summaryrefslogtreecommitdiff
path: root/net-misc
diff options
context:
space:
mode:
Diffstat (limited to 'net-misc')
-rw-r--r--net-misc/Manifest.gzbin54747 -> 54751 bytes
-rw-r--r--net-misc/downloader-cli/Manifest4
-rw-r--r--net-misc/downloader-cli/downloader-cli-0.3.3.ebuild21
-rw-r--r--net-misc/downloader-cli/downloader-cli-0.3.4.ebuild10
-rw-r--r--net-misc/freerdp/Manifest2
-rw-r--r--net-misc/freerdp/freerdp-3.0.0-r1.ebuild2
-rw-r--r--net-misc/gsasl/Manifest2
-rw-r--r--net-misc/gsasl/gsasl-2.2.1.ebuild101
-rw-r--r--net-misc/openssh/Manifest8
-rw-r--r--net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch345
-rw-r--r--net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch21
-rw-r--r--net-misc/openssh/openssh-9.4_p1-r1.ebuild380
-rw-r--r--net-misc/openssh/openssh-9.5_p1-r2.ebuild378
13 files changed, 111 insertions, 1163 deletions
diff --git a/net-misc/Manifest.gz b/net-misc/Manifest.gz
index 9c0d2b5ad23a..8da69875f104 100644
--- a/net-misc/Manifest.gz
+++ b/net-misc/Manifest.gz
Binary files differ
diff --git a/net-misc/downloader-cli/Manifest b/net-misc/downloader-cli/Manifest
index 2c2a9ecbf249..2734915bfdb2 100644
--- a/net-misc/downloader-cli/Manifest
+++ b/net-misc/downloader-cli/Manifest
@@ -1,5 +1,3 @@
-DIST downloader_cli-0.3.3.tar.gz 10881 BLAKE2B 489e49d679be3570ee348ec73091cc3458953d4b37c552a9a417af2421e9c032624214300418ff8c93decda6bad7622e6208a08dc216f40d1195f849dc11d0d3 SHA512 4210cc3c09f4c9d07c3ea7335b6ea356393f539ef26e3a231b3278359e853165b8145c1f6186b657e2cee02b515748f7ffc87966cc30e082b0d2b282b9557c72
DIST downloader_cli-0.3.4.tar.gz 14479 BLAKE2B d45ec6399b6ccd76141a85440faeac040b11565c1d7db6316c23026008238e11601346ff433ec2f18516fef2f34f2e87d94460b64bfe875569c6da236e4ba63e SHA512 ace252bc6129b463c644ef7c34d07cd37759030fc4b4b853e049a2377226cdc73a6661f4e8ca7721b7af11f9daf548c81f25f73fde405e633091d614a05ed4f6
-EBUILD downloader-cli-0.3.3.ebuild 469 BLAKE2B b669b7228c5e9e017ac903054552a461ae83c8f2ed093c3d6dd7204ca977930fc92c49f9b548923c53f8a75ad68489657462bedea347dbcfebfd34a003188ef1 SHA512 d0f2162b1b3cde0578a925c50f301d3f0cc464eb16fdad581f64ace278870f1f50854ad380333ca5016831b86812eb4dbd31fecfbae749816b5ef47ad22115ac
-EBUILD downloader-cli-0.3.4.ebuild 470 BLAKE2B 53d65e25a3fba2c868097c9a39fe8ec3bc9d806128d097efc41f11b1343a2b74435ac36de4ede09fef09e24ec485341937b7957912de7fd586d1fd1295939467 SHA512 566e4d593f7b9dd7ed84a95c6324a19d5c8750ab754cf1ac766cb68802c9abd38a4fac9fb1107c84374279ae05f259a271b3d7d41fdc6533478d98882ae78480
+EBUILD downloader-cli-0.3.4.ebuild 498 BLAKE2B 3b44ef4d863f4353471e6aa343b62ad99acf6fe2a1061e0b4cd608bf1e140b5b51ca26ea4f13a34d0ec3a83dade12c51197e8403981779deccf760a700518df8 SHA512 293974b2c6475a3277e197bd72fc39136dd9a5ca5f6227efd93abb226e3979291c2d95efc4be1d42a00cbde30fa19e4ece4cba86a05ecaca7b0b60bff86b81bc
MISC metadata.xml 477 BLAKE2B 4b2e74ef3c28a676745976feecdc1f6f0d341ce223b1d92a25a44eb0bf81d3f3d091145f7fef901dc49b6f8d157419408b1e203965c294b48a42be40853113ae SHA512 92893a29b67aabc13badbf69f3ad8147faff5d65d235f487a744719a9002a968581b2a2aebe64776dcba3ddeb8ba849a72e3a96d6551a22c72a0e0866ab16a90
diff --git a/net-misc/downloader-cli/downloader-cli-0.3.3.ebuild b/net-misc/downloader-cli/downloader-cli-0.3.3.ebuild
deleted file mode 100644
index 12f30759df62..000000000000
--- a/net-misc/downloader-cli/downloader-cli-0.3.3.ebuild
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Simple downloader with an customizable progressbar"
-HOMEPAGE="
- https://github.com/deepjyoti30/downloader-cli/
