summaryrefslogtreecommitdiff
path: root/net-misc
diff options
context:
space:
mode:
Diffstat (limited to 'net-misc')
-rw-r--r--net-misc/Manifest.gzbin54370 -> 54365 bytes
-rw-r--r--net-misc/openssh-contrib/Manifest2
-rw-r--r--net-misc/openssh-contrib/files/openssh-9.7_p1-config-tweaks.patch27
-rw-r--r--net-misc/openssh-contrib/openssh-contrib-9.7_p1-r2.ebuild524
-rw-r--r--net-misc/openssh/Manifest2
-rw-r--r--net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch27
-rw-r--r--net-misc/openssh/openssh-9.7_p1-r4.ebuild398
7 files changed, 980 insertions, 0 deletions
diff --git a/net-misc/Manifest.gz b/net-misc/Manifest.gz
index 3551dd08e7b5..a4d645e2030a 100644
--- a/net-misc/Manifest.gz
+++ b/net-misc/Manifest.gz
Binary files differ
diff --git a/net-misc/openssh-contrib/Manifest b/net-misc/openssh-contrib/Manifest
index c717e01ee9bf..816e8b6d66b3 100644
--- a/net-misc/openssh-contrib/Manifest
+++ b/net-misc/openssh-contrib/Manifest
@@ -8,6 +8,7 @@ AUX openssh-9.0_p1-X509-uninitialized-delay.patch 321 BLAKE2B 19bff0fc7ecdc6350f
AUX openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch 514 BLAKE2B d0dadfc57736cd4d2b04e46f5c0f6d5a1db1cfc7ee70d32afaa0f65269b82e66a72c46d33c9cbf7237f541a0485b25669cd2f4b34393e3a3ef0c9b4334092fe5 SHA512 f8badde54501340bde275951bc1cf653919bec02c760bf771308f10697b9ad2a483e30ae74ad124a737341f5c64657ab193a4d7fdf2baf24029b9447099da04b
AUX openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch 1647 BLAKE2B 9d55e9060e6eae041176bef27acc58d6026c8fb68c65c71c11c1acbe4e6840a63fba3dbc113a8981da66901717c1f3b4f2211a2cb322d3d4e5eba8c86f4e269c SHA512 d8fc604795d8bb4228ccbfe5714d5503bb1e0d63818d2fac65d533530d01fe4ce4fac0743b8b415f646322fec859b699fa7365beba8a42bd880d737b7c6bd7df
AUX openssh-9.6_p1-hpn-version.patch 552 BLAKE2B 4fccbb5239b9e856b01c796216ef73aaeeee0676cafc9274d225047b0196d26601073d06c8bb443361cdf89229fb052b6760273facec3e505d2bf80135f15235 SHA512 46dc0cf3bf94237d582f1c363723f22e0bbf6c435f649776766690d2595f07012e2e65a3e73f1c18dbe564885e690ce1449c3e6bf63778fe4220b4c897928f9c
+AUX openssh-9.7_p1-config-tweaks.patch 1032 BLAKE2B 52f20d412722b00a452b92c8b45a8884b3e8d76c05be45431de3c7a0401dcbbf4587b65703e28a389ee05066af73cb6c1845626342b059fac463dc2ea38d0535 SHA512 bfc39aa573dd3934bae2a496a8a730f99dd7d6217c4d6e146ca4c401151f5e803f704719f29213548c67db015ba9f4cae749dd7ee5bc3b8cee0395892abae01f
AUX sshd-r1.confd 774 BLAKE2B df3f3f28cb4d35b49851399b52408c42e242ae3168ff3fc79add211903567da370cfe86a267932ca9cf13c3afbc38a8f1b53e753a31670ee61bf8ba8747832f8 SHA512 3a69752592126024319a95f1c1747af508fd639c86eca472106c5d6c23d5eeaa441ca74740d4b1aafaa0db759d38879e3c1cee742b08d6166ebc58cddac1e2fe
AUX sshd-r1.initd 2675 BLAKE2B 47e87cec2d15b90aae362ce0c8e8ba08dada9ebc244e28be1fe67d24deb00675d3d9b8fef40def8a9224a3e2d15ab717574a3d837e099133c1cf013079588b55 SHA512 257d6437162b76c4a3a648ecc5d4739ca7eaa60b192fde91422c6c05d0de6adfa9635adc24d57dc3da6beb92b1b354ffe8fddad3db453efb610195d5509a4e27
