72c86f2586d
diff --git a/net-misc/openssh/openssh-7.3_p1-r2.ebuild b/net-misc/openssh/openssh-7.3_p1-r2.ebuild
new file mode 100644
index 00000000..753d73e
--- /dev/null
+++ b/net-misc/openssh/openssh-7.3_p1-r2.ebuild
@@ -0,0 +1,332 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
+SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz"
+X509_VER="9.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
+ epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
+ #save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ epatch "${WORKDIR}"/${SCTP_PATCH%.*}
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-08-08 8:39 Andrew Savchenko
0 siblings, 0 replies; 441+ messages in thread
From: Andrew Savchenko @ 2016-08-08 8:39 UTC (permalink / raw
To: gentoo-commits
commit: 6862d10fc9815d80da857443e931d1ea2e1be400
Author: Andrew Savchenko <bircoph <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 8 08:34:52 2016 +0000
Commit: Andrew Savchenko <bircoph <AT> gentoo <DOT> org>
CommitDate: Mon Aug 8 08:38:34 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6862d10f
net-misc/openssh: USE=sctp is now global
Removing local sctp USE flag description, as flag is global now,
see [1] for details.
[1] https://archives.gentoo.org/gentoo-dev/message/427fac41fbe21ec98dfba63b1d68efe5
Package-Manager: portage-2.3.0
Signed-off-by: Andrew Savchenko <bircoph <AT> gentoo.org>
net-misc/openssh/metadata.xml | 1 -
1 file changed, 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 180b581..29134fc 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -29,7 +29,6 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
<flag name="livecd">Enable root password logins for live-cd environment.</flag>
- <flag name="sctp">Support for Stream Control Transmission Protocol</flag>
<flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
<flag name="X509">Adds support for X.509 certificate authentication</flag>
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-08-02 19:10 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2016-08-02 19:10 UTC (permalink / raw
To: gentoo-commits
commit: 04e24fa6cf133dcd64b9f02f5a2c0362df21e3fa
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 2 19:10:40 2016 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Tue Aug 2 19:10:40 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04e24fa6
net-misc/openssh: Re-added $Id$ header line.
Package-Manager: portage-2.3.0
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
net-misc/openssh/openssh-7.3_p1.ebuild | 1 +
1 file changed, 1 insertion(+)
diff --git a/net-misc/openssh/openssh-7.3_p1.ebuild b/net-misc/openssh/openssh-7.3_p1.ebuild
index 09e100e..871c3c4 100644
--- a/net-misc/openssh/openssh-7.3_p1.ebuild
+++ b/net-misc/openssh/openssh-7.3_p1.ebuild
@@ -1,5 +1,6 @@
# Copyright 1999-2016 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
+# $Id$
EAPI="5"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-08-02 14:57 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-08-02 14:57 UTC (permalink / raw
To: gentoo-commits
commit: efb18910010dbddfe868628999922c205ed43634
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 2 09:33:22 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Aug 2 14:56:58 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=efb18910
net-misc/openssh: version bump to 7.3_p1
net-misc/openssh/Manifest | 3 +
net-misc/openssh/openssh-7.3_p1.ebuild | 330 +++++++++++++++++++++++++++++++++
2 files changed, 333 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index ea15d13..f3b4f04 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -5,5 +5,8 @@ DIST openssh-7.1p2.tar.gz 1475829 SHA256 dd75f024dcf21e06a0d6421d582690bf987a1f6
DIST openssh-7.2_p1-sctp.patch.xz 8088 SHA256 b9cc21336e23d44548e87964da9ff85ac83ce84693162abb172afb46be4a666e SHA512 b287684337a101a26ab8df6894b679b063cdaa7dfc7b78fcc0ce8350c27526f150a6463c515019beb0af2ff005cc109d2913998f95f828e553b835a4df8b64df WHIRLPOOL 16646a896f746946af84961974be08418b951c80249dce2fd4ae533a4d66e79d4372fd979aeda9c51aff51b86edf4178af18379e948195696a6fa114e2757306
DIST openssh-7.2p2+x509-8.9.diff.gz 449308 SHA256 bd77fcd285d10a86fb2934e90776fe39e4cd2da043384ec2ca45296a60669589 SHA512 c7ed07aae72fd4f967ab5717831c51ad639ca59633c3768f6930bab0947f5429391e3911a7570288a1c688c8c21747f3cb722538ae96de6b50a021010e1506fa WHIRLPOOL 7c1328e471b0e5e9576117ec563b66fea142886b0666b6d51ac9b8ec09286ba7a965b62796c32206e855e484180797a2c31d500c27289f3bc8c7db2d3af95e6f
DIST openssh-7.2p2.tar.gz 1499808 SHA256 a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c SHA512 44f62b3a7bc50a0735d496a5aedeefb71550d8c10ad8f22b94e29fcc8084842db96e8c4ca41fced17af69e1aab09ed1182a12ad8650d9a46fd8743a0344df95b WHIRLPOOL 95e16af6d1d82f4a660b56854b8e9da947b89e47775c06fe277a612cd1a7cabe7454087eb45034aedfb9b08096ce4aa427b9a37f43f70ccf1073664bdec13386
+DIST openssh-7.3_p1-sctp.patch.xz 9968 SHA256 18c3db45ed1e5495db29626938d8432aee509e88057494f052cfc09d40824c7f SHA512 f249b76898af0c6f1f65f2a1cfb422648aa712818d0dc051b85a171f26bdddf7980fff5de7761161aa41c309e528b3801b4234f5cdd9f79f8eef173ae83f1e3c WHIRLPOOL 1d92b969154b77d8ce9e3a6d0302aa17ec95e2d5ea4de72c0fb5680a8ee12f518ee5b1c47f22ad5d1a923a74c43829ed36cf478fe75fe400de967ab48d93dc99
+DIST openssh-7.3p1.tar.gz 1522617 SHA256 3ffb989a6dcaa69594c3b550d4855a5a2e1718ccdde7f5e36387b424220fbecc SHA512 7ba2d6140f38bd359ebf32ef17626e0ae1c00c3a38c01877b7c6b0317d030f10a8f82a0a51fc3b6273619de9ed73e24b8cf107b1e968f927053a3bedf97ff801 WHIRLPOOL f852026638d173d455f74e3fce16673fc4b10f32d954d5bb8c7c65df8d1ca7efd0938177dd9fb6e1f7354383f21c7bca8a2f01e89793e32f8ca68c30456a611c
DIST openssh-lpk-7.1p2-0.3.14.patch.xz 17704 SHA256 fbf2e1560cac707f819a539999c758a444ba6bfe140ef80d1af7ef1c9a95f0df SHA512 95851baa699da16720358249d54d2f6a3c57b0ae082375bef228b97697c501c626ab860916c5b17e3c649b44f14f4009ff369962597438dfd60480a0e4882471 WHIRLPOOL 4629b3a7d1f373a678935e889a6cd0d66d70b420e93e40ae0ad19aa7f91be7dcf2169fb797d89df93005a885d54ebaa0d46c2e5418bd2d0a77ad64e65897b518
DIST openssh-lpk-7.2p2-0.3.14.patch.xz 17692 SHA256 2cd4108d60112bd97402f9c27aac2c24d334a37afe0933ad9c6377a257a68aee SHA512 e6a25f8f0106fadcb799300452d6f22034d3fc69bd1c95a3365884873861f41b1e9d49f2c5223dde6fcd00562c652ba466bc8c48833ce5ab353af3a041f75b15 WHIRLPOOL 237343b320772a1588b64c4135758af840199214129d7e8cfa9798f976c32902ca5493ee0c33b16003854fea243556997bc688640a9872b82c06f72c86f2586d
+DIST openssh-lpk-7.3p1-0.3.14.patch.xz 17800 SHA256 cf1f60235cb8b0e561cd36cbf9e4f437e16fd748c2616d3f511c128c02deb76c SHA512 e9a73c5f13e41f6e11c744fdbcdb2e399c394479f79249e901cb3c101efb06f23d51d3ba4869db872184fa034a5910fc93a730fe906266c8d7409e39ad5b1ecd WHIRLPOOL bbdeadbed8f901148713bd9e4a082a4be2992c3151f995febd8be89bbb85d91185e1f0413b5a94a9340f2f404d18c9cee2aa6e032adaee0306aa1c624f6cc09c
diff --git a/net-misc/openssh/openssh-7.3_p1.ebuild b/net-misc/openssh/openssh-7.3_p1.ebuild
new file mode 100644
index 0000000..09e100e
--- /dev/null
+++ b/net-misc/openssh/openssh-7.3_p1.ebuild
@@ -0,0 +1,330 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
+SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz"
+LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz"
+#X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
+ #save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ epatch "${WORKDIR}"/${SCTP_PATCH%.*}
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-06-18 19:14 Jorge Manuel B. S. Vicetto
0 siblings, 0 replies; 441+ messages in thread
From: Jorge Manuel B. S. Vicetto @ 2016-06-18 19:14 UTC (permalink / raw
To: gentoo-commits
commit: 5f80a533616f8e591963a5f2ae7d7e9a694e0079
Author: Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 18 18:28:00 2016 +0000
Commit: Jorge Manuel B. S. Vicetto <jmbsvicetto <AT> gentoo <DOT> org>
CommitDate: Sat Jun 18 19:13:34 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5f80a533
net-misc/openssh: Allow root password logins for live-cd.
Signed-off-by: Jorge Manuel B. S. Vicetto <jmbsvicetto <AT> gentoo.org>
Reviewed-by: Robin H. Johnson <robbat2 <AT> gentoo.org>
Package-Manager: portage-2.2.28
net-misc/openssh/metadata.xml | 1 +
net-misc/openssh/openssh-7.2_p2-r1.ebuild | 334 ++++++++++++++++++++++++++++++
2 files changed, 335 insertions(+)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 82905cb..180b581 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -28,6 +28,7 @@ ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and
<flag name="hpn">Enable high performance ssh</flag>
<flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
<flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
+ <flag name="livecd">Enable root password logins for live-cd environment.</flag>
<flag name="sctp">Support for Stream Control Transmission Protocol</flag>
<flag name="ssh1">Support the legacy/weak SSH1 protocol</flag>
<flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
diff --git a/net-misc/openssh/openssh-7.2_p2-r1.ebuild b/net-misc/openssh/openssh-7.2_p2-r1.ebuild
new file mode 100644
index 0000000..282823e
--- /dev/null
+++ b/net-misc/openssh/openssh-7.2_p2-r1.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
+LDAP_PATCH="${PN}-lpk-7.2p2-0.3.14.patch.xz"
+X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-7.2_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
+ #save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ epatch "${WORKDIR}"/${PN}-7.2_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ # Allow root password logins for live-cds
+ if use livecd ; then
+ sed -i \
+ -e "/PermitRootLogin/c\\
+\\
+# By popular demand, we're allowing root login with password on livecds\\
+PermitRootLogin Yes\\
+" "${ED}"/etc/ssh/sshd_config
+ fi
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-04-18 9:43 Patrice Clement
0 siblings, 0 replies; 441+ messages in thread
From: Patrice Clement @ 2016-04-18 9:43 UTC (permalink / raw
To: gentoo-commits
commit: 00ad5e65e98cfae777524a8031c87d38889a684e
Author: Patrice Clement <monsieurp <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 18 09:18:20 2016 +0000
Commit: Patrice Clement <monsieurp <AT> gentoo <DOT> org>
CommitDate: Mon Apr 18 09:28:53 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=00ad5e65
net-misc/openssh: Fix metadata.xml file.