- https://pypi.org/project/downloader-cli/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 ~x86"
-
-RDEPEND="dev-python/urllib3[${PYTHON_USEDEP}]"
diff --git a/net-misc/downloader-cli/downloader-cli-0.3.4.ebuild b/net-misc/downloader-cli/downloader-cli-0.3.4.ebuild
index 9c175cbe3619..1f443f330dfb 100644
--- a/net-misc/downloader-cli/downloader-cli-0.3.4.ebuild
+++ b/net-misc/downloader-cli/downloader-cli-0.3.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
@@ -9,13 +9,13 @@ PYTHON_COMPAT=( python3_{10..12} )
inherit distutils-r1 pypi
DESCRIPTION="Simple downloader with an customizable progressbar"
-HOMEPAGE="
- https://github.com/deepjyoti30/downloader-cli/
- https://pypi.org/project/downloader-cli/
-"
+HOMEPAGE="https://github.com/deepjyoti30/downloader-cli/
+ https://pypi.org/project/downloader-cli/"
LICENSE="MIT"
SLOT="0"
KEYWORDS="amd64 ~x86"
RDEPEND="dev-python/urllib3[${PYTHON_USEDEP}]"
+
+distutils_enable_tests pytest
diff --git a/net-misc/freerdp/Manifest b/net-misc/freerdp/Manifest
index b49d38d97298..d581b61ba1a0 100644
--- a/net-misc/freerdp/Manifest
+++ b/net-misc/freerdp/Manifest
@@ -6,6 +6,6 @@ DIST freerdp-3.0.0.tar.gz 9032924 BLAKE2B 45e3ee13a664b947e509100824709088091192
EBUILD freerdp-2.11.1.ebuild 3382 BLAKE2B d5dea2d7e87eecbaea1b0a40a306be2d5053b03874cc14499764750bf4a5139a2860a9804e2e96a8dfc2fc959100d97b3b210f3edcad5ea6d2f29cb9fc73d58a SHA512 3622e56997255a2f78ff349aeb88899d4e948d8b049cfd24bcb1ca4f7d6669068900aa35ae7e15659adffed01a7f08ca585d254d74353078b70ad56d8f4b44e2
EBUILD freerdp-2.11.2.ebuild 3388 BLAKE2B 9c9a11d0ff7656b7222dabdff1f802e72880483d8175c1b804576d647512aa148f7294172e279e08664ff03c526bd0cfa754e512215f15f201a4ea4677467fea SHA512 95c104b10bbf6c79735fc87f1db6a1546cff8f419d4d1e0f7cb1720e90922bb516dda39ddbe3cb4d7a72e4f00aa7f1ea453a15165634e686a44b23d681a5b4b5
EBUILD freerdp-2.9999.ebuild 3247 BLAKE2B ef1fc3d6aeccb4ac0fad19144f14034f784807b58892971cae742fb780115e6af807979c1de87b858eb5bfb0d47670f546c019867aa44912eacea9dc25c67b40 SHA512 abe9e156276fbf9877fb7b1859f7bb4e74cce6b9e0400fe498a0a02db4d407fe469c6119659e0a234c205e6f1b5491a2b34a0bbc81fca1df2b0ad52a2b644adb
-EBUILD freerdp-3.0.0-r1.ebuild 3571 BLAKE2B 86dc39857473179b5fb7057aeb756df68af70ad3af718ae8bc0f91549f96c60c2edf084e82627c91dd00e9378f4f2ed0c367a80e26d16780f333aa52e10d9fdc SHA512 a6e1e2f75e63f8ae7c4998daf2c6f2ccf0f08e0851ef21901d56a812a1e9dd6eb1966e3b27c95a7c122ee7ae828f519cf050d77ed0ed1661e4b3a7d0dca58597
+EBUILD freerdp-3.0.0-r1.ebuild 3578 BLAKE2B 1ae1d6cf89b05a68547bb2f39b8dfb2f2836b9c25bd2f1b8ef0a20539f1469c796b301032d78abd644deaee4672c10093736130e932ff9d416e4a4be3c30c99d SHA512 5a966698e90478a7607a8d25d654fd31392b9870f72aaaed99e514a44e6d051887b3f8ace0a705a803ee844178c40224865b8f5b6ba8dadb824a0b59f2e68d87
EBUILD freerdp-9999.ebuild 3571 BLAKE2B 86dc39857473179b5fb7057aeb756df68af70ad3af718ae8bc0f91549f96c60c2edf084e82627c91dd00e9378f4f2ed0c367a80e26d16780f333aa52e10d9fdc SHA512 a6e1e2f75e63f8ae7c4998daf2c6f2ccf0f08e0851ef21901d56a812a1e9dd6eb1966e3b27c95a7c122ee7ae828f519cf050d77ed0ed1661e4b3a7d0dca58597
MISC metadata.xml 599 BLAKE2B abc5045f654a1dee76a0c4352bb2374063a885c1bce2b0ccf43a62cf933119a6aa50bf835c3b35e546d6bbd772100d8523e4f388ebbb43883e5903957799d65e SHA512 7f06ed1615b32380a21e5fe772e0e36c475dc105a78f8766c13158b49526b288d4de81be2649861544acd8cd3ac51720c985ebfe19cb4439f3ea96c67b729c01
diff --git a/net-misc/freerdp/freerdp-3.0.0-r1.ebuild b/net-misc/freerdp/freerdp-3.0.0-r1.ebuild
index 40f110ef9887..ed9667cbc8b5 100644