AUX sshd.pam_include.2 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c
@@ -29,4 +30,5 @@ DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a80
DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf
EBUILD openssh-contrib-9.6_p1.ebuild 17830 BLAKE2B a99f2b5b8a6ad4557c0b26bd173471dd5091973b3c7d91e2817cfb93e3f4aed48833fbfda5cd83e9d8cd4231d7785c381ee091e10c4f9c4bcb775fcc53fd6a89 SHA512 729cf8d95395836998ac0433c7c43718dd764cb3af8767a1bf5fb5dbb8c119cacb9bfb2db041cfc5e25f12fd389c3dbfaf355b2faadd373387fdabf25ca714be
EBUILD openssh-contrib-9.7_p1-r1.ebuild 18480 BLAKE2B bec8883ea8439c99050c3552d7761465f283fc149e6cd39acce517f10c8f616b86f2b3a8dbf96c0c0ae4a97a493df493c1aa45584c7cc603e52c6112f65c19d9 SHA512 b2fb79bd1732936f1fce7c2ee80fa6de309c4e1050aa4985ade5274a04d4495dca2bb489edd3ae7584eae57bfd7ee1ca764c2ca9fad2d7a7e347fed69c74dbb8
+EBUILD openssh-contrib-9.7_p1-r2.ebuild 18477 BLAKE2B 8044b6a1ba1bc632fdca9868c91b418ec34fce38fe5f14af3c45736184cea5923c7eb3bf4ae1f220eff8cec3bff6599730b502c4472604a6b9357bfbb7c7ffd5 SHA512 0c87616a97126a670a4185ff97236841308d85766e3fe4179162b0e99b1c6e4b9d19fdae269522f0914d5c7c3d7a7c95cbfcada86f093e590e705ee9a5db91f2
MISC metadata.xml 2975 BLAKE2B 068d52ba2e5de0b696e7fe995e4c2a041206a59258f24704ca3a72fe1d85323c2aad7899f055b48a4045d6303491822c59f2b86b85fc428a26f8259ea583796a SHA512 83fef701188c00af53382b5099fc2ebf83c903c3edefc3d2cf6deb0a667c0d0d9531c18728eef9b5b703903d31fbdb55a68e5b76890ea090bc1d79fef3ae6b89
diff --git a/net-misc/openssh-contrib/files/openssh-9.7_p1-config-tweaks.patch b/net-misc/openssh-contrib/files/openssh-9.7_p1-config-tweaks.patch
new file mode 100644
index 000000000000..229f7484cff5
--- /dev/null
+++ b/net-misc/openssh-contrib/files/openssh-9.7_p1-config-tweaks.patch
@@ -0,0 +1,27 @@
+diff -Naur a/ssh_config b/ssh_config
+--- a/ssh_config 2024-03-11 05:20:49.000000000 +0000
++++ b/ssh_config 2024-06-10 16:30:15.863023773 +0100
+@@ -13,6 +13,9 @@
+ # Thus, host-specific definitions should be at the beginning of the
+ # configuration file, and defaults at the end.
+
++# Make sure that all Host and Match options are below this Include!
++Include "/etc/ssh/ssh_config.d/*.conf"
++
+ # Site-wide defaults for some commonly used options. For a comprehensive
+ # list of available options, their meanings and defaults, please see the
+ # ssh_config(5) man page.
+diff -Naur a/sshd_config b/sshd_config
+--- a/sshd_config 2024-06-10 16:19:01.530491925 +0100
++++ b/sshd_config 2024-06-10 16:32:49.766386759 +0100
+@@ -105,8 +105,8 @@
+ # no default banner path
+ #Banner none
+
+-# override default of no subsystems
+-Subsystem sftp /usr/libexec/sftp-server
++# Make sure that all Match options are below this Include!