Package-Manager: portage-2.2.26
net-misc/openssh/metadata.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index a809b9d..82905cb 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -5,7 +5,7 @@
<email>base-system@gentoo.org</email>
<name>Gentoo Base System</name>
</maintainer>
- <maintainer restrict="net-misc/openssh[ldap]" type="person">
+ <maintainer type="person">
<email>robbat2@gentoo.org</email>
<description>LPK issues. Only assign if it's a direct LPK issue. Do not directly assign for anything else.</description>
</maintainer>
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-18 21:27 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-03-18 21:27 UTC (permalink / raw
To: gentoo-commits
commit: aa6973a8a81393d9c7648e179f010aa3c990a849
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 18 21:26:02 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Mar 18 21:26:02 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aa6973a8
net-misc/openssh: mark 7.2_p2 arm64/ia64/m68k/s390/sh/sparc stable #576954
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index 5ad0876..62f1026 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-18 6:12 Markus Meier
0 siblings, 0 replies; 441+ messages in thread
From: Markus Meier @ 2016-03-18 6:12 UTC (permalink / raw
To: gentoo-commits
commit: 0e6af10b9cd29d7e411cd2b8c9c69f695c85fdfe
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 18 06:12:21 2016 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Fri Mar 18 06:12:21 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e6af10b
net-misc/openssh: arm stable, bug #576954
Package-Manager: portage-2.2.28
RepoMan-Options: --include-arches="arm"
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index 0998196..5ad0876 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-16 11:51 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-03-16 11:51 UTC (permalink / raw
To: gentoo-commits
commit: f4025fe30f34683c63cf1204715ed246e83082d9
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 16 11:48:25 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Mar 16 11:51:09 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f4025fe3
net-misc/openssh: ppc stable wrt bug #576954
Package-Manager: portage-2.2.26
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index e669bd1..0998196 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-15 20:50 Tobias Klausmann
0 siblings, 0 replies; 441+ messages in thread
From: Tobias Klausmann @ 2016-03-15 20:50 UTC (permalink / raw
To: gentoo-commits
commit: a4da4c8f8f697ff38c09d3e341b8c5a766edcedb
Author: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 15 20:50:28 2016 +0000
Commit: Tobias Klausmann <klausman <AT> gentoo <DOT> org>
CommitDate: Tue Mar 15 20:50:28 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a4da4c8f
net-misc/openssh-7.2_p2-r0: add alpha keyword
Gentoo-Bug: 576954
Package-Manager: portage-2.2.28
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index e446cc0..e669bd1 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-15 16:39 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-03-15 16:39 UTC (permalink / raw
To: gentoo-commits
commit: 3dfbf8eea8d35b3924833b1a99e59412ace96bb1
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 15 16:37:22 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Mar 15 16:38:51 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3dfbf8ee
net-misc/openssh: x86 stable wrt bug #576954
Package-Manager: portage-2.2.26
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index 87df95c..e446cc0 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-12 9:12 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2016-03-12 9:12 UTC (permalink / raw
To: gentoo-commits
commit: b93aae877453c9d5d2a831e9b3ea7aa624f2a284
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 12 09:10:14 2016 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Sat Mar 12 09:10:14 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b93aae87
net-misc/openssh: Stable for HPPA PPC64 (bug #576954).
Package-Manager: portage-2.2.28
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index 47334b9..87df95c 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-11 13:29 Richard Freeman
0 siblings, 0 replies; 441+ messages in thread
From: Richard Freeman @ 2016-03-11 13:29 UTC (permalink / raw
To: gentoo-commits
commit: 33a7f2c143287a912f8306155a09142f94cb576a
Author: Richard Freeman <rich0 <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 11 13:29:39 2016 +0000
Commit: Richard Freeman <rich0 <AT> gentoo <DOT> org>
CommitDate: Fri Mar 11 13:29:39 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33a7f2c1
net-misc/openssh: amd64 stable
Bug: 576954
Package-Manager: portage-2.2.26
net-misc/openssh/openssh-7.2_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
index 7613ed8..47334b9 100644
--- a/net-misc/openssh/openssh-7.2_p2.ebuild
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-11 5:52 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-03-11 5:52 UTC (permalink / raw
To: gentoo-commits
commit: a6cd19cc42eac1e72dff6585b9c83bce69048df6
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 11 05:51:49 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Mar 11 05:51:49 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a6cd19cc
net-misc/openssh: version bump to 7.2_p2 #576954
net-misc/openssh/Manifest | 3 +
net-misc/openssh/openssh-7.2_p2.ebuild | 324 +++++++++++++++++++++++++++++++++
2 files changed, 327 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index aeb1b97..ff03350 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -9,6 +9,9 @@ DIST openssh-7.1p2.tar.gz 1475829 SHA256 dd75f024dcf21e06a0d6421d582690bf987a1f6
DIST openssh-7.2_p1-sctp.patch.xz 8088 SHA256 b9cc21336e23d44548e87964da9ff85ac83ce84693162abb172afb46be4a666e SHA512 b287684337a101a26ab8df6894b679b063cdaa7dfc7b78fcc0ce8350c27526f150a6463c515019beb0af2ff005cc109d2913998f95f828e553b835a4df8b64df WHIRLPOOL 16646a896f746946af84961974be08418b951c80249dce2fd4ae533a4d66e79d4372fd979aeda9c51aff51b86edf4178af18379e948195696a6fa114e2757306
DIST openssh-7.2p1+x509-8.8.diff.gz 446930 SHA256 a6a4bc0fb63d8117718d2ddb975ff09e99d8788913b396f9b7af22a7630e5d8f SHA512 28ace1c1972b8a77f0574b578054bb0224ec3861f6549c193351b1c8395ed335c9cf1070f8cc9b28c9b4188ead264d84bcd4477d4ce8b6143e0122ac9e7eb304 WHIRLPOOL c5dd0f4be77f69a0cd435b1a4f85496ec5da3a162f0858a006acb0bedfb613959f74031ccf24fb4f86f7244a20066a89191d068a4890d165315586d5574f7155
DIST openssh-7.2p1.tar.gz 1499707 SHA256 973cc37b2f3597e4cf599b09e604e79c0fe5d9b6f595a24e91ed0662860b4ac3 SHA512 e6a1a6fbc420c5af76892f05ac5d7601533629a595869c6143edc3a21322faa72c5638ccb2e346d25af5703d77c1e1bebf2ace488d75aaaa5b3d5a65a53bdb54 WHIRLPOOL d284999b325b5ef1c4e33ea14a51d74a22c7b52d9642dee70490fa71b4473dd08c0b76c4faa4575932c579b931608f575f3366881dd6438150b71333239e189c
+DIST openssh-7.2p2+x509-8.9.diff.gz 449308 SHA256 bd77fcd285d10a86fb2934e90776fe39e4cd2da043384ec2ca45296a60669589 SHA512 c7ed07aae72fd4f967ab5717831c51ad639ca59633c3768f6930bab0947f5429391e3911a7570288a1c688c8c21747f3cb722538ae96de6b50a021010e1506fa WHIRLPOOL 7c1328e471b0e5e9576117ec563b66fea142886b0666b6d51ac9b8ec09286ba7a965b62796c32206e855e484180797a2c31d500c27289f3bc8c7db2d3af95e6f
+DIST openssh-7.2p2.tar.gz 1499808 SHA256 a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c SHA512 44f62b3a7bc50a0735d496a5aedeefb71550d8c10ad8f22b94e29fcc8084842db96e8c4ca41fced17af69e1aab09ed1182a12ad8650d9a46fd8743a0344df95b WHIRLPOOL 95e16af6d1d82f4a660b56854b8e9da947b89e47775c06fe277a612cd1a7cabe7454087eb45034aedfb9b08096ce4aa427b9a37f43f70ccf1073664bdec13386
DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256 d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512 2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081 WHIRLPOOL b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b
DIST openssh-lpk-7.1p2-0.3.14.patch.xz 17704 SHA256 fbf2e1560cac707f819a539999c758a444ba6bfe140ef80d1af7ef1c9a95f0df SHA512 95851baa699da16720358249d54d2f6a3c57b0ae082375bef228b97697c501c626ab860916c5b17e3c649b44f14f4009ff369962597438dfd60480a0e4882471 WHIRLPOOL 4629b3a7d1f373a678935e889a6cd0d66d70b420e93e40ae0ad19aa7f91be7dcf2169fb797d89df93005a885d54ebaa0d46c2e5418bd2d0a77ad64e65897b518
DIST openssh-lpk-7.2p1-0.3.14.patch.xz 17700 SHA256 4fdec61e082acedd33cf9199ff8a99780b8b1690e2236a05d1a57035dde70a5b SHA512 4da7ab88c42df4580dccadf43c72c9a19806172dd219356b740dd9877db5ba2842d481ffaac3f87427ca2b7fa2bc4f076edf1890517d13f641122bbf6728d8c7 WHIRLPOOL dcb4c800c5b54b512907dd00f6aab7f0c7ee87cb66240eb346cdd4937ed62983e21fb1777a4c74d7b6db492683ed4c68de13a21dbcba39abd879a16c6b4dd2da
+DIST openssh-lpk-7.2p2-0.3.14.patch.xz 17692 SHA256 2cd4108d60112bd97402f9c27aac2c24d334a37afe0933ad9c6377a257a68aee SHA512 e6a25f8f0106fadcb799300452d6f22034d3fc69bd1c95a3365884873861f41b1e9d49f2c5223dde6fcd00562c652ba466bc8c48833ce5ab353af3a041f75b15 WHIRLPOOL 237343b320772a1588b64c4135758af840199214129d7e8cfa9798f976c32902ca5493ee0c33b16003854fea243556997bc688640a9872b82c06f72c86f2586d
diff --git a/net-misc/openssh/openssh-7.2_p2.ebuild b/net-misc/openssh/openssh-7.2_p2.ebuild
new file mode 100644
index 0000000..7613ed8
--- /dev/null
+++ b/net-misc/openssh/openssh-7.2_p2.ebuild
@@ -0,0 +1,324 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
+LDAP_PATCH="${PN}-lpk-7.2p2-0.3.14.patch.xz"
+X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-7.2_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
+ #save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ epatch "${WORKDIR}"/${PN}-7.2_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-03-04 18:58 Mike Gilbert
0 siblings, 0 replies; 441+ messages in thread
From: Mike Gilbert @ 2016-03-04 18:58 UTC (permalink / raw