--- a/net-misc/freerdp/freerdp-3.0.0-r1.ebuild
+++ b/net-misc/freerdp/freerdp-3.0.0-r1.ebuild
@@ -15,7 +15,7 @@ else
MY_P=${P/_/-}
S="${WORKDIR}/${MY_P}"
SRC_URI="https://pub.freerdp.com/releases/${MY_P}.tar.gz"
- KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
fi
DESCRIPTION="Free implementation of the Remote Desktop Protocol"
diff --git a/net-misc/gsasl/Manifest b/net-misc/gsasl/Manifest
index bae3e49486a5..c0935a602a71 100644
--- a/net-misc/gsasl/Manifest
+++ b/net-misc/gsasl/Manifest
@@ -1,6 +1,8 @@
DIST gsasl-2.0.1.tar.gz 3279632 BLAKE2B a25d121a5043455ed827a6bdc776c10d467a49b4dc6b73d2f4b08fecbf1ca5f423ffdcfd39e0d2bf71f724ed8302ffd8acda4fda3ef10ceadece60509ac73500 SHA512 01c6f6bd9f986c942a25b89fee0052aef8c10bf914ead29983abdf0cc8fcaa7223fd9d9eeafb4be07e4bc318f087f6f6258facaaeb7f83bca8de512406812be5
DIST gsasl-2.2.0.tar.gz 3290469 BLAKE2B ca57765f299939a6f9457aac3d51132f7b5a0e2f0788523349083a65e5de0b780573000c378e0fff844cf9f882239e7ff6e0b520ae66a60f3e928c16d6f74857 SHA512 0ae318a8616fe675e9718a3f04f33731034f9a7ba03d83ccb1a72954ded54ced35dc7c7e173fdcb6fa0f0813f8891c6cbcedf8bf70b37d00b8ec512eb9f07f5f
+DIST gsasl-2.2.1.tar.gz 3344807 BLAKE2B 3bb1f7dee8510c19215dc8fdc5efd8e53318ab967b4d4af9e48474857a112b0e08872016a5c5bcbd6b1b340f29fbd77623efc6c41a1f87fb734623e2f173e1bf SHA512 161b8a315862a79807ba067c5ae840175b0d8ec14806aceafc3f92d571713b94d1b8c1a5b188c47bf94a79b9a1f133065f96b087baa5e7f360ae7fb8336381ab
EBUILD gsasl-2.0.1-r2.ebuild 2185 BLAKE2B 8ead62589512588de24ae7619f1a39c7e31f0b5245a48d7a166e014f899f79db05389fc5d939e9d6c0af807ae813d79358a165e1a7bc50c6ed6364973159451e SHA512 ef7af4d634781a493f019ad8424eee1b1d5637662993d0739dfd21d481fe895841cd2ab011cffbd458397242232fb96dc805ff561ce09a1af0150fa2445ccf18
EBUILD gsasl-2.0.1.ebuild 1994 BLAKE2B 6a85bdc65189d22d718530dd1769b98767099a10c49d2686f076daa99a19ac18eb38703252191e4633146732f1aa68f0e654012d81262366f413b4c930aaa4d2 SHA512 d7d1e08f70185e6e90a22f29db6240f8af9a3c5c6dbfd0a2249ce957e17df7ae81de09e2b3b548b028d402c413e30f1875b0f6da7891c3e61d95f804538ceb5c
EBUILD gsasl-2.2.0.ebuild 2191 BLAKE2B 03e751c305fd5d66fd97d157b91ce1c04d7c0b97bf79416a3f3db55924878daa0a859e25f7d88fb0478131780a2f1b4199ec3671ec5e78f40e24e69d7bd979c5 SHA512 01854d9cac3cff6a679c36f9f304e065042647111b489fc9827b2e90ff68e868b82f82659ddb1761047310336d76948abdaeab6fa5ef67753dd4a7581bde8789
+EBUILD gsasl-2.2.1.ebuild 2303 BLAKE2B 30058485b4cd6c2c86e2345cf7ef4642257d76d52225ffec0edcbbffe5a20cfe3cda3c0fc4c1efb24f0c2f68310d10bd1ac1b9cce7e495c28681e14ac35d2112 SHA512 f6179cbb0ab69296c0096e18cb66f202d4d7102969c841ee4e15ae6cd24e531bffc60f6b27e123dfabd9b355f0cbf5e74cc5377490e0f565b6b85a862880784b
MISC metadata.xml 579 BLAKE2B 87f59c4a4c3ba2b3741aac713b47ec1357889afce3d06919705a5e31fba874ba5e0ba53c1a43cfb465d4c3ed138d465060f883afedd882547a39cefd58e20c01 SHA512 ccf34d49ff3453e97e1e4c2c9c769ea7ae201243d3756bd7154cf98581e704ae980a6e82ba8020993e42956a512111972ba2cc39e0f3fe789b1080ebe9e5f351
diff --git a/net-misc/gsasl/gsasl-2.2.1.ebuild b/net-misc/gsasl/gsasl-2.2.1.ebuild
new file mode 100644
index 000000000000..35e903c6643b
--- /dev/null
+++ b/net-misc/gsasl/gsasl-2.2.1.ebuild
@@ -0,0 +1,101 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="The GNU SASL client, server, and library"
+HOMEPAGE="https://www.gnu.org/software/gsasl/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+# Before giving keywords (or ideally even bumping), please check https://www.gnu.org/software/gsasl/ to see
+# if it's a stable release or not!