++Include "/etc/ssh/sshd_config.d/*.conf"
+
+ # Example of overriding settings on a per-user basis
+ #Match User anoncvs
diff --git a/net-misc/openssh-contrib/openssh-contrib-9.7_p1-r2.ebuild b/net-misc/openssh-contrib/openssh-contrib-9.7_p1-r2.ebuild
new file mode 100644
index 000000000000..0f9dacf37bf1
--- /dev/null
+++ b/net-misc/openssh-contrib/openssh-contrib-9.7_p1-r2.ebuild
@@ -0,0 +1,524 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit user-info optfeature flag-o-matic autotools pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+MY_P=${P/-contrib/}
+PARCH=${MY_P/_}
+
+# PV to USE for HPN patches
+#HPN_PV="${PV^^}"
+HPN_PV="8.5_P1"
+
+HPN_VER="15.2"
+HPN_PATCHES=(
+ openssh-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ openssh-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff
+)
+HPN_GLUE_PATCH="openssh-9.6_p1-hpn-${HPN_VER}-glue.patch"
+HPN_PATCH_DIR="HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}"
+
+X509_VER="15.0"
+X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_PATCH="${X509_PATCH/p2/p1}"
+X509_GLUE_PATCH="openssh-${PV}-X509-glue-${X509_VER}.patch"
+#X509_HPN_GLUE_PATCH="${MY_P}-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch"
+X509_HPN_GLUE_PATCH="${MY_P}-hpn-${HPN_VER}-X509-${X509_VER%.1}-glue.patch"
+
+DESCRIPTION="Port of OpenBSD's free SSH release with HPN/X509 patches"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ ${HPN_VER:+hpn? (
+ $(printf "https://downloads.sourceforge.net/project/hpnssh/Patches/${HPN_PATCH_DIR}/%s\n" "${HPN_PATCHES[@]}")
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz
+ )}
+ ${X509_VER:+X509? (
+ https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH}
+ https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz
+ ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )}
+ )}
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X X509 xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ hpn? ( ssl )
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( ssl !xmss !security-key )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+"
+BDEPEND="
+ dev-build/autoconf
+ virtual/pkgconfig
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
+ "${FILESDIR}/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+ "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch"
+)
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ local missing=()
+ check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); }
+ check_feature hpn HPN_VER
+ check_feature X509 X509_PATCH
+ if [[ ${#missing[@]} -ne 0 ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${missing[*]}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "Missing requested third party patch."
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_unpack() {
+ default
+
+ # We don't have signatures for HPN, X509, so we have to write this ourselves
+ use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc}
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ eapply -- "${PATCHES[@]}"
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" &>/dev/null || die
+ eapply "${WORKDIR}/${X509_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}/openssh-9.0_p1-X509-uninitialized-delay.patch"
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/openssh-${PV}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}" || die
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die
+ pushd "${hpn_patchdir}" &>/dev/null || die
+ eapply "${WORKDIR}/${HPN_GLUE_PATCH}"
+ use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}"
+ popd &>/dev/null || die
+
+ eapply "${hpn_patchdir}"
+
+ use X509 || eapply "${FILESDIR}/openssh-9.6_p1-hpn-version.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ # Before re-enabling, check https://bugs.gentoo.org/354113#c6
+ # and be sure to have tested it.
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ eapply_user #473004
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ # optional at runtime; guarantee a known path
+ --with-xauth="${EPREFIX}"/usr/bin/xauth