To: gentoo-commits
commit: e29aea826c4f7e84888c789d872e4f465222f468
Author: Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 4 18:58:03 2016 +0000
Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Fri Mar 4 18:58:03 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e29aea82
net-misc/openssh: Re-order maintainers
net-misc/openssh/metadata.xml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
index 1d275bd..a809b9d 100644
--- a/net-misc/openssh/metadata.xml
+++ b/net-misc/openssh/metadata.xml
@@ -1,14 +1,14 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
- <maintainer restrict="net-misc/openssh[ldap]" type="person">
- <email>robbat2@gentoo.org</email>
- <description>LPK issues. Only assign if it's a direct LPK issue. Do not directly assign for anything else.</description>
- </maintainer>
<maintainer type="project">
<email>base-system@gentoo.org</email>
<name>Gentoo Base System</name>
</maintainer>
+ <maintainer restrict="net-misc/openssh[ldap]" type="person">
+ <email>robbat2@gentoo.org</email>
+ <description>LPK issues. Only assign if it's a direct LPK issue. Do not directly assign for anything else.</description>
+ </maintainer>
<longdescription>
OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools that
increasing numbers of people on the Internet are coming to rely on. Many users of telnet,
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-01-17 9:01 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-01-17 9:01 UTC (permalink / raw
To: gentoo-commits
commit: 04ebe3333cee7df7c418f2ef7bce08e97989b3aa
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 17 09:00:21 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Sun Jan 17 09:00:28 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04ebe333
net-misc/openssh: rev bump to pick up new x509 patch
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.1_p2-r1.ebuild | 326 ++++++++++++++++++++++++++++++
2 files changed, 327 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 775ee66..61ef955 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -3,6 +3,7 @@ DIST openssh-7.1p1+x509-8.6.diff.gz 413931 SHA256 cbf661a1fec080dc9ed335a2904141
DIST openssh-7.1p1-hpnssh14v9.tar.xz 21580 SHA256 a795c2f2621f537b3fd98172cbd1f7c71869e4da78cd280d123fa19ae4262b97 SHA512 6ce151949bf81b5518b95092a2f18d2f24581954e2c629deaf3c1d10136f32f830567aafb9b4045547e95e3ab63cf750e240eac40e2b9caa6d71cb2b132821ec WHIRLPOOL 8e3c9a1d79112092a6cb42c6766ccdf61e5d8fcd366ea5c7d3bab94cf309bcc12f3761476a288158638a340023aa24519d888caac19fb0ef25fa56bdab06412c
DIST openssh-7.1p1.tar.gz 1493170 SHA256 fc0a6d2d1d063d5c66dffd952493d0cda256cad204f681de0f84ef85b2ad8428 SHA512 f1491ca5a0a733eb27ede966590642a412cb7be7178dcb7b9e5844bbdc8383032f4b00435192b95fc0365b6fe74d6c5ac8d6facbe9d51e1532d049e2f784e8f7 WHIRLPOOL a650a93657f930d20dc3fa24ab720857f63f7cd0a82d1906cf1e58145e866129207851d5e587d678655e5731fa73221ab9b6ea0754533100c25fe2acaa442e05
DIST openssh-7.1p2+x509-8.6.diff.xz 283964 SHA256 0848ceb42fa15f6197d5d81f9da6dea9cc3a7fda2fdb424447fa0f995a5197d1 SHA512 276f5738498ce9a559a5066cfeb670c48f275c2cbf7b007f213405b71349f1f77cc2c7bee6af5ee548b9443f0e44ede0e3d232a31b52ac834cf81cac855bfa87 WHIRLPOOL 024b9f0d9dda3ec2ae7da156f801c3735e5ff7198010fbc021ccde8adada28e45f076264c9f09fc34586adc52d8ad93689b4bdbecaaad7761bb9e26a8c4af231
+DIST openssh-7.1p2+x509-8.7.diff.gz 438584 SHA256 23030dff924a78718686fad6442b1083293b0c2a057714291bd0af9ed8ef5868 SHA512 d9aa43f5fc06b88b442285a9f9a15d01b52796c36f0cb228c756edca473a89eadb296c45503a14514fdb156d3bc9d90ff33271ccfa9461a9bb2b798a581cc007 WHIRLPOOL ef3f4486fff0addad1a6bdcde3ba606d55d6e3ea5d2cd6e79bfe2494d660c38f0e9f1c157af72c3b6ad5e6eb3731168f975b26c94f8357154e54c08e5d876652
DIST openssh-7.1p2-hpnssh14v10.tar.xz 22388 SHA256 729e20a2627ca403da6cfff8ef251c03421022123a21c68003181b4e5409bcc5 SHA512 b8e88ac5891ed632416db8da6377512614f19f5f7a7c093b55ecfe3e3f50979c61c0674e9381c316632d8daed90f8cce958c9b77bd00084a4ee1b0297cf321ba WHIRLPOOL c466cc33dc4a40e9466148beb154c539e095ac1b9cdcc5b3d235cbcf12ca10255d63da2f0e1da10d1afa1a0d2ebd436ca0d9e542c732df6ef67fb8f4d2d0192c
DIST openssh-7.1p2.tar.gz 1475829 SHA256 dd75f024dcf21e06a0d6421d582690bf987a1f6323e32ad6619392f3bfde6bbd SHA512 d5be60f3645ec238b21e1f2dfd801b2136146674bbc086ebdb14be516c613819bc87c84b5089f3a45fe6e137a7458404f79f42572c69d91571e45ebed9d5e3af WHIRLPOOL 9f48952b82db3983c20e84bcff5b6761f5b284174072c828698dced3a53ca8bbc2e1f89d2e82b62a68f4606b52c980fcf097250f86c1a67ad343d20e3ec9d1f4
DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256 d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512 2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081 WHIRLPOOL b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b
diff --git a/net-misc/openssh/openssh-7.1_p2-r1.ebuild b/net-misc/openssh/openssh-7.1_p2-r1.ebuild
new file mode 100644
index 0000000..5c418d4
--- /dev/null
+++ b/net-misc/openssh/openssh-7.1_p2-r1.ebuild
@@ -0,0 +1,326 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz"
+LDAP_PATCH="${PN}-lpk-7.1p2-0.3.14.patch.xz"
+X509_VER="8.7" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
+ epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch
+ save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ # The X509 patchset fixes this independently.
+ use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch
+ epatch "${WORKDIR}"/${PN}-6.8_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-01-15 14:10 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-01-15 14:10 UTC (permalink / raw
To: gentoo-commits
commit: 1092815e48b8155057f1ed39cd888ba8a6bade58
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 15 13:55:16 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Fri Jan 15 14:09:10 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1092815e
net-misc/openssh: mark 7.1_p2 arm64/hppa/m68k stable #571892
net-misc/openssh/openssh-7.1_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p2.ebuild b/net-misc/openssh/openssh-7.1_p2.ebuild
index f8ae245..762e35d 100644
--- a/net-misc/openssh/openssh-7.1_p2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-01-15 9:15 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2016-01-15 9:15 UTC (permalink / raw
To: gentoo-commits
commit: 876476e6f68c185ed4cdb286a2453106fb7a9b58
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 15 09:13:58 2016 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Fri Jan 15 09:13:58 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=876476e6
net-misc/openssh-7.1_p2: stable for alpha/amd64/arm/ia64/ppc/ppc64/s390/sh/sparc/x86 wrt bug #571892
Package-Manager: portage-2.2.26
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-misc/openssh/openssh-7.1_p2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p2.ebuild b/net-misc/openssh/openssh-7.1_p2.ebuild
index 153649a..f8ae245 100644
--- a/net-misc/openssh/openssh-7.1_p2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 arm ~arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-01-14 20:59 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2016-01-14 20:59 UTC (permalink / raw
To: gentoo-commits
commit: 7d47c8fd0679cdda919da4931076ac74a43338a5
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 14 20:23:46 2016 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Thu Jan 14 20:59:31 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7d47c8fd
net-misc/openssh: fix patch failures when USE="-hpn X509"
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 8 +++++---
net-misc/openssh/openssh-7.1_p1-r3.ebuild | 8 +++++---
2 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 584f384..40ee3c8 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -116,9 +116,11 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
- pushd ${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
- popd >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
diff --git a/net-misc/openssh/openssh-7.1_p1-r3.ebuild b/net-misc/openssh/openssh-7.1_p1-r3.ebuild
index 69c064d..07f0e7f 100644
--- a/net-misc/openssh/openssh-7.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r3.ebuild
@@ -115,9 +115,11 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
- pushd ${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
- popd >/dev/null
+ if use hpn ; then
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ fi
epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2016-01-14 20:40 Richard Freeman
0 siblings, 0 replies; 441+ messages in thread
From: Richard Freeman @ 2016-01-14 20:40 UTC (permalink / raw
To: gentoo-commits
commit: 2bbf8c4d3df7ba6fd7356dae4880096570834c6f
Author: Richard Freeman <rich0 <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 14 20:38:10 2016 +0000
Commit: Richard Freeman <rich0 <AT> gentoo <DOT> org>
CommitDate: Thu Jan 14 20:38:54 2016 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2bbf8c4d
net-misc/openssh: amd64 stable
Gentoo-bug: 571892
Package-Manager: portage-2.2.26
net-misc/openssh/openssh-7.1_p1-r3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r3.ebuild b/net-misc/openssh/openssh-7.1_p1-r3.ebuild
index f8aac3e..69c064d 100644
--- a/net-misc/openssh/openssh-7.1_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r3.ebuild
@@ -27,7 +27,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-15 18:26 Matt Turner
0 siblings, 0 replies; 441+ messages in thread
From: Matt Turner @ 2015-11-15 18:26 UTC (permalink / raw
To: gentoo-commits
commit: 3e9702c339ce1a04f914c5b9a41b3682e0fb499d
Author: Matt Turner <mattst88 <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 15 18:00:12 2015 +0000
Commit: Matt Turner <mattst88 <AT> gentoo <DOT> org>
CommitDate: Sun Nov 15 18:27:45 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3e9702c3
net-misc/openssh: alpha stable, bug 555518.