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+IUSE="+client gcrypt gnutls idn kerberos nls ntlm +server static-libs"
+REQUIRED_USE="|| ( client server )"
+
+DEPEND="
+ !net-libs/libgsasl
+ sys-libs/readline:=
+ gcrypt? ( dev-libs/libgcrypt:= )
+ gnutls? ( net-libs/gnutls:= )
+ idn? ( net-dns/libidn:= )
+ kerberos? ( >=net-libs/libgssglue-0.5-r1 )
+ nls? ( >=sys-devel/gettext-0.18.1 )
+ ntlm? ( >=net-libs/libntlm-0.3.5 )
+"
+RDEPEND="${DEPEND}"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+ # gnulib FPs
+ unreachable
+ MIN
+ alignof
+ static_assert
+)
+
+src_prepare() {
+ default
+
+ sed -i \
+ -e '/gl_WARN_ADD(\[-Werror/d' \
+ -e 's/ -Werror//' \
+ configure.ac || die
+
+ eautoreconf
+}
+
+src_configure() {
+ local krb5_impl="--with-gssapi-impl=no"
+
+ # See https://blog.josefsson.org/2022/07/14/towards-pluggable-gss-api-modules/
+ if use kerberos; then
+ krb5_impl="--with-gssapi-impl=gssglue"
+ fi
+
+ local myeconfargs=(
+ --disable-gcc-warnings
+ --disable-valgrind-tests
+ --disable-rpath
+
+ --with-packager="Gentoo Linux"
+ --with-packager-bug-reports="https://bugs.gentoo.org"
+ --with-packager-version="r${PR}"
+
+ $(use_enable client)
+ $(use_enable server)
+
+ $(use_enable kerberos gssapi)
+ ${krb5_impl}
+ $(use_enable kerberos gs2)
+
+ $(use_with gcrypt libgcrypt)
+ $(use_with gnutls)
+ $(use_enable nls)
+ $(use_with idn stringprep)
+ $(use_enable ntlm)
+ $(use_enable static-libs static)
+ )
+
+ econf "${myeconfargs[@]}"
+}
+
+src_install() {
+ default
+
+ if ! use static-libs; then
+ rm -f "${ED}"/usr/lib*/lib*.la || die
+ fi
+
+ doman doc/gsasl.1 doc/man/*.3
+}
+
+pkg_postinst() {
+ ewarn "For USE=kerberos, ${PN} now uses libgssglue to allow choosing"
+ ewarn "the Kerberos implementation at runtime."
+ elog "See https://blog.josefsson.org/2022/07/14/towards-pluggable-gss-api-modules/"
+ elog "for more details."
+}
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 901c76798def..d1c299df9fd9 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,21 +1,13 @@
-AUX openssh-9.3_p1-GSSAPI-dns.patch 10903 BLAKE2B 2b6502923c474cf3965fd6372b56acab5c7afce5dd1ab89396afb8b892052f1d95425f659b4eb361700db32117f00bd09f4b7aa44ea09811657fff516e171e81 SHA512 00bdc40538a33324ba4696ae526fe8a0b3a700c3f1c2722bd39a3e3632ed919832b0b8ba03c4f421322ee3ad51c53f699009633c243294cdf07c460b0b09ad3e
AUX openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch 415 BLAKE2B e29acfc416d7a84a19691a56cc7f8f6a71955b147d2f7d8686cfa391887040a66249312a321c02f9acc665dfdfcb04b129772f0e44ebdf1ff54853d439a39d7d SHA512 122d325267aa69e4c9520b396ba8608ab1ea77f651cb0078479bc60c938366632c4bc7b0d17b12ef7a13bb6a447b230122029dbed93b837c9698fc91a2822e11
AUX openssh-9.3_p1-disable-conch-interop-tests.patch 554 BLAKE2B f5f45c000ec26c1f783669c3447ea3c80c5c0f9b971b86ca1e79e99e906a90a519abb6b14db462f5766572e9759180719ea44f048ef5aa8efc37efb61d2b6ef7 SHA512 f35b15f1e8d0eb276d748ee14c71004c6599ddb124c33e2f84623bc9eb02bb4fd4680d25d0ba0289d6a723a526c95c9a56b30496bdaa565bae853bf3d1bab61f
AUX openssh-9.3_p1-fix-putty-tests.patch 1691 BLAKE2B 8a92766bd2db65a4dab1254a356ecee65203e11179a499b40dfde623c642a0d6aa205490faabd50abfba5bbb4a9d3e1fa9427c42fd82883df1401b7a871979ea SHA512 4b27ece068d233e128dde2571a93ce6ff695ee975e5dcbef84b8c0923e84903494f980bbe38129cd9f83bb34e7a7940f8686a5b8f85d20e3e11c53b6d933196d
-AUX openssh-9.3_p2-zlib-1.3.patch 671 BLAKE2B 44a974e83faaee7336898227bc6f14ff4ab6e8e91e2d8f61d22f45b4d73e57a79b505143620d3a910c6e7cea91ab406e10ffcf23a802f447843f5c2836e37c34 SHA512 d2e5992c783b46b4859501aa32aa7b0acc5ec9e512589e18faebfa8660c52a3ad9ffa3d5a4cd5ba9a5fadb7ab86e51c32714dd23325054b05fa07194bd86f7d7
AUX sshd-r1.confd 774 BLAKE2B df3f3f28cb4d35b49851399b52408c42e242ae3168ff3fc79add211903567da370cfe86a267932ca9cf13c3afbc38a8f1b53e753a31670ee61bf8ba8747832f8 SHA512 3a69752592126024319a95f1c1747af508fd639c86eca472106c5d6c23d5eeaa441ca74740d4b1aafaa0db759d38879e3c1cee742b08d6166ebc58cddac1e2fe
AUX sshd-r1.initd 2675 BLAKE2B 47e87cec2d15b90aae362ce0c8e8ba08dada9ebc244e28be1fe67d24deb00675d3d9b8fef40def8a9224a3e2d15ab717574a3d837e099133c1cf013079588b55 SHA512 257d6437162b76c4a3a648ecc5d4739ca7eaa60b192fde91422c6c05d0de6adfa9635adc24d57dc3da6beb92b1b354ffe8fddad3db453efb610195d5509a4e27
AUX sshd.pam_include.2 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c
AUX sshd.service.1 298 BLAKE2B 7a4f2e2656096b09a8b435d393ea9b0a7bd10a2a9f0e9d9cf49b9ae9600cccfb19a64e09f4cf718e8054fc997f21656f609eb3af15ee2e3576531a88b5709842 SHA512 efc936ca412999e3b1acabe6cf4e87c033fe468cede1c3c499499e252cf7cdeca0841e5e1862ebe316ff3f4bf758fba674f08d081b403713e154b6bbc37da365
AUX sshd.socket 136 BLAKE2B 22e218c831fc384a3151ef97c391253738fa9002e20cf4628c6fe3d52d4b0ac3b957da58f816950669d0a6f8f2786251c6dfc31bbb863f837a3f52631341dc2e SHA512 4d31d373b7bdae917dc0cf05418c71d4743e98e354aefcf055f88f55c9c644a5a0e0e605dbb8372c1b98d17c0ea1c8c0fee27d38ab8dbe23c7e420a6a78c6d42
AUX sshd_at.service.1 163 BLAKE2B b5c77d69e3860d365ba96a5b2fe14514bda9425e170fc7f324dcaf95fb02756ef9c5c2658904e812232f40fac9a3c2f4abf61b9129038bde66bb7d3a992d2606 SHA512 fbfe0aed3a5e99f15dc68838975cc49a206d697fb3549d8b31db25617dc7b7b8dd2397d865d89f305d5da391cd56a69277c2215c4335fccb4dd6a9b95ba34e2f
-DIST openssh-9.4p1.tar.gz 1845094 BLAKE2B d13d758129cce947d3f12edb6e88406aad10de6887b19ffa3ebd8e382b742a05f2a692a8824aec99939f6c7e13fbccc3bb14e5ee112f9a9255d4882eb87dcf53 SHA512 0aaedeced7dbc70419c7245eb0e9db4ef570e0e7739b890ebae04d56da5fe8d147e8e150f3c943f60730976569e3ac6cc8da62ec7e2a78e2ef47d295ca0b1d25
-DIST openssh-9.4p1.tar.gz.asc 833 BLAKE2B 95eedd9356766e5d0ea1261da3dc4c7869f054b418c626fb35815a0aa655b1ddbf54436b437d98c4344b05c9196c8fa1f592eac07b3ccf08bd3e980f8b6955af SHA512 983b4ebaa3b98e70831ce686cb503270926c065163a2510eef0c5102ef50b6e665b889ee15ea8c0bd7c4bbddb19270f036e1d554a8212ef2c292f9c682c8631a
-DIST openssh-9.5p1.tar.gz 1843001 BLAKE2B 55dbb0a2792b0046c943a19ca0966660e6e378e77856e94823a1bbbafaa0da94357403765c4c028aebf6543049a0f9bbe0019629be3f92cdadfac1be56def796 SHA512 e183fdf7477fd986215b889eea4a945d71385e35305746ccb164e757ecc28166f429c70890a237d8ef4cdcae5132935ba2ecb3b2a658eb73a6afcf6f42277b9c
-DIST openssh-9.5p1.tar.gz.asc 833 BLAKE2B abec3d14d9a880008db202be00ed446ccc0a98ce77c16a9e6d6492feac07c8f3284f9cd24f6ee1d904a55f9f23d5cce8a716916975c179a38ef6bde1d36e0acf SHA512 2b6de653420ba02eb99c7e6fba09af3bacfe9c701f3dfc3c94f41a3539c0414954fc5c64cce63c488c5ccd5d4ddb42d3f2184ff7f323342c885c47bf7d426ca1
DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509
DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
-EBUILD openssh-9.4_p1-r1.ebuild 13388 BLAKE2B e9e6c2bdc30df9c16488c0b1d176e2e3ad84b6d26b6061ad1dfcc4ac968b1b0e0aef70ee8e83ea31d7165d5ab9f2223ce6bbccf8484b9a80a3e5ec76377ce624 SHA512 bab7dd22e43ce950c65365104d132297deb66d577a7f58a1d4bac67ea7e9b2319cdcab7ecf739f316528229bf21b5a0ec2b9ed7f690078be4ccefce0663ae596
-EBUILD openssh-9.5_p1-r2.ebuild 13261 BLAKE2B 09edffc733d459734c20122b0b6795822ccaf9acf6699ac335ed58bfdad56616a1835e236d80424e16dacda24c1ce64cf54a89fca5dabcb33c1c4ecddc5dca1a SHA512 a4ef119fa28e209296e416ed00ca10e793895d45c5de2e1662ea8cadf43cf9cb6fc5757b91c6237cd0829bc4e7b5f0f729448b25de7b9c1e011a325fe059f374
EBUILD openssh-9.6_p1-r1.ebuild 14012 BLAKE2B 3c621dc111aabb2426f157c7e7b97c15c018ebda64cfe7995947c5a9e77cee69997cf91f868fece41351a2c5caadd2fa4419503ed4708bd301b14d3712986b9a SHA512 c5cee410667aab17cef22c4c88bc7d97b0409d4c9a0784200f0e07299eac4dae141e045178e02d3cbba493dcb385a87ee1e56e8ffa12e32feeb7359c783f723d
MISC metadata.xml 1788 BLAKE2B d04d3030f70f3615522672fa56e684acaa67ddce8d16cce86ba8911fb8fc11ed152be012ecf560427d271868c4841a7422aaa644305947302d3ebab62bdb577d SHA512 bd328e3a33ce04b989149333db5f774f1b52540f12ef83b08b7fcf136ae2a3a9c83bef42c28991d3536249098ca0b9ffd21e583d93599580510d8619e9fd01ca
diff --git a/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch
deleted file mode 100644
index cbc0ec2d9c2d..000000000000
--- a/net-misc/openssh/files/openssh-9.3_p1-GSSAPI-dns.patch
+++ /dev/null
@@ -1,345 +0,0 @@
---- a/auth.c
-+++ b/auth.c
-@@ -637,118 +637,6 @@
- return (&fake);
- }
-
--/*
-- * Returns the remote DNS hostname as a string. The returned string must not
-- * be freed. NB. this will usually trigger a DNS query the first time it is
-- * called.
-- * This function does additional checks on the hostname to mitigate some
-- * attacks on based on conflation of hostnames and IP addresses.
-- */
--
--static char *
--remote_hostname(struct ssh *ssh)
--{
-- struct sockaddr_storage from;
-- socklen_t fromlen;
-- struct addrinfo hints, *ai, *aitop;
-- char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-- const char *ntop = ssh_remote_ipaddr(ssh);
--
-- /* Get IP address of client. */
-- fromlen = sizeof(from);
-- memset(&from, 0, sizeof(from));
-- if (getpeername(ssh_packet_get_connection_in(ssh),
-- (struct sockaddr *)&from, &fromlen) == -1) {
-- debug("getpeername failed: %.100s", strerror(errno));
-- return xstrdup(ntop);
-- }
--
-- ipv64_normalise_mapped(&from, &fromlen);
-- if (from.ss_family == AF_INET6)
-- fromlen = sizeof(struct sockaddr_in6);
--
-- debug3("Trying to reverse map address %.100s.", ntop);
-- /* Map the IP address to a host name. */
-- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-- NULL, 0, NI_NAMEREQD) != 0) {
-- /* Host name not found. Use ip address. */
-- return xstrdup(ntop);
-- }
--
-- /*
-- * if reverse lookup result looks like a numeric hostname,
-- * someone is trying to trick us by PTR record like following:
-- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-- hints.ai_flags = AI_NUMERICHOST;
-- if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-- logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-- name, ntop);
-- freeaddrinfo(ai);
-- return xstrdup(ntop);
-- }
--
-- /* Names are stored in lowercase. */
-- lowercase(name);
--
-- /*
-- * Map it back to an IP address and check that the given
-- * address actually is an address of this host. This is
-- * necessary because anyone with access to a name server can
-- * define arbitrary names for an IP address. Mapping from
-- * name to IP address can be trusted better (but can still be
-- * fooled if the intruder has access to the name server of
-- * the domain).
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_family = from.ss_family;
-- hints.ai_socktype = SOCK_STREAM;
-- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-- logit("reverse mapping checking getaddrinfo for %.700s "
-- "[%s] failed.", name, ntop);
-- return xstrdup(ntop);
-- }
-- /* Look for the address from the list of addresses. */
-- for (ai = aitop; ai; ai = ai->ai_next) {
-- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-- (strcmp(ntop, ntop2) == 0))
-- break;
-- }
-- freeaddrinfo(aitop);
-- /* If we reached the end of the list, the address was not there. */
-- if (ai == NULL) {
-- /* Address not found for the host name. */
-- logit("Address %.100s maps to %.600s, but this does not "
-- "map back to the address.", ntop, name);
-- return xstrdup(ntop);
-- }
-- return xstrdup(name);
--}
--
--/*
-- * Return the canonical name of the host in the other side of the current
-- * connection. The host name is cached, so it is efficient to call this
-- * several times.
-- */
--
--const char *
--auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
--{
-- static char *dnsname;
--
-- if (!use_dns)
-- return ssh_remote_ipaddr(ssh);
-- else if (dnsname != NULL)
-- return dnsname;
-- else {
-- dnsname = remote_hostname(ssh);
-- return dnsname;
-- }
--}
--
- /* These functions link key/cert options to the auth framework */
-
- /* Log sshauthopt options locally and (optionally) for remote transmission */
---- a/canohost.c
-+++ b/canohost.c
-@@ -205,3 +205,117 @@
- {
- return get_sock_port(sock, 1);
- }
-+
-+/*
-+ * Returns the remote DNS hostname as a string. The returned string must not
-+ * be freed. NB. this will usually trigger a DNS query the first time it is
-+ * called.
-+ * This function does additional checks on the hostname to mitigate some
-+ * attacks on legacy rhosts-style authentication.
-+ * XXX is RhostsRSAAuthentication vulnerable to these?
-+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
-+ */
-+
-+static char *
-+remote_hostname(struct ssh *ssh)
-+{
-+ struct sockaddr_storage from;
-+ socklen_t fromlen;
-+ struct addrinfo hints, *ai, *aitop;
-+ char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-+ const char *ntop = ssh_remote_ipaddr(ssh);
-+
-+ /* Get IP address of client. */
-+ fromlen = sizeof(from);
-+ memset(&from, 0, sizeof(from));
-+ if (getpeername(ssh_packet_get_connection_in(ssh),
-+ (struct sockaddr *)&from, &fromlen) == -1) {
-+ debug("getpeername failed: %.100s", strerror(errno));
-+ return xstrdup(ntop);
-+ }
-+
-+ ipv64_normalise_mapped(&from, &fromlen);
-+ if (from.ss_family == AF_INET6)
-+ fromlen = sizeof(struct sockaddr_in6);
-+
-+ debug3("Trying to reverse map address %.100s.", ntop);
-+ /* Map the IP address to a host name. */
-+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-+ NULL, 0, NI_NAMEREQD) != 0) {
-+ /* Host name not found. Use ip address. */
-+ return xstrdup(ntop);
-+ }
-+
-+ /*
-+ * if reverse lookup result looks like a numeric hostname,
-+ * someone is trying to trick us by PTR record like following:
-+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-+ hints.ai_flags = AI_NUMERICHOST;
-+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-+ name, ntop);
-+ freeaddrinfo(ai);
-+ return xstrdup(ntop);
-+ }
-+
-+ /* Names are stored in lowercase. */
-+ lowercase(name);
-+
-+ /*
-+ * Map it back to an IP address and check that the given
-+ * address actually is an address of this host. This is
-+ * necessary because anyone with access to a name server can
-+ * define arbitrary names for an IP address. Mapping from
-+ * name to IP address can be trusted better (but can still be
-+ * fooled if the intruder has access to the name server of
-+ * the domain).
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_family = from.ss_family;
-+ hints.ai_socktype = SOCK_STREAM;
-+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-+ logit("reverse mapping checking getaddrinfo for %.700s "
-+ "[%s] failed.", name, ntop);
-+ return xstrdup(ntop);
-+ }
-+ /* Look for the address from the list of addresses. */
-+ for (ai = aitop; ai; ai = ai->ai_next) {
-+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-+ (strcmp(ntop, ntop2) == 0))
-+ break;
-+ }
-+ freeaddrinfo(aitop);
-+ /* If we reached the end of the list, the address was not there. */
-+ if (ai == NULL) {
-+ /* Address not found for the host name. */
-+ logit("Address %.100s maps to %.600s, but this does not "
-+ "map back to the address.", ntop, name);
-+ return xstrdup(ntop);
-+ }
-+ return xstrdup(name);
-+}
-+
-+/*
-+ * Return the canonical name of the host in the other side of the current
-+ * connection. The host name is cached, so it is efficient to call this
-+ * several times.
-+ */
-+
-+const char *
-+auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
-+{
-+ static char *dnsname;
-+
-+ if (!use_dns)
-+ return ssh_remote_ipaddr(ssh);
-+ else if (dnsname != NULL)
-+ return dnsname;
-+ else {
-+ dnsname = remote_hostname(ssh);
-+ return dnsname;
-+ }
-+}
---- a/readconf.c
-+++ b/readconf.c
-@@ -160,6 +160,7 @@
- oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+ oGssTrustDns,
- oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
- oHashKnownHosts,
-@@ -207,9 +208,11 @@
- #if defined(GSSAPI)
- { "gssapiauthentication", oGssAuthentication },
- { "gssapidelegatecredentials", oGssDelegateCreds },
-+ { "gssapitrustdns", oGssTrustDns },
- # else
- { "gssapiauthentication", oUnsupported },
- { "gssapidelegatecredentials", oUnsupported },
-+ { "gssapitrustdns", oUnsupported },
- #endif
- #ifdef ENABLE_PKCS11
- { "pkcs11provider", oPKCS11Provider },
-@@ -1125,6 +1128,10 @@
- intptr = &options->gss_deleg_creds;
- goto parse_flag;
-
-+ case oGssTrustDns:
-+ intptr = &options->gss_trust_dns;
-+ goto parse_flag;
-+
- case oBatchMode:
- intptr = &options->batch_mode;
- goto parse_flag;
-@@ -2341,6 +2348,7 @@
- options->pubkey_authentication = -1;
- options->gss_authentication = -1;
- options->gss_deleg_creds = -1;
-+ options->gss_trust_dns = -1;
- options->password_authentication = -1;
- options->kbd_interactive_authentication = -1;
- options->kbd_interactive_devices = NULL;
-@@ -2501,6 +2509,8 @@
- options->gss_authentication = 0;
- if (options->gss_deleg_creds == -1)
- options->gss_deleg_creds = 0;
-+ if (options->gss_trust_dns == -1)
-+ options->gss_trust_dns = 0;
- if (options->password_authentication == -1)
- options->password_authentication = 1;
- if (options->kbd_interactive_authentication == -1)
---- a/readconf.h
-+++ b/readconf.h
-@@ -41,6 +41,7 @@
- int hostbased_authentication; /* ssh2's rhosts_rsa */
- int gss_authentication; /* Try GSS authentication */
- int gss_deleg_creds; /* Delegate GSS credentials */
-+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
- int password_authentication; /* Try password
- * authentication. */
- int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -843,6 +843,16 @@
- Forward (delegate) credentials to the server.
- The default is
- .Cm no .
-+Note that this option applies to protocol version 2 connections using GSSAPI.
-+.It Cm GSSAPITrustDns
-+Set to
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If
-+.Dq no, the hostname entered on the
-+command line will be passed untouched to the GSSAPI library.
-+The default is
-+.Dq no .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -764,6 +764,13 @@
- OM_uint32 min;
- int r, ok = 0;
- gss_OID mech = NULL;
-+ const char *gss_host;
-+
-+ if (options.gss_trust_dns) {
-+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns);
-+ gss_host = auth_get_canonical_hostname(ssh, 1);
-+ } else
-+ gss_host = authctxt->host;
-
- /* Try one GSSAPI method at a time, rather than sending them all at
- * once. */
-@@ -778,7 +785,7 @@
- elements[authctxt->mech_tried];
- /* My DER encoding requires length<128 */
- if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
-- mech, authctxt->host)) {
-+ mech, gss_host)) {
- ok = 1; /* Mechanism works */
- } else {
- authctxt->mech_tried++;
diff --git a/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch b/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch
deleted file mode 100644
index f1336bbe0380..000000000000
--- a/net-misc/openssh/files/openssh-9.3_p2-zlib-1.3.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-https://bugs.gentoo.org/912766
-https://github.com/openssh/openssh-portable/commit/cb4ed12ffc332d1f72d054ed92655b5f1c38f621
-
-From cb4ed12ffc332d1f72d054ed92655b5f1c38f621 Mon Sep 17 00:00:00 2001
-From: Darren Tucker <dtucker@dtucker.net>
-Date: Sat, 19 Aug 2023 07:39:08 +1000
-Subject: [PATCH] Fix zlib version check for 1.3 and future version.
-
-bz#3604.
---- a/configure.ac
-+++ b/configure.ac
-@@ -1464,7 +1464,7 @@ else
- [[
- int a=0, b=0, c=0, d=0, n, v;
- n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
-- if (n != 3 && n != 4)
-+ if (n < 1)
- exit(1);
- v = a*1000000 + b*10000 + c*100 + d;
- fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
-
diff --git a/net-misc/openssh/openssh-9.4_p1-r1.ebuild b/net-misc/openssh/openssh-9.4_p1-r1.ebuild
deleted file mode 100644
index dbfa1b7bbe14..000000000000
--- a/net-misc/openssh/openssh-9.4_p1-r1.ebuild
+++ /dev/null
@@ -1,380 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-GSSAPI-dns.patch" #165444 integrated into gsskex
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
- "${FILESDIR}/${PN}-9.3_p2-zlib-1.3.patch" #912766
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply -- "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- --with-hardening
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-9.5_p1-r2.ebuild b/net-misc/openssh/openssh-9.5_p1-r2.ebuild
deleted file mode 100644
index 5043c36ea762..000000000000
--- a/net-misc/openssh/openssh-9.5_p1-r2.ebuild
+++ /dev/null
@@ -1,378 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
- mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )"
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
- ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- xmss? ( ssl )
- test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- net-libs/ldns[ecdsa(+),ssl(+)]
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
- virtual/libcrypt:=[static-libs(+)]
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
- acct-group/sshd
- acct-user/sshd
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( sys-libs/pam )
- kerberos? ( virtual/krb5 )
-"
-DEPEND="${RDEPEND}
- virtual/os-headers
- kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
- static? ( ${LIB_DEPEND} )
-"
-RDEPEND="${RDEPEND}
- !net-misc/openssh-contrib
- pam? ( >=sys-auth/pambase-20081028 )
- !prefix? ( sys-apps/shadow )
- X? ( x11-apps/xauth )
-"
-# Weird dep construct for newer gcc-config for bug #872416
-BDEPEND="
- sys-devel/autoconf
- virtual/pkgconfig
- || (
- >=sys-devel/gcc-config-2.6
- >=sys-devel/clang-toolchain-symlinks-14-r1:14
- >=sys-devel/clang-toolchain-symlinks-15-r1:15
- >=sys-devel/clang-toolchain-symlinks-16-r1:*
- )
- verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
- "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch"
- "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch"
-)
-
-pkg_pretend() {
- local i enabled_eol_flags disabled_eol_flags
- for i in hpn sctp X509; do
- if has_version "net-misc/openssh[${i}]"; then
- enabled_eol_flags+="${i},"
- disabled_eol_flags+="-${i},"
- fi
- done
-
- if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
- # Skip for binary packages entirely because of environment saving, bug #907892
- [[ ${MERGE_TYPE} == binary ]] && return
-
- ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
- ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
- ewarn "since these USE flags required third-party patches that often trigger bugs"
- ewarn "and are of questionable provenance."
- ewarn
- ewarn "If you must continue relying on this functionality, switch to"
- ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
- ewarn "world file first: 'emerge --deselect net-misc/openssh'"
- ewarn
- ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
- ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
- ewarn "variant, when re-emerging you will have to set"
- ewarn
- ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
- die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply -- "${PATCHES[@]}"
-
- [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
-
- eapply_user #473004
-
- # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
- sed -e '/\t\tpercent \\/ d' \
- -i regress/Makefile || die
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
- use xmss && append-cflags -DWITH_XMSS
-
- if [[ ${CHOST} == *-solaris* ]] ; then
- # Solaris' glob.h doesn't have things like GLOB_TILDE, configure
- # doesn't check for this, so force the replacement to be put in
- # place
- append-cppflags -DBROKEN_GLOB
- fi
-
- # use replacement, RPF_ECHO_ON doesn't exist here
- [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- --with-hardening
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with security-key security-key-builtin)
- $(use_with ssl openssl)
- $(use_with ssl ssl-engine)
- )
-
- if use elibc_musl; then
- # musl defines bogus values for UTMP_FILE and WTMP_FILE
- # https://bugs.gentoo.org/753230
- myconf+=( --disable-utmp --disable-wtmp )
- fi
-
- # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
- # bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
- tc-is-clang && myconf+=( --without-hardening )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local tests=( compat-tests )
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- ewarn "user, so we will run a subset only."
- tests+=( interop-tests )
- else
- tests+=( tests )
- fi
-
- local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
- mkdir -p "${HOME}"/.ssh || die
- emake -j1 "${tests[@]}" </dev/null
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
- Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
- Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
- # Send locale environment variables (bug #367017)
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM (bug #658540)
- SendEnv COLORTERM
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
- RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die
- # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
- EOF
-
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
- # Allow client to pass locale environment variables (bug #367017)
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM (bug #658540)
- AcceptEnv COLORTERM
- EOF
-
- if use pam ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
- UsePAM yes
- # This interferes with PAM.
- PasswordAuthentication no
- # PAM can do its own handling of MOTD.
- PrintMotd no
- PrintLastLog no
- EOF
- fi
-
- if use livecd ; then
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
- # Allow root login with password on livecds.
- PermitRootLogin Yes
- EOF
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd-r1.initd sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- if use pam; then
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- fi
-
- tweak_ssh_configs
-
- doman contrib/ssh-copy-id.1
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
- diropts -m 0700
- dodir /etc/skel/.ssh
- rmdir "${ED}"/var/empty || die
-
- systemd_dounit "${FILESDIR}"/sshd.socket
- systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
- systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-}
-
-pkg_preinst() {
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
- show_ssl_warning=1
- fi
-}
-
-pkg_postinst() {
- local old_ver
- for old_ver in ${REPLACING_VERSIONS}; do
- if ver_test "${old_ver}" -lt "5.8_p1"; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if ver_test "${old_ver}" -lt "7.0_p1"; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ver_test "${old_ver}" -lt "7.6_p1"; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ver_test "${old_ver}" -lt "7.7_p1"; then
- elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
- elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
- elog "if you need to authenticate against LDAP."
- elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
- fi
- if ver_test "${old_ver}" -lt "8.2_p1"; then
- ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
- ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
- ewarn "connection is generally safe."
- fi
- if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
- ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
- ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
- ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
- ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
- ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
- ewarn "set 'Restart=no' in your sshd unit file."
- fi
- done
-
- if [[ -n ${show_ssl_warning} ]]; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-25 02:42:24 +0000