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(usex X509 '' "$(use_with security-key security-key-builtin)")
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+create_config_dropins() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
+ # override default of no subsystems
+ Subsystem sftp ${EPREFIX}/usr/libexec/sftp-server
+ EOF
+
+ if use pam ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_compile() {
+ default
+ create_config_dropins
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 REGRESS_INTEROP_PUTTY=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+
+ # Install dropins with explicit mode, bug 906638, 915840
+ diropts -m0755
+ insopts -m0644
+ insinto /etc/ssh
+ doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+ diropts -m0700
+ insopts -m0600
+ doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ # bug #139235
+ optfeature "x11 forwarding" x11-apps/xauth
+
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 626e2ad43391..90b2484df1ae 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -2,6 +2,7 @@ AUX openssh-9.3_p1-disable-conch-interop-tests.patch 554 BLAKE2B f5f45c000ec26c1
AUX openssh-9.3_p1-fix-putty-tests.patch 1691 BLAKE2B 8a92766bd2db65a4dab1254a356ecee65203e11179a499b40dfde623c642a0d6aa205490faabd50abfba5bbb4a9d3e1fa9427c42fd82883df1401b7a871979ea SHA512 4b27ece068d233e128dde2571a93ce6ff695ee975e5dcbef84b8c0923e84903494f980bbe38129cd9f83bb34e7a7940f8686a5b8f85d20e3e11c53b6d933196d
AUX openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch 1647 BLAKE2B 9d55e9060e6eae041176bef27acc58d6026c8fb68c65c71c11c1acbe4e6840a63fba3dbc113a8981da66901717c1f3b4f2211a2cb322d3d4e5eba8c86f4e269c SHA512 d8fc604795d8bb4228ccbfe5714d5503bb1e0d63818d2fac65d533530d01fe4ce4fac0743b8b415f646322fec859b699fa7365beba8a42bd880d737b7c6bd7df
AUX openssh-9.6_p1-fix-xmss-c99.patch 696 BLAKE2B db9ad0e9340ee241d28310b438e90a909bea551fe136f2e6855f00067e63f3558a773005359454b14315dd46ac508397ad8f081b4aaae9f7ccf0bbc30b263d85 SHA512 1e7c2b7aec655ba312a9c0edb9db5f79323aace53f5531d69d60672e1f5bb329543558d8abea5e7a21cea1c438c5ae228f6e2a0fc39a78524b6f7f005b8011e3
+AUX openssh-9.7_p1-config-tweaks.patch 1032 BLAKE2B 52f20d412722b00a452b92c8b45a8884b3e8d76c05be45431de3c7a0401dcbbf4587b65703e28a389ee05066af73cb6c1845626342b059fac463dc2ea38d0535 SHA512 bfc39aa573dd3934bae2a496a8a730f99dd7d6217c4d6e146ca4c401151f5e803f704719f29213548c67db015ba9f4cae749dd7ee5bc3b8cee0395892abae01f
AUX sshd-r1.confd 774 BLAKE2B df3f3f28cb4d35b49851399b52408c42e242ae3168ff3fc79add211903567da370cfe86a267932ca9cf13c3afbc38a8f1b53e753a31670ee61bf8ba8747832f8 SHA512 3a69752592126024319a95f1c1747af508fd639c86eca472106c5d6c23d5eeaa441ca74740d4b1aafaa0db759d38879e3c1cee742b08d6166ebc58cddac1e2fe
AUX sshd-r1.initd 2675 BLAKE2B 47e87cec2d15b90aae362ce0c8e8ba08dada9ebc244e28be1fe67d24deb00675d3d9b8fef40def8a9224a3e2d15ab717574a3d837e099133c1cf013079588b55 SHA512 257d6437162b76c4a3a648ecc5d4739ca7eaa60b192fde91422c6c05d0de6adfa9635adc24d57dc3da6beb92b1b354ffe8fddad3db453efb610195d5509a4e27
AUX sshd.pam_include.2 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c
@@ -16,4 +17,5 @@ EBUILD openssh-9.6_p1-r3.ebuild 13807 BLAKE2B 61ce712b91455496975c2f5daec0d50fc3
EBUILD openssh-9.6_p1-r4.ebuild 13862 BLAKE2B 1b30cb07de4207d7589c1912ce723a2b72b0afa376db008abe25fffad2ddf8cce95f6b4a40cbfaf5a6302770503bb402f4fc535078a153bd0e97d70f77d5ac0f SHA512 bad36e36ac0f200b97f5bdca41040f12c89b677146dec6b5f9637f7a5b3d91d19afb42ef965cdc2c105866b56fda66b27c8f0fc2b3d5d3beded7462ad2c3ce67
EBUILD openssh-9.7_p1-r2.ebuild 13983 BLAKE2B 7d6127c1c0660c549be4e2166e5322ac6a7b86f9e141571a4c14d152aec06b2dbc0837152f8e64c127a4604a4ef0fc0ec2efdf87ea1285cfd717eaccdfae102d SHA512 9f5d8ddc3d15043dc1de5aaa87cccea8d4151265582f52137675193210d8796f5b8baed53c8d2ee883a02a8009dc9e42b7024171d69637173b6011ee277fc81f
EBUILD openssh-9.7_p1-r3.ebuild 14030 BLAKE2B 0763b2e35a159bee5d8548ca1e0a553971db58108d56dc58a4b33e6072fa06b9f516909c9220a1e0740c4a4dd636e2ec265f5a19a32088eb63477feff38f2b66 SHA512 4e2d56e8320eab4dae7caa0bef36668ba91f5377871ef6bfbb884ab14794fd7ca2b348681d703566ad2dd6a357c1f842fbe253948ae59cbf605e3bd538757a2c