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index a063530..584f384 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-10 4:57 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-11-10 4:57 UTC (permalink / raw
To: gentoo-commits
commit: d8dd90409f5dbea050e69342a8ee805d22dfc5c4
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 10 04:54:57 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Nov 10 04:54:57 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d8dd9040
net-misc/openssh: drop skey addpredict
The openssh configure script changed a long time ago to not compile+run a
skey test program. It's only compile+link now which means the code does
not try to access any paths and we can drop this sandbox logic.
net-misc/openssh/openssh-6.7_p1-r4.ebuild | 1 -
net-misc/openssh/openssh-6.7_p1.ebuild | 1 -
net-misc/openssh/openssh-6.8_p1-r5.ebuild | 1 -
net-misc/openssh/openssh-6.9_p1-r1.ebuild | 1 -
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 1 -
net-misc/openssh/openssh-7.0_p1.ebuild | 1 -
net-misc/openssh/openssh-7.1_p1-r1.ebuild | 1 -
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 1 -
net-misc/openssh/openssh-7.1_p1.ebuild | 1 -
9 files changed, 9 deletions(-)
diff --git a/net-misc/openssh/openssh-6.7_p1-r4.ebuild b/net-misc/openssh/openssh-6.7_p1-r4.ebuild
index 86a7dbd..3398875 100644
--- a/net-misc/openssh/openssh-6.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-6.7_p1-r4.ebuild
@@ -176,7 +176,6 @@ static_use_with() {
src_configure() {
local myconf=()
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys #skey configure code triggers this
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-6.7_p1.ebuild b/net-misc/openssh/openssh-6.7_p1.ebuild
index bf6af70..cb06aa7 100644
--- a/net-misc/openssh/openssh-6.7_p1.ebuild
+++ b/net-misc/openssh/openssh-6.7_p1.ebuild
@@ -175,7 +175,6 @@ static_use_with() {
src_configure() {
local myconf=()
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys #skey configure code triggers this
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-6.8_p1-r5.ebuild b/net-misc/openssh/openssh-6.8_p1-r5.ebuild
index e11c9f0..ed55efd 100644
--- a/net-misc/openssh/openssh-6.8_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-6.8_p1-r5.ebuild
@@ -182,7 +182,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-6.9_p1-r1.ebuild b/net-misc/openssh/openssh-6.9_p1-r1.ebuild
index 79c1a8b..a7dc45a 100644
--- a/net-misc/openssh/openssh-6.9_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r1.ebuild
@@ -173,7 +173,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index 9ddc665..40ad0d2 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -167,7 +167,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index 178bf10..9f3ff39 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -167,7 +167,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-7.1_p1-r1.ebuild b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
index beebed5..2571fd0 100644
--- a/net-misc/openssh/openssh-7.1_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
@@ -172,7 +172,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 42a6a3d..df8de9a 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -172,7 +172,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index 45ed87d..895dc7f 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -169,7 +169,6 @@ src_prepare() {
src_configure() {
addwrite /dev/ptmx
- addpredict /etc/skey/skeykeys # skey configure code triggers this
use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
use static && append-ldflags -static
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-10 4:57 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-11-10 4:57 UTC (permalink / raw
To: gentoo-commits
commit: 0f1e57af3008ce0ff34baf39bd688f90edf36e48
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 10 04:56:33 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Nov 10 04:56:33 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0f1e57af
net-misc/openssh: mark arm64/ia64/m68k/s390/sh stable #555518
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index df8de9a..a063530 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-10 4:57 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-11-10 4:57 UTC (permalink / raw
To: gentoo-commits
commit: 1a979a16ac75fda780da5dfd3d31ab8a2b4acfec
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 10 04:50:26 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Tue Nov 10 04:50:26 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1a979a16
net-misc/openssh: warn about change in default root config #555518#16
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 24cdf96..42a6a3d 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -308,12 +308,16 @@ pkg_postinst() {
elog "Make sure to update any configs that you might have. Note that xinetd might"
elog "be an alternative for you as it supports USE=tcpd."
fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
elog "adding to your sshd_config or ~/.ssh/config files:"
elog " PubkeyAcceptedKeyTypes=+ssh-dss"
elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
fi
if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
elog "Be aware that by disabling openssl support in openssh, the server and clients"
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-06 4:21 Jeroen Roovers
0 siblings, 0 replies; 441+ messages in thread
From: Jeroen Roovers @ 2015-11-06 4:21 UTC (permalink / raw
To: gentoo-commits
commit: 3f6d6a1c1ee64f72d4116e13dcb768e2d7ff6fd3
Author: Jeroen Roovers <jer <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 6 04:11:33 2015 +0000
Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org>
CommitDate: Fri Nov 6 04:11:33 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3f6d6a1c
net-misc/openssh: Stable for HPPA PPC64 (bug #555518).
Package-Manager: portage-2.2.24
RepoMan-Options: --ignore-arches
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 53825a0..24cdf96 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-05 20:57 Markus Meier
0 siblings, 0 replies; 441+ messages in thread
From: Markus Meier @ 2015-11-05 20:57 UTC (permalink / raw
To: gentoo-commits
commit: 2df71ecb43320070844cbd1bb41c23d3c05164c7
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 5 20:56:59 2015 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Thu Nov 5 20:56:59 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2df71ecb
net-misc/openssh: arm stable, bug #555518
Package-Manager: portage-2.2.23
RepoMan-Options: --include-arches="arm"
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index ec8d8ed..53825a0 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-05 10:58 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2015-11-05 10:58 UTC (permalink / raw
To: gentoo-commits
commit: 49ada01da9277bc627267ae76e405b227b7d6952
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 5 10:58:28 2015 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Thu Nov 5 10:58:28 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49ada01d
net-misc/openssh: sparc stable wrt bug #555518
Package-Manager: portage-2.2.20.1
RepoMan-Options: --include-arches="sparc"
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index a92fbde..ec8d8ed 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-04 14:26 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2015-11-04 14:26 UTC (permalink / raw
To: gentoo-commits
commit: 828521d6a681209a5b15a040b055c33b099f255d
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 4 14:26:45 2015 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Nov 4 14:26:45 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=828521d6
net-misc/openssh: ppc stable wrt bug #555518
Package-Manager: portage-2.2.20.1
RepoMan-Options: --include-arches="ppc"
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index abdee23..a92fbde 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-03 17:13 Agostino Sarubbo
0 siblings, 0 replies; 441+ messages in thread
From: Agostino Sarubbo @ 2015-11-03 17:13 UTC (permalink / raw
To: gentoo-commits
commit: 5ced64bc1d676bff7521f21ff8fa34736b7ac061
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 3 17:13:37 2015 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Nov 3 17:13:37 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ced64bc
net-misc/openssh: x86 stable wrt bug #555518
Package-Manager: portage-2.2.20.1
RepoMan-Options: --include-arches="x86"
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index aad62fe..abdee23 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-11-03 16:11 Mikle Kolyada
0 siblings, 0 replies; 441+ messages in thread
From: Mikle Kolyada @ 2015-11-03 16:11 UTC (permalink / raw
To: gentoo-commits
commit: 12f079c4434dcb78400e7c02549ca598a60f92f4
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 3 16:08:59 2015 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Tue Nov 3 16:08:59 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=12f079c4
net-misc/openssh: amd64 stable wrt bug #555518
Package-Manager: portage-2.2.20.1
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 7ab7d10..aad62fe 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -28,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
LICENSE="BSD GPL-2"
SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
REQUIRED_USE="ldns? ( ssl )
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-10-31 10:13 Michał Górny
0 siblings, 0 replies; 441+ messages in thread
From: Michał Górny @ 2015-10-31 10:13 UTC (permalink / raw
To: gentoo-commits
commit: 44c505591f7e37d3e10e0d6f522df56d1de1d78c
Author: Yuta Satoh <nigoro <AT> gentoo <DOT> gr <DOT> jp>
AuthorDate: Fri Oct 30 11:12:50 2015 +0000
Commit: Michał Górny <mgorny <AT> gentoo <DOT> org>
CommitDate: Fri Oct 30 11:12:50 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=44c50559
net-misc/openssh: Drop special settings for Gentoo/FreeBSD 9.0 or later.
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 6 ------
1 file changed, 6 deletions(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 048f319..7ab7d10 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -207,12 +207,6 @@ src_configure() {
# The seccomp sandbox is broken on x32, so use the older method for now. #553748
use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
- # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
- if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed 's/\(.\..\).*/\1/')" ; then
- myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
- append-ldflags -lutil
- fi
-
econf "${myconf[@]}"
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-10-29 17:01 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-10-29 17:01 UTC (permalink / raw
To: gentoo-commits
commit: d90c920dbd83c1ec22f068623e15e4c421d11ba3
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 29 17:00:05 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Thu Oct 29 17:00:38 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d90c920d
net-misc/openssh: make hpn-x509 glue patch application more robust #564380
Rather than encode the full name of the hpn patchset in the glue patch,
apply it from the hpn patchset dir.
net-misc/openssh/openssh-7.1_p1-r1.ebuild | 2 ++
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 4 +++-
net-misc/openssh/openssh-7.1_p1.ebuild | 2 ++
3 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r1.ebuild b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
index 41f49c8..beebed5 100644
--- a/net-misc/openssh/openssh-7.1_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
@@ -116,7 +116,9 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
+ pushd ${HPN_PATCH%.*.*} >/dev/null
epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 7e645fd..048f319 100644
--- a/net-misc/openssh/openssh-7.1_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -9,7 +9,7 @@ inherit eutils user flag-o-matic multilib autotools pam systemd versionator
# and _p? releases.
PARCH=${P/_}
-HPN_PATCH="${PN}-7.1p1-hpnssh14v9.tar.xz"
+HPN_PATCH="${PARCH}-hpnssh14v9.tar.xz"
LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz"
X509_VER="8.6" X509_PATCH="${PN}-${PV//_/}+x509-${X509_VER}.diff.gz"
@@ -116,7 +116,9 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
+ pushd ${HPN_PATCH%.*.*} >/dev/null
epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index a9a499e..45ed87d 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -113,7 +113,9 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
+ pushd ${HPN_PATCH%.*.*} >/dev/null
epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-10-29 6:14 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-10-29 6:14 UTC (permalink / raw
To: gentoo-commits
commit: 13b24dbb86a4f2013c376c65ada52d9aee2561c6
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 29 06:13:41 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Thu Oct 29 06:14:01 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=13b24dbb
net-misc/openssh: fix tun window size in hpn mode #564236
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.1_p1-r2.ebuild | 327 ++++++++++++++++++++++++++++++
2 files changed, 328 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 461d5c1..cf1e7a0 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -15,6 +15,7 @@ DIST openssh-7.0p1+x509-8.5.diff.gz 411960 SHA256 6000557f1ddae06aff8837d440d933
DIST openssh-7.0p1-hpnssh14v5.tar.xz 21428 SHA256 6032c4547c9f83a6f648ac7c39cdad2bd6fd725e5f3ab2411c5b30298aae1451 SHA512 d4cf4a628c11515bfe8c3a91b4b7039fca28c2f89ad1dde062c4cb433b984b10dec2d37b1f338f18aa7813e60d8608b65ca95b930edc33086710b82780875942 WHIRLPOOL 7b686f243c98017453b3da3e98b7524650b4a0a75fda6add80c7c233d468194d1d1333ffa4445c20856d807548aaa356c87a03ca87d8995a4b7ba350c7714d1e
DIST openssh-7.0p1.tar.gz 1493376 SHA256 fd5932493a19f4c81153d812ee4e042b49bbd3b759ab3d9344abecc2bc1485e5 SHA512 d82aa8e85630c3e2102e69da477185e0d30d84211d7d4ee0a1d9822bd234d649fe369bf91ce3d2b5ef0caee687d383cb761b682d3bf24bccbd2ce9a1fe9d9f50 WHIRLPOOL bb8007450ffee580df5a73e3d6ab9b54b7151c46c3b996516e5cb776034be21cbef1281a520279655137e218a757d8092cba3f66e216c6b4c6828876540cb5df
DIST openssh-7.1p1+x509-8.6.diff.gz 413931 SHA256 cbf661a1fec080dc9ed335a290414154326c2a13f124985db050b86a91073d52 SHA512 c91d0f1b69b6d34984e94b391ad022271e73d0634cef2df355ba555366bc38d30649b478f245b6c51ce79d71adf1b693bc97826e6c6013a78e7ccfb7023b4bcc WHIRLPOOL 4ed4427e80026996c43a188d7d45f2c53fa6a7fd842a248b1225b27f3e9037e761f0ed172d79b53ada81c24d958a2193e94d918f6ca1320e45d5e68379845981
+DIST openssh-7.1p1-hpnssh14v9.tar.xz 21580 SHA256 a795c2f2621f537b3fd98172cbd1f7c71869e4da78cd280d123fa19ae4262b97 SHA512 6ce151949bf81b5518b95092a2f18d2f24581954e2c629deaf3c1d10136f32f830567aafb9b4045547e95e3ab63cf750e240eac40e2b9caa6d71cb2b132821ec WHIRLPOOL 8e3c9a1d79112092a6cb42c6766ccdf61e5d8fcd366ea5c7d3bab94cf309bcc12f3761476a288158638a340023aa24519d888caac19fb0ef25fa56bdab06412c
DIST openssh-7.1p1.tar.gz 1493170 SHA256 fc0a6d2d1d063d5c66dffd952493d0cda256cad204f681de0f84ef85b2ad8428 SHA512 f1491ca5a0a733eb27ede966590642a412cb7be7178dcb7b9e5844bbdc8383032f4b00435192b95fc0365b6fe74d6c5ac8d6facbe9d51e1532d049e2f784e8f7 WHIRLPOOL a650a93657f930d20dc3fa24ab720857f63f7cd0a82d1906cf1e58145e866129207851d5e587d678655e5731fa73221ab9b6ea0754533100c25fe2acaa442e05
DIST openssh-lpk-6.7p1-0.3.14.patch.xz 16920 SHA256 0203e6e44e41d58ec46d1611d7efc985134e662bbee51632c29f43ae809003f0 SHA512 344ccde4a04aeb1500400f779e64b2d8a5ad2970de3c4c343ca9605758e22d3812ef5453cd3221b18ad74a9762583c62417879107e4e1dda1398a6a65bcd04b2 WHIRLPOOL 5b6beeb743d04deea70c8b471a328b5f056fd4651e1370c7882e5d12f54fa2170486dcd6f97aa8c58e80af9a2d4012e2dfbcf53185317976d309783ca8d6cf73
DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256 d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512 2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081 WHIRLPOOL b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b
diff --git a/net-misc/openssh/openssh-7.1_p1-r2.ebuild b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
new file mode 100644
index 0000000..7e645fd
--- /dev/null
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -0,0 +1,327 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="4"
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PN}-7.1p1-hpnssh14v9.tar.xz"
+LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz"
+X509_VER="8.6" X509_PATCH="${PN}-${PV//_/}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ https://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ epatch "${FILESDIR}"/${PN}-6.3_p1-x509-hpn14v2-glue.patch
+ epatch "${FILESDIR}"/${PN}-6.9_p1-x509-warnings.patch
+ save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ # The X509 patchset fixes this independently.
+ use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch
+ epatch "${WORKDIR}"/${PN}-6.8_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+ addpredict /etc/skey/skeykeys # skey configure code triggers this
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ # The X509 patch deletes this option entirely.
+ $(use X509 || use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
+ if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed 's/\(.\..\).*/\1/')" ; then
+ myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
+ append-ldflags -lutil
+ fi
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-26 8:07 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-09-26 8:07 UTC (permalink / raw
To: gentoo-commits
commit: 8392e26a62eb085c9a537560c23c6614a51b62cf
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 26 08:07:37 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Sat Sep 26 08:07:43 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8392e26a
net-misc/openssh: note ssh-dss client config options too
net-misc/openssh/openssh-7.1_p1-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-misc/openssh/openssh-7.1_p1-r1.ebuild b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
index 082440f..41f49c8 100644
--- a/net-misc/openssh/openssh-7.1_p1-r1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
@@ -315,7 +315,7 @@ pkg_postinst() {
if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config:"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
elog " PubkeyAcceptedKeyTypes=+ssh-dss"
elog "You should however generate new keys using rsa or ed25519."
fi
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-20 17:35 Julian Ospald
0 siblings, 0 replies; 441+ messages in thread
From: Julian Ospald @ 2015-09-20 17:35 UTC (permalink / raw
To: gentoo-commits
commit: cb790cc5d87d2b0b213ca1f601e29028bdaaf3dd
Author: Julian Ospald <hasufell <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 20 17:12:44 2015 +0000
Commit: Julian Ospald <hasufell <AT> gentoo <DOT> org>
CommitDate: Sun Sep 20 17:34:58 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cb790cc5
net-misc/openssh: add libressl support
net-misc/openssh/openssh-7.1_p1-r1.ebuild | 327 ++++++++++++++++++++++++++++++
1 file changed, 327 insertions(+)
diff --git a/net-misc/openssh/openssh-7.1_p1-r1.ebuild b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
new file mode 100644
index 0000000..082440f
--- /dev/null
+++ b/net-misc/openssh/openssh-7.1_p1-r1.ebuild
@@ -0,0 +1,327 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="4"
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PN}-7.0p1-hpnssh14v5.tar.xz"
+LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz"
+X509_VER="8.6" X509_PATCH="${PN}-${PV//_/}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ https://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ epatch "${FILESDIR}"/${PN}-6.3_p1-x509-hpn14v2-glue.patch
+ epatch "${FILESDIR}"/${PN}-6.9_p1-x509-warnings.patch
+ save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ # The X509 patchset fixes this independently.
+ use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch
+ epatch "${WORKDIR}"/${PN}-6.8_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+ addpredict /etc/skey/skeykeys # skey configure code triggers this
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ # The X509 patch deletes this option entirely.
+ $(use X509 || use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
+ if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed 's/\(.\..\).*/\1/')" ; then
+ myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
+ append-ldflags -lutil
+ fi
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-14 20:26 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-09-14 20:26 UTC (permalink / raw
To: gentoo-commits
commit: d449aefe1f6635ea30acc81a5c6732681f89f7f3
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 14 20:25:01 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Mon Sep 14 20:26:03 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d449aefe
net-misc/openssh: fix openssl[static-libs] dep to match SLOT=0 #560306
Since we use (+) in the dep, we might match the non-zero openssl dep
in which case portage won't pull in static-libs support in SLOT=0.
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 2 +-
net-misc/openssh/openssh-7.0_p1.ebuild | 2 +-
net-misc/openssh/openssh-7.1_p1.ebuild | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index ead3926..9ddc665 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -49,7 +49,7 @@ LIB_DEPEND="
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
>=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl[static-libs(+)]
+ dev-libs/openssl:0[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
RDEPEND="
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index 7a71f85..178bf10 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -49,7 +49,7 @@ LIB_DEPEND="
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
>=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl[static-libs(+)]
+ dev-libs/openssl:0[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
RDEPEND="
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index 5c7f373..a9a499e 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -49,7 +49,7 @@ LIB_DEPEND="
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
>=dev-libs/openssl-0.9.8f:0[bindist=]
- dev-libs/openssl[static-libs(+)]
+ dev-libs/openssl:0[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
RDEPEND="
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-13 2:41 Richard Farina
0 siblings, 0 replies; 441+ messages in thread
From: Richard Farina @ 2015-09-13 2:41 UTC (permalink / raw
To: gentoo-commits
commit: 19cf898d8015af6347040689b837dc848c7dd260
Author: Zero_Chaos <zerochaos <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 13 02:34:57 2015 +0000
Commit: Richard Farina <zerochaos <AT> gentoo <DOT> org>
CommitDate: Sun Sep 13 02:34:57 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=19cf898d
net-misc/openssh: revert improper 4411ff42539dc7917a8db314327c6fbe699a616f
Package-Manager: portage-2.2.20.1
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 3 +--
net-misc/openssh/openssh-7.0_p1.ebuild | 3 +--
net-misc/openssh/openssh-7.1_p1.ebuild | 3 +--
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index e80d708..ead3926 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -48,8 +48,7 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.8f:0 )
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index 702e196..7a71f85 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -48,8 +48,7 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.8f:0 )
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index 2614574..5c7f373 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -48,8 +48,7 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.8f:0 )
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-12 23:26 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-09-12 23:26 UTC (permalink / raw
To: gentoo-commits
commit: aa682834d9a463b6a5e466c3098332b829e92adf
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 12 23:25:10 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Sat Sep 12 23:25:10 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aa682834
net-misc/openssh: require newer openssl
This matches the INSTALL guidelines in the source code.