+EBUILD openssh-9.7_p1-r4.ebuild 14025 BLAKE2B b310875c402e2519bed2ddcf252538ee229590f5d3114f9529633fa27b29fce6a782c78b5e5155c962c3c9a15d8563d5bd108c6a50f8637cc0d35f775e4f14af SHA512 90f22e5aac80903dacb7d0c74efa23ede19e60dc084af47de65d67293076ada2fe3d7a2309ad86e745c244fb6cd1aa4186358a54e7f3832d32538f27f6ccbd94
MISC metadata.xml 1788 BLAKE2B d04d3030f70f3615522672fa56e684acaa67ddce8d16cce86ba8911fb8fc11ed152be012ecf560427d271868c4841a7422aaa644305947302d3ebab62bdb577d SHA512 bd328e3a33ce04b989149333db5f774f1b52540f12ef83b08b7fcf136ae2a3a9c83bef42c28991d3536249098ca0b9ffd21e583d93599580510d8619e9fd01ca
diff --git a/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch b/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch
new file mode 100644
index 000000000000..229f7484cff5
--- /dev/null
+++ b/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch
@@ -0,0 +1,27 @@
+diff -Naur a/ssh_config b/ssh_config
+--- a/ssh_config 2024-03-11 05:20:49.000000000 +0000
++++ b/ssh_config 2024-06-10 16:30:15.863023773 +0100
+@@ -13,6 +13,9 @@
+ # Thus, host-specific definitions should be at the beginning of the
+ # configuration file, and defaults at the end.
+
++# Make sure that all Host and Match options are below this Include!
++Include "/etc/ssh/ssh_config.d/*.conf"
++
+ # Site-wide defaults for some commonly used options. For a comprehensive
+ # list of available options, their meanings and defaults, please see the
+ # ssh_config(5) man page.
+diff -Naur a/sshd_config b/sshd_config
+--- a/sshd_config 2024-06-10 16:19:01.530491925 +0100
++++ b/sshd_config 2024-06-10 16:32:49.766386759 +0100
+@@ -105,8 +105,8 @@
+ # no default banner path
+ #Banner none
+
+-# override default of no subsystems
+-Subsystem sftp /usr/libexec/sftp-server
++# Make sure that all Match options are below this Include!
++Include "/etc/ssh/sshd_config.d/*.conf"
+
+ # Example of overriding settings on a per-user basis
+ #Match User anoncvs
diff --git a/net-misc/openssh/openssh-9.7_p1-r4.ebuild b/net-misc/openssh/openssh-9.7_p1-r4.ebuild
new file mode 100644
index 000000000000..6bed5f250d22
--- /dev/null
+++ b/net-misc/openssh/openssh-9.7_p1-r4.ebuild
@@ -0,0 +1,398 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+ mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+ ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ xmss? ( ssl )
+ test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ net-libs/ldns[ecdsa(+),ssl(+)]
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+ virtual/libcrypt:=[static-libs(+)]
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+ acct-group/sshd
+ acct-user/sshd
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( sys-libs/pam )
+ kerberos? ( virtual/krb5 )
+"
+DEPEND="
+ ${RDEPEND}
+ virtual/os-headers
+ kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+ static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+ ${RDEPEND}
+ !net-misc/openssh-contrib
+ pam? ( >=sys-auth/pambase-20081028 )
+ !prefix? ( sys-apps/shadow )
+"
+BDEPEND="
+ dev-build/autoconf
+ virtual/pkgconfig
+ verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+ "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
+ "${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
+)
+
+pkg_pretend() {
+ local i enabled_eol_flags disabled_eol_flags
+ for i in hpn sctp X509; do
+ if has_version "net-misc/openssh[${i}]"; then
+ enabled_eol_flags+="${i},"
+ disabled_eol_flags+="-${i},"
+ fi
+ done
+
+ if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+ # Skip for binary packages entirely because of environment saving, bug #907892
+ [[ ${MERGE_TYPE} == binary ]] && return
+
+ ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+ ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+ ewarn "since these USE flags required third-party patches that often trigger bugs"
+ ewarn "and are of questionable provenance."
+ ewarn
+ ewarn "If you must continue relying on this functionality, switch to"
+ ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+ ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+ ewarn
+ ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+ ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+ ewarn "variant, when re-emerging you will have to set"
+ ewarn
+ ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+ die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+ sed -e '/\t\tpercent \\/ d' \
+ -i regress/Makefile || die
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+ use xmss && append-cflags -DWITH_XMSS
+
+ if [[ ${CHOST} == *-solaris* ]] ; then
+ # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+ # doesn't check for this, so force the replacement to be put in
+ # place
+ append-cppflags -DBROKEN_GLOB
+ fi
+
+ # use replacement, RPF_ECHO_ON doesn't exist here
+ [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX}"/etc/ssh
+ --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX}"/var/empty
+ --with-privsep-user=sshd
+ # optional at runtime; guarantee a known path
+ --with-xauth="${EPREFIX}"/usr/bin/xauth
+
+ # --with-hardening adds the following in addition to flags we
+ # already set in our toolchain:
+ # * -ftrapv (which is broken with GCC anyway),
+ # * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+ # the world to not have)
+ # * -fzero-call-used-regs=used (history of miscompilations with
+ # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+ # gcc PR104820, gcc PR104817, gcc PR110934)).
+ #
+ # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+ # so we cannot just disable -fzero-call-used-regs=used.
+ #
+ # Therefore, just pass --without-hardening, given it doesn't negate
+ # our already hardened toolchain defaults, and avoids adding flags
+ # which are known-broken in both Clang and GCC and haven't been
+ # proven reliable.
+ --without-hardening
+
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+ $(use_with ldns)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with security-key security-key-builtin)
+ $(use_with ssl openssl)
+ $(use_with ssl ssl-engine)
+ )
+
+ if use elibc_musl; then
+ # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+ myconf+=( --disable-utmp --disable-wtmp )
+ fi
+
+ # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
+ # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
+ tc-is-clang && myconf+=( --without-hardening )
+
+ econf "${myconf[@]}"
+}
+
+create_config_dropins() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+ # Send locale environment variables (bug #367017)
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM (bug #658540)
+ SendEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+ RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
+ # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+ ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+ # Allow client to pass locale environment variables (bug #367017)
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM (bug #658540)
+ AcceptEnv COLORTERM
+ EOF
+
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
+ # override default of no subsystems
+ Subsystem sftp ${EPREFIX}/usr/libexec/sftp-server
+ EOF
+
+ if use pam ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+ UsePAM yes
+ # This interferes with PAM.
+ PasswordAuthentication no
+ # PAM can do its own handling of MOTD.
+ PrintMotd no
+ PrintLastLog no
+ EOF
+ fi
+
+ if use livecd ; then
+ cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+ # Allow root login with password on livecds.
+ PermitRootLogin Yes
+ EOF
+ fi
+}
+
+src_compile() {
+ default
+ create_config_dropins
+}
+
+src_test() {
+ local tests=( compat-tests )
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ ewarn "user, so we will run a subset only."
+ tests+=( interop-tests )
+ else
+ tests+=( tests )
+ fi
+
+ local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+ mkdir -p "${HOME}"/.ssh || die
+ emake -j1 "${tests[@]}" </dev/null
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ if use pam; then
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+ fi
+
+ doman contrib/ssh-copy-id.1
+ dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+ rmdir "${ED}"/var/empty || die
+
+ systemd_dounit "${FILESDIR}"/sshd.socket
+ systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
+ systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+
+ # Install dropins with explicit mode, bug 906638, 915840
+ diropts -m0755
+ insopts -m0644
+ insinto /etc/ssh
+ doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+ doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
+ diropts -m0700
+ insopts -m0600
+ doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
+}
+
+pkg_preinst() {
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+ show_ssl_warning=1
+ fi
+}
+
+pkg_postinst() {
+ # bug #139235
+ optfeature "x11 forwarding" x11-apps/xauth
+
+ local old_ver
+ for old_ver in ${REPLACING_VERSIONS}; do
+ if ver_test "${old_ver}" -lt "5.8_p1"; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if ver_test "${old_ver}" -lt "7.0_p1"; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if ver_test "${old_ver}" -lt "7.6_p1"; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if ver_test "${old_ver}" -lt "7.7_p1"; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ver_test "${old_ver}" -lt "8.2_p1"; then
+ ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+ ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+ ewarn "connection is generally safe."
+ fi
+ if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
+ ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+ ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+ ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+ ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+ ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+ ewarn "set 'Restart=no' in your sshd unit file."
+ fi
+ done
+
+ if [[ -n ${show_ssl_warning} ]]; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-18 20:46:46 +0000