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 4 ++--
net-misc/openssh/openssh-7.0_p1.ebuild | 4 ++--
net-misc/openssh/openssh-7.1_p1.ebuild | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index 89dc93d..e80d708 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -48,8 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.6d:0 )
+ !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.8f:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index 0c9737d..702e196 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -48,8 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.6d:0 )
+ !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.8f:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index 25a2a0f..2614574 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -48,8 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
- bindist? ( >=dev-libs/openssl-0.9.6d:0 )
+ !bindist? ( >=dev-libs/openssl-0.9.8f:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.8f:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-09-12 22:02 Richard Farina
0 siblings, 0 replies; 441+ messages in thread
From: Richard Farina @ 2015-09-12 22:02 UTC (permalink / raw
To: gentoo-commits
commit: 4411ff42539dc7917a8db314327c6fbe699a616f
Author: Zero_Chaos <zerochaos <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 12 22:01:28 2015 +0000
Commit: Richard Farina <zerochaos <AT> gentoo <DOT> org>
CommitDate: Sat Sep 12 22:02:06 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4411ff42
net-misc/openssh: relax bindist use flag deps slightly to allow for actual buildable/functional options
Package-Manager: portage-2.2.20.1
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 3 ++-
net-misc/openssh/openssh-7.0_p1.ebuild | 3 ++-
net-misc/openssh/openssh-7.1_p1.ebuild | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index b9cf6ab..89dc93d 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -48,7 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- >=dev-libs/openssl-0.9.6d:0[bindist=]
+ !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.6d:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index b7448a2..0c9737d 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -48,7 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- >=dev-libs/openssl-0.9.6d:0[bindist=]
+ !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.6d:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
index 709e6f9..25a2a0f 100644
--- a/net-misc/openssh/openssh-7.1_p1.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -48,7 +48,8 @@ LIB_DEPEND="
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
ssl? (
- >=dev-libs/openssl-0.9.6d:0[bindist=]
+ !bindist? ( >=dev-libs/openssl-0.9.6d:0[-bindist] )
+ bindist? ( >=dev-libs/openssl-0.9.6d:0 )
dev-libs/openssl[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
^ permalink raw reply related [flat|nested] 441+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-08-21 10:57 Lars Wendler
0 siblings, 0 replies; 441+ messages in thread
From: Lars Wendler @ 2015-08-21 10:57 UTC (permalink / raw
To: gentoo-commits
commit: 9e1994f8c1ebc7c0079df74a531411b121ba54eb
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 21 10:56:44 2015 +0000
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
CommitDate: Fri Aug 21 10:56:44 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9e1994f8
net-misc/openssh: Bump to version 7.1_p1
Package-Manager: portage-2.2.20.1
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
net-misc/openssh/Manifest | 1 +
net-misc/openssh/openssh-7.1_p1.ebuild | 324 +++++++++++++++++++++++++++++++++
2 files changed, 325 insertions(+)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 131a217..09457f6 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -14,5 +14,6 @@ DIST openssh-6.9p1.tar.gz 1487617 SHA256 6e074df538f357d440be6cf93dc581a21f22d39
DIST openssh-7.0p1+x509-8.5.diff.gz 411960 SHA256 6000557f1ddae06aff8837d440d93342a923fada571fec59fc5dedf388fb5f9e SHA512 1241419ea32a21b0ef15fb3845344c9b1126ecee94265b074e60af794eacdb39a98983040a61b9f169e0a6d5a0a248e1bbf9d9b3e56df50cb382441a26dddafd WHIRLPOOL 117e8c9bb05ded7fdf261e9aca709540e0a3817bc5b3e70472e8c802063e37ee24feae4c1b3a909177ab163e53c2d614b4f0fc75aad1ca44c0e0584eeff55a81
DIST openssh-7.0p1-hpnssh14v5.tar.xz 21428 SHA256 6032c4547c9f83a6f648ac7c39cdad2bd6fd725e5f3ab2411c5b30298aae1451 SHA512 d4cf4a628c11515bfe8c3a91b4b7039fca28c2f89ad1dde062c4cb433b984b10dec2d37b1f338f18aa7813e60d8608b65ca95b930edc33086710b82780875942 WHIRLPOOL 7b686f243c98017453b3da3e98b7524650b4a0a75fda6add80c7c233d468194d1d1333ffa4445c20856d807548aaa356c87a03ca87d8995a4b7ba350c7714d1e
DIST openssh-7.0p1.tar.gz 1493376 SHA256 fd5932493a19f4c81153d812ee4e042b49bbd3b759ab3d9344abecc2bc1485e5 SHA512 d82aa8e85630c3e2102e69da477185e0d30d84211d7d4ee0a1d9822bd234d649fe369bf91ce3d2b5ef0caee687d383cb761b682d3bf24bccbd2ce9a1fe9d9f50 WHIRLPOOL bb8007450ffee580df5a73e3d6ab9b54b7151c46c3b996516e5cb776034be21cbef1281a520279655137e218a757d8092cba3f66e216c6b4c6828876540cb5df
+DIST openssh-7.1p1.tar.gz 1493170 SHA256 fc0a6d2d1d063d5c66dffd952493d0cda256cad204f681de0f84ef85b2ad8428 SHA512 f1491ca5a0a733eb27ede966590642a412cb7be7178dcb7b9e5844bbdc8383032f4b00435192b95fc0365b6fe74d6c5ac8d6facbe9d51e1532d049e2f784e8f7 WHIRLPOOL a650a93657f930d20dc3fa24ab720857f63f7cd0a82d1906cf1e58145e866129207851d5e587d678655e5731fa73221ab9b6ea0754533100c25fe2acaa442e05
DIST openssh-lpk-6.7p1-0.3.14.patch.xz 16920 SHA256 0203e6e44e41d58ec46d1611d7efc985134e662bbee51632c29f43ae809003f0 SHA512 344ccde4a04aeb1500400f779e64b2d8a5ad2970de3c4c343ca9605758e22d3812ef5453cd3221b18ad74a9762583c62417879107e4e1dda1398a6a65bcd04b2 WHIRLPOOL 5b6beeb743d04deea70c8b471a328b5f056fd4651e1370c7882e5d12f54fa2170486dcd6f97aa8c58e80af9a2d4012e2dfbcf53185317976d309783ca8d6cf73
DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256 d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512 2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081 WHIRLPOOL b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b
diff --git a/net-misc/openssh/openssh-7.1_p1.ebuild b/net-misc/openssh/openssh-7.1_p1.ebuild
new file mode 100644
index 0000000..2078e87
--- /dev/null
+++ b/net-misc/openssh/openssh-7.1_p1.ebuild
@@ -0,0 +1,324 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="4"
+inherit eutils user flag-o-matic multilib autotools pam systemd versionator
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+HPN_PATCH="${PN}-7.0p1-hpnssh14v5.tar.xz"
+LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz"
+#X509_VER="8.5" X509_PATCH="${PN}-${PV//_/}+x509-${X509_VER}.diff.gz"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="http://www.openssh.org/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
+ ${HPN_PATCH:+hpn? (
+ mirror://gentoo/${HPN_PATCH}
+ http://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
+ mirror://sourceforge/hpnssh/${HPN_PATCH}
+ )}
+ ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
+ ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ ssh1? ( ssl )
+ static? ( !kerberos !pam )
+ X509? ( !ldap ssl )"
+
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
+ ssl? (
+ >=dev-libs/openssl-0.9.6d:0[bindist=]
+ dev-libs/openssl[static-libs(+)]
+ )
+ >=sys-libs/zlib-1.2.3[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S=${WORKDIR}/${PARCH}
+
+pkg_setup() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ $(use ldap && maybe_fail ldap LDAP_PATCH)
+ $(use hpn && maybe_fail hpn HPN_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+save_version() {
+ # version.h patch conflict avoidence
+ mv version.h version.h.$1
+ cp -f version.h.pristine version.h
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+ # keep this as we need it to avoid the conflict between LPK and HPN changing
+ # this file.
+ cp version.h version.h.pristine
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ if use X509 ; then
+ pushd .. >/dev/null
+ #epatch "${WORKDIR}"/${PN}-6.8_p1-x509-${X509_VER}-glue.patch
+ epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
+ popd >/dev/null
+ epatch "${WORKDIR}"/${X509_PATCH%.*}
+ epatch "${FILESDIR}"/${PN}-6.3_p1-x509-hpn14v2-glue.patch
+ epatch "${FILESDIR}"/${PN}-6.9_p1-x509-warnings.patch
+ save_version X509
+ fi
+ if use ldap ; then
+ epatch "${WORKDIR}"/${LDAP_PATCH%.*}
+ save_version LPK
+ fi
+ epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ # The X509 patchset fixes this independently.
+ use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch
+ epatch "${WORKDIR}"/${PN}-6.8_p1-sctp.patch
+ if use hpn ; then
+ EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
+ EPATCH_MULTI_MSG="Applying HPN patchset ..." \
+ epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
+ save_version HPN
+ fi
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ epatch_user #473004
+
+ # Now we can build a sane merged version.h
+ (
+ sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
+ macros=()
+ for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done
+ printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
+ ) > version.h
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+ addpredict /etc/skey/skeykeys # skey configure code triggers this
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ # We apply the ldap patch conditionally, so can't pass --without-ldap
+ # unconditionally else we get unknown flag warnings.
+ $(use ldap && use_with ldap)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with sctp)
+ $(use_with selinux)
+ $(use_with skey)
+ $(use_with ssh1)
+ # The X509 patch deletes this option entirely.
+ $(use X509 || use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
+ if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed 's/\(.\..\).*/\1/')" ; then
+ myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
+ append-ldflags -lutil
+ fi
+
+ econf "${myconf[@]}"
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd.rc6.4 sshd
+ newconfd "${FILESDIR}"/sshd.confd sshd
+ keepdir /var/empty
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED}"/etc/ssh/sshd_config || die
+ fi
+
+ # Gentoo tweaks to default config files
+ cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables #367017
+ AcceptEnv LANG LC_*
+ EOF
+ cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
+
+ # Send locale environment variables #367017
+ SendEnv LANG LC_*
+ EOF
+
+ if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
+ insinto /etc/openldap/schema/
+ newins openssh-lpk_openldap.schema openssh-lpk.schema
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+src_test() {
+ local t tests skipped failed passed shell
+ tests="interop-tests compat-tests"
+ skipped=""
+ shell=$(egetshell ${UID})
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite"
+ elog "requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped="${skipped} tests"
+ else
+ tests="${tests} tests"
+ fi
+ # It will also attempt to write to the homedir .ssh
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in ${tests} ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed="${passed}${t} " \
+ || failed="${failed}${t} "
+ done
+ einfo "Passed tests: ${passed}"
+ ewarn "Skipped tests: ${skipped}"
+ if [[ -n ${failed} ]] ; then
+ ewarn "Failed tests: ${failed}"
+ die "Some tests failed: ${failed}"
+ else
+ einfo "Failed tests: ${failed}"
+ return 0
+ fi
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
+ elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-08-13 2:57 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-08-13 2:57 UTC (permalink / raw
To: gentoo-commits
commit: 671b767a1b5a8119e43a63c167fadb27cfbb7929
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 13 02:53:56 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Thu Aug 13 02:53:56 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=671b767a
net-misc/openssh: add warnings about key support in newer versions #557388
net-misc/openssh/openssh-7.0_p1.ebuild | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net-misc/openssh/openssh-7.0_p1.ebuild b/net-misc/openssh/openssh-7.0_p1.ebuild
index f3bfefd..e7d3760 100644
--- a/net-misc/openssh/openssh-7.0_p1.ebuild
+++ b/net-misc/openssh/openssh-7.0_p1.ebuild
@@ -309,4 +309,16 @@ pkg_postinst() {
elog "Make sure to update any configs that you might have. Note that xinetd might"
elog "be an alternative for you as it supports USE=tcpd."
fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/
@ 2015-08-12 7:21 Mike Frysinger
0 siblings, 0 replies; 441+ messages in thread
From: Mike Frysinger @ 2015-08-12 7:21 UTC (permalink / raw
To: gentoo-commits
commit: 3581b2c101337dec32c2bd6779db7927ff96732a
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 12 07:21:22 2015 +0000
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org>
CommitDate: Wed Aug 12 07:21:28 2015 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3581b2c1
net-misc/openssh: relax USE=tcpd check to a warning #531156
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index fe41c28..4e68ce2 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -89,9 +89,8 @@ pkg_setup() {
# Make sure people who are using tcp wrappers are notified of its removal. #531156
if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- eerror "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- eerror "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- die "USE=tcpd no longer works"
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
fi
}
^ permalink raw reply related [flat|nested] 441+ messages in thread
end of thread, other threads:[~2024-10-30 18:39 UTC | newest]
Thread overview: 441+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-15 5:12 [gentoo-commits] repo/gentoo:master commit in: net-misc/openssh/ Sam James
-- strict thread matches above, loose matches on Subject: below --
2024-10-30 18:39 Arthur Zamarin
2024-10-30 15:46 Arthur Zamarin
2024-10-29 13:12 Sam James
2024-10-29 2:45 Sam James
2024-10-29 2:10 Sam James
2024-10-29 2:10 Sam James
2024-10-29 1:08 Sam James
2024-10-13 20:40 Sam James
2024-10-08 21:50 Jakov Smolić
2024-10-05 14:30 Arthur Zamarin
2024-10-05 13:58 Arthur Zamarin
2024-10-05 12:10 Arthur Zamarin
2024-10-05 11:12 Sam James
2024-07-08 10:12 Sam James
2024-07-01 11:18 Sam James
2024-07-01 11:18 Sam James
2024-07-01 11:18 Sam James
2024-07-01 11:12 Sam James
2024-07-01 11:12 Sam James
2024-07-01 11:12 Sam James
2024-07-01 11:12 Sam James
2024-07-01 11:12 Sam James
2024-07-01 10:40 Arthur Zamarin
2024-07-01 10:39 Sam James
2024-07-01 10:39 Sam James
2024-07-01 10:39 Arthur Zamarin
2024-07-01 10:38 Arthur Zamarin
2024-07-01 10:38 Arthur Zamarin
2024-07-01 10:38 Arthur Zamarin
2024-07-01 10:37 Sam James
2024-07-01 10:22 Sam James
2024-07-01 8:41 Sam James
2024-04-15 7:42 Sam James
2024-03-25 17:28 Mike Gilbert
2024-03-25 15:55 Mike Gilbert
2024-03-25 15:50 Mike Gilbert
2024-03-25 15:28 Mike Gilbert
2024-03-25 15:28 Mike Gilbert
2024-03-15 19:25 Sam James
2024-03-12 8:05 Sam James
2024-03-12 8:05 Sam James
2024-03-12 6:53 Sam James
2024-03-12 6:53 Sam James
2024-03-12 6:53 Sam James
2024-03-12 6:53 Sam James
2024-03-12 3:47 Sam James
2024-02-19 6:17 Sam James
2024-02-19 6:16 Sam James
2024-02-19 6:16 Sam James
2023-12-27 22:58 Sam James
2023-12-27 22:58 Sam James
2023-12-27 22:58 Sam James
2023-12-27 22:58 Sam James
2023-12-27 21:12 Sam James
2023-12-26 17:34 Sam James
2023-12-26 17:34 Sam James
2023-12-26 17:34 Sam James
2023-12-23 19:56 Arthur Zamarin
2023-12-23 4:17 Ionen Wolkens
2023-12-20 7:14 Sam James
2023-12-19 5:42 Sam James
2023-12-15 12:41 Arthur Zamarin
2023-12-15 10:38 Arthur Zamarin
2023-12-15 8:16 Sam James
2023-12-15 7:49 Sam James
2023-12-15 7:23 Sam James
2023-12-15 7:23 Sam James
2023-10-24 19:46 Arthur Zamarin
2023-10-24 19:46 Arthur Zamarin
2023-10-13 11:28 David Seifert
2023-10-13 11:04 Sam James
2023-10-09 18:57 Sam James
2023-10-09 16:21 Arthur Zamarin
2023-10-09 16:21 Arthur Zamarin
2023-10-09 5:54 Sam James
2023-10-09 4:53 Sam James
2023-10-09 4:46 Sam James
2023-10-04 17:42 Patrick McLean
2023-08-10 21:55 Patrick McLean
2023-08-02 12:39 Sam James
2023-07-23 16:12 Arthur Zamarin
2023-07-23 16:01 Arthur Zamarin
2023-07-19 15:23 Arthur Zamarin
2023-07-19 15:23 Arthur Zamarin
2023-07-19 15:13 Sam James
2023-07-19 15:13 Sam James
2023-07-19 15:11 Sam James
2023-07-19 15:11 Sam James
2023-07-19 14:41 Sam James
2023-06-25 19:28 Sam James
2023-06-25 19:17 Sam James
2023-05-11 20:03 Sam James
2023-05-11 20:03 Sam James
2023-05-11 20:03 Sam James
2023-05-06 21:29 David Seifert
2023-04-29 8:48 Sam James
2023-04-23 22:35 Sam James
2023-04-23 22:34 Sam James
2023-04-23 21:12 Jakov Smolić
2023-04-23 20:32 Sam James
2023-04-23 20:22 Sam James
2023-04-23 20:22 Sam James
2023-04-23 20:08 Sam James
2023-03-17 17:10 Patrick McLean
2023-03-15 3:52 Sam James
2023-02-16 10:01 Sam James
2023-02-16 3:30 Sam James
2023-02-15 19:21 Arthur Zamarin
2023-02-15 9:57 Sam James
2023-02-15 9:57 Sam James
2023-02-15 9:57 Sam James
2023-02-15 9:57 Sam James
2023-02-05 20:40 Patrick McLean
2023-02-03 6:28 Sam James
2023-02-02 19:55 Patrick McLean
2023-02-02 19:52 Patrick McLean
2023-01-25 19:22 Arthur Zamarin
2023-01-25 19:22 Arthur Zamarin
2023-01-22 17:50 Robin H. Johnson
2023-01-22 2:25 Sam James
2023-01-22 2:25 Sam James
2023-01-22 1:39 Sam James
2023-01-22 1:39 Sam James
2023-01-22 1:39 Sam James
2023-01-22 1:39 Sam James
2023-01-21 21:57 Robin H. Johnson
2023-01-05 18:44 Patrick McLean
2022-12-28 20:49 John Helmert III
2022-12-28 20:46 John Helmert III
2022-12-28 20:44 John Helmert III
2022-12-20 0:33 Patrick McLean
2022-12-19 18:32 Arthur Zamarin
2022-12-19 18:32 Arthur Zamarin
2022-12-19 18:32 Arthur Zamarin
2022-12-18 5:03 Sam James
2022-12-18 4:57 Sam James
2022-12-18 4:57 Sam James
2022-12-18 4:57 Sam James
2022-12-18 4:57 Sam James
2022-10-29 5:45 Arthur Zamarin
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:44 Sam James
2022-10-28 20:09 Sam James
2022-09-23 23:19 Sam James
2022-09-23 23:17 Sam James
2022-09-23 23:02 Sam James
2022-09-12 20:29 Sam James
2022-08-26 10:08 Sam James
2022-08-25 16:44 Arthur Zamarin
2022-05-20 18:09 Arthur Zamarin
2022-05-10 17:26 Mike Gilbert
2022-05-06 8:07 Jakov Smolić
2022-05-05 7:07 Jakov Smolić
2022-05-03 18:48 Arthur Zamarin
2022-05-03 18:48 Arthur Zamarin
2022-05-03 17:52 Arthur Zamarin
2022-05-01 12:20 Jakov Smolić
2022-04-29 21:24 Sam James
2022-04-02 3:30 Sam James
2022-03-17 1:09 Sam James
2022-03-16 22:25 Sam James
2022-03-16 19:07 Sam James
2022-01-06 9:07 David Seifert
2022-01-04 10:30 David Seifert
2021-12-25 21:14 Sam James
2021-12-25 10:21 Sam James
2021-12-25 9:51 Jakov Smolić
2021-12-25 8:24 Agostino Sarubbo
2021-12-24 20:01 Arthur Zamarin
2021-12-24 20:01 Arthur Zamarin
2021-12-24 17:32 Mike Gilbert
2021-12-24 16:16 Arthur Zamarin
2021-12-24 16:15 Arthur Zamarin
2021-12-24 16:09 Mike Gilbert
2021-12-24 10:57 Marc Schiffbauer
2021-12-19 1:10 John Helmert III
2021-12-16 0:09 Sam James
2021-12-03 6:38 Sam James
2021-12-03 4:26 Sam James
2021-10-06 1:22 Sam James
2021-09-09 16:56 Patrick McLean
2021-06-17 22:18 Thomas Deutschmann
2021-05-27 16:51 Sergei Trofimovich
2021-05-25 16:55 Sam James
2021-05-25 11:06 Sam James
2021-05-24 2:04 Sam James
2021-05-24 2:04 Sam James
2021-05-24 1:45 Sam James
2021-05-24 1:37 Sam James
2021-05-14 23:28 Patrick McLean
2021-05-13 13:55 David Seifert
2021-05-01 14:30 Mikle Kolyada
2021-04-22 8:09 Lars Wendler
2021-04-12 16:02 Sam James
2021-04-01 17:30 Agostino Sarubbo
2021-03-31 14:08 Agostino Sarubbo
2021-03-31 13:53 Agostino Sarubbo
2021-03-30 20:36 Sergei Trofimovich
2021-03-30 6:52 Sergei Trofimovich
2021-03-30 1:17 Thomas Deutschmann
2021-03-29 11:50 Agostino Sarubbo
2021-03-05 18:44 Patrick McLean
2021-02-06 13:49 Thomas Deutschmann
2021-01-25 13:17 Fabian Groffen
2021-01-23 10:51 Mikle Kolyada
2021-01-15 6:31 Mike Frysinger
2021-01-14 20:09 Sergei Trofimovich
2021-01-06 15:06 Fabian Groffen
2020-12-27 17:57 Fabian Groffen
2020-12-27 12:51 Sergei Trofimovich
2020-12-24 22:06 Sergei Trofimovich
2020-12-24 10:03 Agostino Sarubbo
2020-12-22 21:04 Sam James
2020-12-22 21:03 Sam James
2020-12-21 23:55 Sam James
2020-12-21 17:48 Thomas Deutschmann
2020-12-09 12:10 Fabian Groffen
2020-11-05 18:38 Mike Gilbert
2020-10-06 8:35 Fabian Groffen
2020-09-27 11:47 Fabian Groffen
2020-08-17 14:32 Thomas Deutschmann
2020-07-27 21:19 Patrick McLean
2020-07-24 23:55 Patrick McLean
2020-07-24 21:12 Patrick McLean
2020-07-24 21:12 Patrick McLean
2020-04-26 14:34 Mike Gilbert
2020-04-09 1:02 Patrick McLean
2020-04-03 21:35 Mart Raudsepp
2020-03-17 18:00 Sergei Trofimovich
2020-03-16 12:41 Benda XU
2020-03-15 13:05 Mikle Kolyada
2020-03-10 12:36 Michael Haubenwallner
2020-03-07 10:09 Mikle Kolyada
2020-03-02 12:34 Agostino Sarubbo
2020-03-02 12:28 Agostino Sarubbo
2020-03-02 11:34 Sergei Trofimovich
2020-03-02 11:22 Sergei Trofimovich
2020-03-02 11:04 Sergei Trofimovich
2020-02-28 20:40 Sergei Trofimovich
2020-02-28 17:50 Agostino Sarubbo
2020-02-27 9:49 Agostino Sarubbo
2020-02-16 19:05 Patrick McLean
2020-02-16 18:30 Patrick McLean
2020-02-16 6:47 Patrick McLean
2020-02-16 6:32 Michał Górny
2020-02-16 5:57 Patrick McLean
2020-02-08 16:53 David Seifert
2020-02-07 3:41 Patrick McLean
2020-02-06 21:45 Mike Gilbert
2020-02-05 19:36 Patrick McLean
2020-02-05 3:02 Patrick McLean
2020-02-05 3:02 Patrick McLean
2020-02-05 1:55 Patrick McLean
2020-02-05 1:55 Patrick McLean
2019-10-17 13:40 Alexis Ballier
2019-10-12 19:18 Mikle Kolyada
2019-10-11 23:53 Patrick McLean
2019-10-09 20:39 Thomas Deutschmann
2019-10-09 20:39 Thomas Deutschmann
2019-10-08 16:06 Thomas Deutschmann
2019-10-08 16:06 Thomas Deutschmann
2019-09-25 15:43 Thomas Deutschmann
2019-08-14 18:07 Sergei Trofimovich
2019-08-14 7:34 Agostino Sarubbo
2019-08-13 13:51 Agostino Sarubbo
2019-08-13 11:49 Agostino Sarubbo
2019-08-13 11:40 Agostino Sarubbo
2019-08-13 10:59 Agostino Sarubbo
2019-08-13 8:21 Agostino Sarubbo
2019-08-12 9:11 Agostino Sarubbo
2019-08-11 21:30 Thomas Deutschmann
2019-08-11 21:27 Aaron Bauman
2019-05-04 17:00 Anthony G. Basile
2019-05-04 16:01 Mikle Kolyada
2019-04-19 12:52 Thomas Deutschmann
2019-03-19 18:20 Patrick McLean
2019-03-15 23:21 Mikle Kolyada
2019-03-15 23:21 Mikle Kolyada
2019-03-15 23:21 Mikle Kolyada
2019-03-14 8:31 Sergei Trofimovich
2019-03-10 21:38 Matt Turner
2019-03-10 21:38 Matt Turner
2019-03-10 15:36 Mikle Kolyada
2019-03-10 14:35 Mikle Kolyada
2019-03-08 23:01 Thomas Deutschmann
2019-03-08 23:01 Thomas Deutschmann
2019-03-08 19:52 Sergei Trofimovich
2019-03-07 22:02 Sergei Trofimovich
2019-03-07 21:50 Thomas Deutschmann
2019-03-07 15:04 Thomas Deutschmann
2019-03-06 23:56 Thomas Deutschmann
2019-03-06 19:45 Mart Raudsepp
2019-03-06 14:47 Mikle Kolyada
2019-03-03 2:46 Thomas Deutschmann
2019-01-16 1:34 Patrick McLean
2018-12-10 18:45 Patrick McLean
2018-10-06 22:31 Thomas Deutschmann
2018-10-06 17:42 Mikle Kolyada
2018-09-14 8:52 Benda XU
2018-09-13 11:19 Lars Wendler
2018-09-13 3:48 Patrick McLean
2018-08-24 12:23 Thomas Deutschmann
2018-08-22 20:21 Thomas Deutschmann
2018-08-22 17:52 Mart Raudsepp
2018-08-22 15:00 Thomas Deutschmann
2018-08-22 15:00 Thomas Deutschmann
2018-08-16 15:03 Thomas Deutschmann
2018-08-07 21:38 Thomas Deutschmann
2018-08-07 21:38 Thomas Deutschmann
2018-07-28 19:17 Thomas Deutschmann
2018-07-15 21:51 Mikle Kolyada
2018-07-02 22:35 Thomas Deutschmann
2018-06-30 20:59 Mikle Kolyada
2018-06-28 20:00 Anthony G. Basile
2018-06-26 20:33 Jeroen Roovers
2018-06-26 15:55 Mikle Kolyada
2018-06-26 8:22 Mike Frysinger
2018-06-26 8:22 Mike Frysinger
2018-06-25 20:43 Tobias Klausmann
2018-06-21 12:10 Jeroen Roovers
2018-06-21 2:36 Mike Frysinger
2018-06-20 0:31 Anthony G. Basile
2018-06-18 23:33 Thomas Deutschmann
2018-06-13 15:25 Thomas Deutschmann
2018-06-12 20:48 Sergei Trofimovich
2018-06-12 15:17 Mikle Kolyada
2018-06-12 11:36 Thomas Deutschmann
2018-06-12 9:32 Sergei Trofimovich
2018-06-11 22:47 Thomas Deutschmann
2018-06-05 15:42 Thomas Deutschmann
2018-05-08 13:35 Thomas Deutschmann
2018-04-22 17:13 Thomas Deutschmann
2018-04-11 23:54 Thomas Deutschmann
2018-03-12 15:51 Lars Wendler
2018-02-12 21:13 Patrick McLean
2018-01-24 20:50 Lars Wendler
2018-01-23 23:58 Patrick McLean
2018-01-22 9:22 Lars Wendler
2018-01-22 9:22 Lars Wendler
2018-01-22 2:22 Zac Medico
2018-01-12 13:31 Thomas Deutschmann
2018-01-10 8:35 Mike Frysinger
2017-12-24 9:46 Mart Raudsepp
2017-12-18 19:01 Thomas Deutschmann
2017-12-18 19:01 Thomas Deutschmann
2017-11-19 19:57 Sergei Trofimovich
2017-11-19 19:47 Markus Meier
2017-11-19 18:48 Sergei Trofimovich
2017-11-18 12:42 Sergei Trofimovich
2017-11-18 10:32 Sergei Trofimovich
2017-11-17 11:18 Tobias Klausmann
2017-11-16 19:43 Sergei Trofimovich
2017-11-16 1:36 Thomas Deutschmann
2017-11-15 21:01 Agostino Sarubbo
2017-11-07 18:42 Patrick McLean
2017-11-07 13:34 Lars Wendler
2017-10-11 7:57 Lars Wendler
2017-10-10 13:26 Lars Wendler
2017-09-26 22:21 Sergei Trofimovich
2017-09-06 21:00 Michał Górny
2017-06-27 1:26 Patrick McLean
2017-06-13 18:24 Markus Meier
2017-06-13 12:31 Agostino Sarubbo
2017-06-10 15:10 Agostino Sarubbo
2017-06-10 13:45 Agostino Sarubbo
2017-06-09 12:41 Agostino Sarubbo
2017-02-10 1:49 Mike Frysinger
2017-01-18 8:55 Mike Frysinger
2017-01-09 21:09 Lars Wendler
2017-01-07 21:35 Robin H. Johnson
2016-12-26 18:47 Mike Frysinger
2016-12-24 8:05 Mike Frysinger
2016-12-20 22:21 Mike Frysinger
2016-12-20 8:28 Fabian Groffen
2016-11-28 9:38 Agostino Sarubbo
2016-11-28 9:35 Agostino Sarubbo
2016-11-27 11:40 Agostino Sarubbo
2016-11-27 11:37 Agostino Sarubbo
2016-11-17 8:03 Jeroen Roovers
2016-11-14 16:48 Tobias Klausmann
2016-11-13 13:09 Agostino Sarubbo
2016-11-13 13:07 Agostino Sarubbo
2016-11-12 16:55 Mike Frysinger
2016-09-29 13:28 Agostino Sarubbo
2016-09-29 13:14 Agostino Sarubbo
2016-09-29 12:35 Agostino Sarubbo
2016-09-29 9:41 Agostino Sarubbo
2016-09-29 9:09 Tobias Klausmann
2016-09-29 3:36 Jeroen Roovers
2016-09-28 17:28 Fabian Groffen
2016-09-28 12:32 Agostino Sarubbo
2016-09-28 12:32 Agostino Sarubbo
2016-09-14 18:51 Patrick McLean
2016-08-27 18:34 Patrick McLean
2016-08-08 8:39 Andrew Savchenko
2016-08-02 19:10 Lars Wendler
2016-08-02 14:57 Mike Frysinger
2016-06-18 19:14 Jorge Manuel B. S. Vicetto
2016-04-18 9:43 Patrice Clement
2016-03-18 21:27 Mike Frysinger
2016-03-18 6:12 Markus Meier
2016-03-16 11:51 Agostino Sarubbo
2016-03-15 20:50 Tobias Klausmann
2016-03-15 16:39 Agostino Sarubbo
2016-03-12 9:12 Jeroen Roovers
2016-03-11 13:29 Richard Freeman
2016-03-11 5:52 Mike Frysinger
2016-03-04 18:58 Mike Gilbert
2016-01-17 9:01 Mike Frysinger
2016-01-15 14:10 Mike Frysinger
2016-01-15 9:15 Agostino Sarubbo
2016-01-14 20:59 Mike Frysinger
2016-01-14 20:40 Richard Freeman
2015-11-15 18:26 Matt Turner
2015-11-10 4:57 Mike Frysinger
2015-11-10 4:57 Mike Frysinger
2015-11-10 4:57 Mike Frysinger
2015-11-06 4:21 Jeroen Roovers
2015-11-05 20:57 Markus Meier
2015-11-05 10:58 Agostino Sarubbo
2015-11-04 14:26 Agostino Sarubbo
2015-11-03 17:13 Agostino Sarubbo
2015-11-03 16:11 Mikle Kolyada
2015-10-31 10:13 Michał Górny
2015-10-29 17:01 Mike Frysinger
2015-10-29 6:14 Mike Frysinger
2015-09-26 8:07 Mike Frysinger
2015-09-20 17:35 Julian Ospald
2015-09-14 20:26 Mike Frysinger
2015-09-13 2:41 Richard Farina
2015-09-12 23:26 Mike Frysinger
2015-09-12 22:02 Richard Farina
2015-08-21 10:57 Lars Wendler
2015-08-13 2:57 Mike Frysinger
2015-08-12 7:21 Mike Frysinger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox