From 82edba3970d4fee1fcdfb4518fa5ba8423ba1480 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:10 -0400 Subject: [PATCH 01/11] app-text/lowdown: Stabilize 2.0.4 arm64, #970261 Signed-off-by: Eli Schwartz --- app-text/lowdown/lowdown-2.0.4.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app-text/lowdown/lowdown-2.0.4.ebuild b/app-text/lowdown/lowdown-2.0.4.ebuild index 6b0b4859f8ad6..bffd287b58bd4 100644 --- a/app-text/lowdown/lowdown-2.0.4.ebuild +++ b/app-text/lowdown/lowdown-2.0.4.ebuild @@ -13,7 +13,7 @@ S="${WORKDIR}/${PN}-${MY_PV}" LICENSE="ISC" SLOT="0/3" -KEYWORDS="amd64 ~arm ~arm64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~sparc x86" +KEYWORDS="amd64 ~arm arm64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~sparc x86" DEPEND=" virtual/libcrypt:= From 623badb5b62b63c0379e70686cfcf2cc96d58c99 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:11 -0400 Subject: [PATCH 02/11] dev-build/bmake: Stabilize 20251111 arm64, #970261 Signed-off-by: Eli Schwartz --- dev-build/bmake/bmake-20251111.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev-build/bmake/bmake-20251111.ebuild b/dev-build/bmake/bmake-20251111.ebuild index 6e4399bb5b16b..4edfc9f84c0f4 100644 --- a/dev-build/bmake/bmake-20251111.ebuild +++ b/dev-build/bmake/bmake-20251111.ebuild @@ -17,7 +17,7 @@ S="${WORKDIR}/${PN}" LICENSE="BSD" SLOT="0" -KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86" +KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86" IUSE="test" RESTRICT="!test? ( test )" From 935d786f724eba79c074d2cc3f61d235074a2a59 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:12 -0400 Subject: [PATCH 03/11] media-video/libva-utils: Stabilize 2.24.0 arm64, #981415 Signed-off-by: Eli Schwartz --- media-video/libva-utils/libva-utils-2.24.0.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media-video/libva-utils/libva-utils-2.24.0.ebuild b/media-video/libva-utils/libva-utils-2.24.0.ebuild index 3f6b0c74a5f16..8f5f26d2dd5bf 100644 --- a/media-video/libva-utils/libva-utils-2.24.0.ebuild +++ b/media-video/libva-utils/libva-utils-2.24.0.ebuild @@ -12,7 +12,7 @@ if [[ ${PV} = *9999 ]] ; then EGIT_REPO_URI="https://github.com/intel/libva-utils" else SRC_URI="https://github.com/intel/libva-utils/archive/${PV}.tar.gz -> ${P}.tar.gz" - KEYWORDS="amd64 ~arm64 ~loong ppc64 ~riscv x86" + KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv x86" fi LICENSE="MIT" From a4ad08e7353a631d607b6d9a21605bffa0541055 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:13 -0400 Subject: [PATCH 04/11] app-arch/par2cmdline-turbo: Stabilize 1.4.0 arm64, #981477 Signed-off-by: Eli Schwartz --- app-arch/par2cmdline-turbo/par2cmdline-turbo-1.4.0.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app-arch/par2cmdline-turbo/par2cmdline-turbo-1.4.0.ebuild b/app-arch/par2cmdline-turbo/par2cmdline-turbo-1.4.0.ebuild index 535ff0493f0a2..1a565fe08d10a 100644 --- a/app-arch/par2cmdline-turbo/par2cmdline-turbo-1.4.0.ebuild +++ b/app-arch/par2cmdline-turbo/par2cmdline-turbo-1.4.0.ebuild @@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]]; then EGIT_REPO_URI="https://github.com/animetosho/par2cmdline-turbo" else SRC_URI="https://github.com/animetosho/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz" - KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86" + KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~x86" fi DESCRIPTION="par2cmdline × ParPar: speed focused par2cmdline fork" From 17b38ef467387f6a907879629d9b22c1b581d71b Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:15 -0400 Subject: [PATCH 05/11] media-gfx/feh: Stabilize 3.12.2 x86, #981500 Signed-off-by: Eli Schwartz --- media-gfx/feh/feh-3.12.2.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media-gfx/feh/feh-3.12.2.ebuild b/media-gfx/feh/feh-3.12.2.ebuild index ed2fb4314b2e4..205d1258a6a6c 100644 --- a/media-gfx/feh/feh-3.12.2.ebuild +++ b/media-gfx/feh/feh-3.12.2.ebuild @@ -10,7 +10,7 @@ SRC_URI="https://feh.finalrewind.org/${P}.tar.bz2" LICENSE="feh" SLOT="0" -KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv ~x86" +KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv x86" IUSE="debug curl exif magic test xinerama inotify" RESTRICT="test" # Tests are broken. From dec54526075d75af8ab6dcd8c59319ea4b6618f8 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:16 -0400 Subject: [PATCH 06/11] media-gfx/feh: Stabilize 3.12.2 amd64, #981500 Signed-off-by: Eli Schwartz --- media-gfx/feh/feh-3.12.2.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media-gfx/feh/feh-3.12.2.ebuild b/media-gfx/feh/feh-3.12.2.ebuild index 205d1258a6a6c..b782690e9cb9b 100644 --- a/media-gfx/feh/feh-3.12.2.ebuild +++ b/media-gfx/feh/feh-3.12.2.ebuild @@ -10,7 +10,7 @@ SRC_URI="https://feh.finalrewind.org/${P}.tar.bz2" LICENSE="feh" SLOT="0" -KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv x86" +KEYWORDS="amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv x86" IUSE="debug curl exif magic test xinerama inotify" RESTRICT="test" # Tests are broken. From 8788a78f43346434166cbf94bdf5c8d81465af4a Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:18 -0400 Subject: [PATCH 07/11] media-gfx/feh: Stabilize 3.12.2 ppc64, #981500 Signed-off-by: Eli Schwartz --- media-gfx/feh/feh-3.12.2.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media-gfx/feh/feh-3.12.2.ebuild b/media-gfx/feh/feh-3.12.2.ebuild index b782690e9cb9b..a04aa678a8641 100644 --- a/media-gfx/feh/feh-3.12.2.ebuild +++ b/media-gfx/feh/feh-3.12.2.ebuild @@ -10,7 +10,7 @@ SRC_URI="https://feh.finalrewind.org/${P}.tar.bz2" LICENSE="feh" SLOT="0" -KEYWORDS="amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv x86" +KEYWORDS="amd64 ~arm ~arm64 ~mips ~ppc ppc64 ~riscv x86" IUSE="debug curl exif magic test xinerama inotify" RESTRICT="test" # Tests are broken. From 338d9bef26b90fdf0fd878a5ef00f194b04f56e2 Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Thu, 27 Aug 2026 09:58:19 -0400 Subject: [PATCH 08/11] media-gfx/feh: Stabilize 3.12.2 ppc, #981500 Signed-off-by: Eli Schwartz --- media-gfx/feh/feh-3.12.2.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media-gfx/feh/feh-3.12.2.ebuild b/media-gfx/feh/feh-3.12.2.ebuild index a04aa678a8641..0d4b5efbfb179 100644 --- a/media-gfx/feh/feh-3.12.2.ebuild +++ b/media-gfx/feh/feh-3.12.2.ebuild @@ -10,7 +10,7 @@ SRC_URI="https://feh.finalrewind.org/${P}.tar.bz2" LICENSE="feh" SLOT="0" -KEYWORDS="amd64 ~arm ~arm64 ~mips ~ppc ppc64 ~riscv x86" +KEYWORDS="amd64 ~arm ~arm64 ~mips ppc ppc64 ~riscv x86" IUSE="debug curl exif magic test xinerama inotify" RESTRICT="test" # Tests are broken. From 4e88e222748c9bfc5ad3baad0fbf5646841e4a15 Mon Sep 17 00:00:00 2001 From: Patrick McLean Date: Thu, 27 Aug 2026 12:10:10 -0700 Subject: [PATCH 09/11] net-misc/pkixssh: add 19.1 Signed-off-by: Patrick McLean --- net-misc/pkixssh/Manifest | 1 + net-misc/pkixssh/pkixssh-19.1.ebuild | 371 +++++++++++++++++++++++++++ 2 files changed, 372 insertions(+) create mode 100644 net-misc/pkixssh/pkixssh-19.1.ebuild diff --git a/net-misc/pkixssh/Manifest b/net-misc/pkixssh/Manifest index c2dbe384d8716..b88dd0eb4ff00 100644 --- a/net-misc/pkixssh/Manifest +++ b/net-misc/pkixssh/Manifest @@ -6,3 +6,4 @@ DIST pkixssh-18.0.2.tar.xz 1286028 BLAKE2B f246e6278eac14ddd6c73f312bace228885e9 DIST pkixssh-18.0.3.tar.xz 1310136 BLAKE2B 22aad88cb974861ca89f09c9d123dafbb436403bc44d5f28b31f87e6ad492615d5238177604e6b44de8b47a386a741b71ae07e117370ae5c4018101de43ccee5 SHA512 3e0730ecdc8743a98c46096cc1727946cf219226b44b27186b2fc36ad92076a8d7d771f4aa1f10e6460b4be308de6dce0f57cac09a6d8d0cf24500dd913d3ddc DIST pkixssh-19.0.1.tar.xz 1331816 BLAKE2B 3f52244f8aec9c83a8efb468ef940d43666f699a197e9e4865c579362dd55efef014e01a725f3c5a9f7f58e73a3caaea849645fc00473bccefc28944a7e6780a SHA512 84dc0bc0173885881f61969d8a8516a13d947b0febf1d824f9ff4fdeb6daa32f3589f77843c2082f7e6d22b30619c59155082889d1bdbe4d62a10bd41df1d50d DIST pkixssh-19.0.tar.xz 1332456 BLAKE2B 756199adb90d0ecaa9ae5909533c7cbd14bb3731ca1868cd5dfcab3b78042b1aada36427abe155598fefd27b278876a1a532b4f99832558ba363f9af69fb07cd SHA512 52bc131f0f73a4d139aa9a15d78cf4e0ea6f85ba016ead9b6ed7971ce9537215eac8fb1cb3cb41019799c6118d77304886e6f990e5fcf357780a3019c78bbe2f +DIST pkixssh-19.1.tar.xz 1331108 BLAKE2B 8bf887b7ca9e166a8ed1e4cbab5a090ad285025feca9a0a7d09929303ceb31e7713db290f77f57e7aece127340e23cbd0a71a923d53e6de55a95aea7621015d6 SHA512 f1c755e7a9cf86016f36bc3adaaa07fe3341ee9e04d058c66249e847a67351c972422ac22d1c0c73b0a2be7ed65292434e317b45783b0f2e85283c1d0ea191a5 diff --git a/net-misc/pkixssh/pkixssh-19.1.ebuild b/net-misc/pkixssh/pkixssh-19.1.ebuild new file mode 100644 index 0000000000000..8ac846888b6d7 --- /dev/null +++ b/net-misc/pkixssh/pkixssh-19.1.ebuild @@ -0,0 +1,371 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +# not sure how to get the signing keys for this yet, but upstream provides a signature +inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver + +DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" +HOMEPAGE="https://roumenpetrov.info/secsh/" +SRC_URI=" + https://roumenpetrov.info/secsh/src/${P}.tar.xz +" +# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64" +IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam selinux +ssl-engine static test" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + static? ( !kerberos !pam ) + test? ( ssl-engine ) +" + +LIB_DEPEND=" + audit? ( sys-process/audit[static-libs(+)] ) + ldns? ( + net-libs/ldns[static-libs(+)] + net-libs/ldns[ecdsa(+),ssl(+)] + ) + libedit? ( dev-libs/libedit:=[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] + virtual/libcrypt:=[static-libs(+)] + >=virtual/zlib-1.2.3:=[static-libs(+)] +" +RDEPEND=" + acct-group/sshd + acct-user/sshd + !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + pam? ( sys-libs/pam ) + kerberos? ( virtual/krb5 ) + !net-misc/openssh + !net-misc/openssh-contrib +" +DEPEND=" + ${RDEPEND} + virtual/os-headers + kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) + static? ( ${LIB_DEPEND} ) +" +RDEPEND=" + ${RDEPEND} + !net-misc/openssh-contrib + pam? ( >=sys-auth/pambase-20081028 ) + !prefix? ( sys-apps/shadow ) +" +BDEPEND=" + dev-build/autoconf + virtual/pkgconfig +" +# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) + +PATCHES=( + "${FILESDIR}/pkixssh-17.0-no-rundir.patch" + "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" + # Backports from upstream release branch + #"${FILESDIR}/${PV}" + # Our own backports +) + +src_prepare() { + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) + + default + + # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox + sed -e '/\t\tpercent \\/ d' \ + -i regress/Makefile || die + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + + # _XOPEN_SOURCE causes header conflicts on Solaris + [[ ${CHOST} == *-solaris* ]] && sed_args+=( + -e 's/-D_XOPEN_SOURCE//' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + + use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG + use static && append-ldflags -static + + if [[ ${CHOST} == *-solaris* ]] ; then + # Solaris' glob.h doesn't have things like GLOB_TILDE, configure + # doesn't check for this, so force the replacement to be put in + # place + append-cppflags -DBROKEN_GLOB + fi + + # use replacement, RPF_ECHO_ON doesn't exist here + [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + # optional at runtime; guarantee a known path + --with-xauth="${EPREFIX}"/usr/bin/xauth + + # --with-hardening adds the following in addition to flags we + # already set in our toolchain: + # * -ftrapv (which is broken with GCC anyway), + # * -ftrivial-auto-var-init=zero (which is nice, but not the end of + # the world to not have) + # * -fzero-call-used-regs=used (history of miscompilations with + # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, + # gcc PR104820, gcc PR104817, gcc PR110934)). + # + # Furthermore, OSSH_CHECK_CFLAG_COMPILE did not use AC_CACHE_CHECK + # until 10.1_p1, so we couldn't disable -fzero-call-used-regs=used. + # + # Therefore, just pass --without-hardening, given it doesn't negate + # our already hardened toolchain defaults, and avoids adding flags + # which are known-broken in both Clang and GCC and haven't been + # proven reliable. + --without-hardening + --without-pie + --without-stackprotect + + # wtmpdb not yet packaged + --without-wtmpdb + + $(use_with audit audit linux) + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with selinux) + $(use_with ssl-engine ssl-engine) + ) + + if use elibc_musl; then + # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) + myconf+=( --disable-utmp --disable-wtmp ) + fi + + econf "${myconf[@]}" +} + +create_config_dropins() { + local locale_vars=( + # These are language variables that POSIX defines. + # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 + LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME + + # These are the GNU extensions. + # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html + LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE + ) + + mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die + # override default of no subsystems + Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server + EOF + + if use pam ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_compile() { + default + create_config_dropins +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will skip testing" + return 0 + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" /dev/null 2>&1; then + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" + systemctl try-restart sshd + eend $? + elif [[ -d /run/openrc ]]; then + # We don't check for sshd -t here because the OpenRC init script + # has a stop_pre() which does checkconfig, i.e. we defer to it + # to give nicer output for a failed sanity check. + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" + rc-service -q --ifstarted --nodeps sshd restart + eend $? + fi +} From 22b3f78397888cd473e704ecf1886b913ecc0a80 Mon Sep 17 00:00:00 2001 From: Patrick McLean Date: Thu, 27 Aug 2026 12:11:01 -0700 Subject: [PATCH 10/11] net-misc/pkixssh: drop 17.0, 17.1.1, 17.1.2, 18.0.2 Signed-off-by: Patrick McLean --- net-misc/pkixssh/Manifest | 4 - .../files/openssh-9.6_p1-fix-xmss-c99.patch | 20 - net-misc/pkixssh/pkixssh-17.0.ebuild | 378 ------------------ net-misc/pkixssh/pkixssh-17.1.1.ebuild | 377 ----------------- net-misc/pkixssh/pkixssh-17.1.2.ebuild | 377 ----------------- net-misc/pkixssh/pkixssh-18.0.2.ebuild | 373 ----------------- 6 files changed, 1529 deletions(-) delete mode 100644 net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch delete mode 100644 net-misc/pkixssh/pkixssh-17.0.ebuild delete mode 100644 net-misc/pkixssh/pkixssh-17.1.1.ebuild delete mode 100644 net-misc/pkixssh/pkixssh-17.1.2.ebuild delete mode 100644 net-misc/pkixssh/pkixssh-18.0.2.ebuild diff --git a/net-misc/pkixssh/Manifest b/net-misc/pkixssh/Manifest index b88dd0eb4ff00..0b1723c8ec231 100644 --- a/net-misc/pkixssh/Manifest +++ b/net-misc/pkixssh/Manifest @@ -1,8 +1,4 @@ -DIST pkixssh-17.0.tar.xz 1278364 BLAKE2B 3d960862f12de6f01cc31d405f86414887e67dfe20398b0694f0df9f206a1194ee00426279f903bdcccf0c104b3225feb6e74e812548c2a9b8e64b43a85b6c86 SHA512 a933ce926d8953e2848a7b1e81326c7dea2ddaf3569c026ef8bb58164d4a420f8e5d271c84ec65ebc3d306e6b59e421235823577f84c18a2252fa8be855b00ac -DIST pkixssh-17.1.1.tar.xz 1263532 BLAKE2B 1f115c2e55fe1d133054707b8b2876476ea9afafdc81437be1abc8d3e8a3c457a2c89058b35cbee49a8b8d79cb45e8df348eb307ae647eb2c0ecaec9867fa0db SHA512 1379a71a9156c28d667e0d8cf9e099c10c63d55fec71b566fbcada8bbad67559293070abe8bd6ecc66f9ab226400b18df076699b7f96ecf4e3e8e208e6bc381e -DIST pkixssh-17.1.2.tar.xz 1263688 BLAKE2B e76cc439649a1738bab593c6783a0cbeee33ec8d3b3ea6d07111deedcf0056bb7d6cab533c630949494aff934d6fabc2fd74365076a829f014e269b0f42d67bb SHA512 8bd7bc6276e561509944e0810307317a5c5e3b6a58ec61286799ba42e76d3a7970f72c6c0123253760cb45d859fa5d012c69c79b4ee8142d7207e4ee82eb3470 DIST pkixssh-17.2.2.tar.xz 1270064 BLAKE2B 8bf49085770fc9e08ff7c0170b71227e7db1e6de07d7bfecb1d8ad769e711bc31e41ff649f591ce5d673aef1c5ac1b03c8661acfecf99672de6961f1d48cb182 SHA512 9d0e66dbf9748477e76dd59281880f2142304dedb3d90dbc02df06bacdd509cd127b1b7bd0e98ffe6ff47121a5d63870c6e738bf430ec87539e5d5c1705fa388 -DIST pkixssh-18.0.2.tar.xz 1286028 BLAKE2B f246e6278eac14ddd6c73f312bace228885e9da4de2fda5e3b005fd4a5049ac545d5d27104a1be34ca4a79a022983eb0467ce721df18e18a2a167d1892ad9c15 SHA512 d1b28da6adc7e9cdacaa983bfbfce5c6214e29a0027b57a1ec0932eba4a4e6f052e52cd7fd04df9a2c819df3c538d7770bce26b4ba69b92f924cbef11fff0e8c DIST pkixssh-18.0.3.tar.xz 1310136 BLAKE2B 22aad88cb974861ca89f09c9d123dafbb436403bc44d5f28b31f87e6ad492615d5238177604e6b44de8b47a386a741b71ae07e117370ae5c4018101de43ccee5 SHA512 3e0730ecdc8743a98c46096cc1727946cf219226b44b27186b2fc36ad92076a8d7d771f4aa1f10e6460b4be308de6dce0f57cac09a6d8d0cf24500dd913d3ddc DIST pkixssh-19.0.1.tar.xz 1331816 BLAKE2B 3f52244f8aec9c83a8efb468ef940d43666f699a197e9e4865c579362dd55efef014e01a725f3c5a9f7f58e73a3caaea849645fc00473bccefc28944a7e6780a SHA512 84dc0bc0173885881f61969d8a8516a13d947b0febf1d824f9ff4fdeb6daa32f3589f77843c2082f7e6d22b30619c59155082889d1bdbe4d62a10bd41df1d50d DIST pkixssh-19.0.tar.xz 1332456 BLAKE2B 756199adb90d0ecaa9ae5909533c7cbd14bb3731ca1868cd5dfcab3b78042b1aada36427abe155598fefd27b278876a1a532b4f99832558ba363f9af69fb07cd SHA512 52bc131f0f73a4d139aa9a15d78cf4e0ea6f85ba016ead9b6ed7971ce9537215eac8fb1cb3cb41019799c6118d77304886e6f990e5fcf357780a3019c78bbe2f diff --git a/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch b/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch deleted file mode 100644 index cf06b80cd5fa4..0000000000000 --- a/net-misc/pkixssh/files/openssh-9.6_p1-fix-xmss-c99.patch +++ /dev/null @@ -1,20 +0,0 @@ -xmss_hash.c: In function ‘core_hash_SHA2’: -xmss_hash.c:56:5: error: implicit declaration of function ‘SHA256’ [-Wimplicit-function-declaration] - 56 | SHA256(buf, inlen + keylen + n, out); - | ^~~~~~ -xmss_hash.c:61:7: error: implicit declaration of function ‘SHA512’ [-Wimplicit-function-declaration] - 61 | SHA512(buf, inlen + keylen + n, out); - | ^~~~~~ - -diff --git a/xmss_hash.c b/xmss_hash.c -index 70c126ae2..cb17de2af 100644 ---- a/xmss_hash.c -+++ b/xmss_hash.c -@@ -12,6 +12,7 @@ Public domain. - #include "xmss_hash_address.h" - #include "xmss_commons.h" - #include "xmss_hash.h" -+#include - - #include - #ifdef HAVE_STDINT_H diff --git a/net-misc/pkixssh/pkixssh-17.0.ebuild b/net-misc/pkixssh/pkixssh-17.0.ebuild deleted file mode 100644 index 82592fda85bb1..0000000000000 --- a/net-misc/pkixssh/pkixssh-17.0.ebuild +++ /dev/null @@ -1,378 +0,0 @@ -# Copyright 1999-2025 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -# not sure how to get the signing keys for this yet, but upstream provides a signature -#VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pkixssh.org.asc -#inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver -inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver - -DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" -HOMEPAGE="https://roumenpetrov.info/secsh/" -SRC_URI=" - https://roumenpetrov.info/secsh/src/${P}.tar.xz -" -# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="~amd64" -IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie selinux +ssl-engine static test xmss" - -RESTRICT="!test? ( test )" - -REQUIRED_USE=" - pie? ( !static ) - static? ( !kerberos !pam ) - test? ( ssl-engine ) -" - -# tests currently fail with XMSS -REQUIRED_USE+="test? ( !xmss )" - -LIB_DEPEND=" - audit? ( sys-process/audit[static-libs(+)] ) - ldns? ( - net-libs/ldns[static-libs(+)] - net-libs/ldns[ecdsa(+),ssl(+)] - ) - libedit? ( dev-libs/libedit:=[static-libs(+)] ) - selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) - >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] - virtual/libcrypt:=[static-libs(+)] - >=virtual/zlib-1.2.3:=[static-libs(+)] -" -RDEPEND=" - acct-group/sshd - acct-user/sshd - !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) - pam? ( sys-libs/pam ) - kerberos? ( virtual/krb5 ) - !net-misc/openssh - !net-misc/openssh-contrib -" -DEPEND=" - ${RDEPEND} - virtual/os-headers - kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) - static? ( ${LIB_DEPEND} ) -" -RDEPEND=" - ${RDEPEND} - !net-misc/openssh-contrib - pam? ( >=sys-auth/pambase-20081028 ) - !prefix? ( sys-apps/shadow ) -" -BDEPEND=" - dev-build/autoconf - virtual/pkgconfig -" -# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) - -PATCHES=( - "${FILESDIR}/pkixssh-17.0-no-rundir.patch" - "${FILESDIR}/openssh-9.6_p1-fix-xmss-c99.patch" - "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" - # Backports from upstream release branch - #"${FILESDIR}/${PV}" - # Our own backports -) - -src_prepare() { - # don't break .ssh/authorized_keys2 for fun - sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die - - [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) - - default - - # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox - sed -e '/\t\tpercent \\/ d' \ - -i regress/Makefile || die - - tc-export PKG_CONFIG - local sed_args=( - -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" - # Disable fortify flags ... our gcc does this for us - -e 's:-D_FORTIFY_SOURCE=2::' - ) - - # _XOPEN_SOURCE causes header conflicts on Solaris - [[ ${CHOST} == *-solaris* ]] && sed_args+=( - -e 's/-D_XOPEN_SOURCE//' - ) - sed -i "${sed_args[@]}" configure{.ac,} || die - - eautoreconf -} - -src_configure() { - addwrite /dev/ptmx - - use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG - use static && append-ldflags -static - use xmss && append-cflags -DWITH_XMSS - - if [[ ${CHOST} == *-solaris* ]] ; then - # Solaris' glob.h doesn't have things like GLOB_TILDE, configure - # doesn't check for this, so force the replacement to be put in - # place - append-cppflags -DBROKEN_GLOB - fi - - # use replacement, RPF_ECHO_ON doesn't exist here - [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no - - local myconf=( - --with-ldflags="${LDFLAGS}" - --disable-strip - --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run - --sysconfdir="${EPREFIX}"/etc/ssh - --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc - --datadir="${EPREFIX}"/usr/share/openssh - --with-privsep-path="${EPREFIX}"/var/empty - --with-privsep-user=sshd - # optional at runtime; guarantee a known path - --with-xauth="${EPREFIX}"/usr/bin/xauth - - # --with-hardening adds the following in addition to flags we - # already set in our toolchain: - # * -ftrapv (which is broken with GCC anyway), - # * -ftrivial-auto-var-init=zero (which is nice, but not the end of - # the world to not have) - # * -fzero-call-used-regs=used (history of miscompilations with - # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, - # gcc PR104820, gcc PR104817, gcc PR110934)). - # - # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK, - # so we cannot just disable -fzero-call-used-regs=used. - # - # Therefore, just pass --without-hardening, given it doesn't negate - # our already hardened toolchain defaults, and avoids adding flags - # which are known-broken in both Clang and GCC and haven't been - # proven reliable. - --without-hardening - - # wtmpdb not yet packaged - --without-wtmpdb - - $(use_with audit audit linux) - $(use_with kerberos kerberos5 "${EPREFIX}"/usr) - $(use_with ldns) - $(use_with libedit) - $(use_with pam) - $(use_with pie) - $(use_with selinux) - $(use_with ssl-engine ssl-engine) - ) - - if use elibc_musl; then - # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) - myconf+=( --disable-utmp --disable-wtmp ) - fi - - econf "${myconf[@]}" -} - -create_config_dropins() { - local locale_vars=( - # These are language variables that POSIX defines. - # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 - LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME - - # These are the GNU extensions. - # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html - LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE - ) - - mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die - # Send locale environment variables (bug #367017) - SendEnv ${locale_vars[*]} - - # Send COLORTERM to match TERM (bug #658540) - SendEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die - RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die - # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die - # Allow client to pass locale environment variables (bug #367017) - AcceptEnv ${locale_vars[*]} - - # Allow client to pass COLORTERM to match TERM (bug #658540) - AcceptEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die - # override default of no subsystems - Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server - EOF - - if use pam ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die - UsePAM yes - # This interferes with PAM. - PasswordAuthentication no - # PAM can do its own handling of MOTD. - PrintMotd no - PrintLastLog no - EOF - fi - - if use livecd ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die - # Allow root login with password on livecds. - PermitRootLogin Yes - EOF - fi -} - -src_compile() { - default - create_config_dropins -} - -src_test() { - local tests=( compat-tests ) - local shell=$(egetshell "${UID}") - if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then - ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" - ewarn "user, so we will skip testing" - return 0 - else - tests+=( tests ) - fi - - local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 - mkdir -p "${HOME}"/.ssh || die - emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" /dev/null 2>&1; then - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" - systemctl try-restart sshd - eend $? - elif [[ -d /run/openrc ]]; then - # We don't check for sshd -t here because the OpenRC init script - # has a stop_pre() which does checkconfig, i.e. we defer to it - # to give nicer output for a failed sanity check. - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" - rc-service -q --ifstarted --nodeps sshd restart - eend $? - fi -} diff --git a/net-misc/pkixssh/pkixssh-17.1.1.ebuild b/net-misc/pkixssh/pkixssh-17.1.1.ebuild deleted file mode 100644 index 8a9b6ec2e3b47..0000000000000 --- a/net-misc/pkixssh/pkixssh-17.1.1.ebuild +++ /dev/null @@ -1,377 +0,0 @@ -# Copyright 1999-2025 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -# not sure how to get the signing keys for this yet, but upstream provides a signature -#VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pkixssh.org.asc -#inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver -inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver - -DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" -HOMEPAGE="https://roumenpetrov.info/secsh/" -SRC_URI=" - https://roumenpetrov.info/secsh/src/${P}.tar.xz -" -# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="~amd64" -IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie selinux +ssl-engine static test xmss" - -RESTRICT="!test? ( test )" - -REQUIRED_USE=" - pie? ( !static ) - static? ( !kerberos !pam ) - test? ( ssl-engine ) -" - -# tests currently fail with XMSS -REQUIRED_USE+="test? ( !xmss )" - -LIB_DEPEND=" - audit? ( sys-process/audit[static-libs(+)] ) - ldns? ( - net-libs/ldns[static-libs(+)] - net-libs/ldns[ecdsa(+),ssl(+)] - ) - libedit? ( dev-libs/libedit:=[static-libs(+)] ) - selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) - >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] - virtual/libcrypt:=[static-libs(+)] - >=virtual/zlib-1.2.3:=[static-libs(+)] -" -RDEPEND=" - acct-group/sshd - acct-user/sshd - !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) - pam? ( sys-libs/pam ) - kerberos? ( virtual/krb5 ) - !net-misc/openssh - !net-misc/openssh-contrib -" -DEPEND=" - ${RDEPEND} - virtual/os-headers - kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) - static? ( ${LIB_DEPEND} ) -" -RDEPEND=" - ${RDEPEND} - !net-misc/openssh-contrib - pam? ( >=sys-auth/pambase-20081028 ) - !prefix? ( sys-apps/shadow ) -" -BDEPEND=" - dev-build/autoconf - virtual/pkgconfig -" -# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) - -PATCHES=( - "${FILESDIR}/pkixssh-17.0-no-rundir.patch" - "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" - # Backports from upstream release branch - #"${FILESDIR}/${PV}" - # Our own backports -) - -src_prepare() { - # don't break .ssh/authorized_keys2 for fun - sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die - - [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) - - default - - # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox - sed -e '/\t\tpercent \\/ d' \ - -i regress/Makefile || die - - tc-export PKG_CONFIG - local sed_args=( - -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" - # Disable fortify flags ... our gcc does this for us - -e 's:-D_FORTIFY_SOURCE=2::' - ) - - # _XOPEN_SOURCE causes header conflicts on Solaris - [[ ${CHOST} == *-solaris* ]] && sed_args+=( - -e 's/-D_XOPEN_SOURCE//' - ) - sed -i "${sed_args[@]}" configure{.ac,} || die - - eautoreconf -} - -src_configure() { - addwrite /dev/ptmx - - use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG - use static && append-ldflags -static - use xmss && append-cflags -DWITH_XMSS - - if [[ ${CHOST} == *-solaris* ]] ; then - # Solaris' glob.h doesn't have things like GLOB_TILDE, configure - # doesn't check for this, so force the replacement to be put in - # place - append-cppflags -DBROKEN_GLOB - fi - - # use replacement, RPF_ECHO_ON doesn't exist here - [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no - - local myconf=( - --with-ldflags="${LDFLAGS}" - --disable-strip - --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run - --sysconfdir="${EPREFIX}"/etc/ssh - --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc - --datadir="${EPREFIX}"/usr/share/openssh - --with-privsep-path="${EPREFIX}"/var/empty - --with-privsep-user=sshd - # optional at runtime; guarantee a known path - --with-xauth="${EPREFIX}"/usr/bin/xauth - - # --with-hardening adds the following in addition to flags we - # already set in our toolchain: - # * -ftrapv (which is broken with GCC anyway), - # * -ftrivial-auto-var-init=zero (which is nice, but not the end of - # the world to not have) - # * -fzero-call-used-regs=used (history of miscompilations with - # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, - # gcc PR104820, gcc PR104817, gcc PR110934)). - # - # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK - # util 17.1, so we cannot just disable -fzero-call-used-regs=used. - # - # Therefore, just pass --without-hardening, given it doesn't negate - # our already hardened toolchain defaults, and avoids adding flags - # which are known-broken in both Clang and GCC and haven't been - # proven reliable. - --without-hardening - - # wtmpdb not yet packaged - --without-wtmpdb - - $(use_with audit audit linux) - $(use_with kerberos kerberos5 "${EPREFIX}"/usr) - $(use_with ldns) - $(use_with libedit) - $(use_with pam) - $(use_with pie) - $(use_with selinux) - $(use_with ssl-engine ssl-engine) - ) - - if use elibc_musl; then - # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) - myconf+=( --disable-utmp --disable-wtmp ) - fi - - econf "${myconf[@]}" -} - -create_config_dropins() { - local locale_vars=( - # These are language variables that POSIX defines. - # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 - LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME - - # These are the GNU extensions. - # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html - LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE - ) - - mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die - # Send locale environment variables (bug #367017) - SendEnv ${locale_vars[*]} - - # Send COLORTERM to match TERM (bug #658540) - SendEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die - RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die - # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die - # Allow client to pass locale environment variables (bug #367017) - AcceptEnv ${locale_vars[*]} - - # Allow client to pass COLORTERM to match TERM (bug #658540) - AcceptEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die - # override default of no subsystems - Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server - EOF - - if use pam ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die - UsePAM yes - # This interferes with PAM. - PasswordAuthentication no - # PAM can do its own handling of MOTD. - PrintMotd no - PrintLastLog no - EOF - fi - - if use livecd ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die - # Allow root login with password on livecds. - PermitRootLogin Yes - EOF - fi -} - -src_compile() { - default - create_config_dropins -} - -src_test() { - local tests=( compat-tests ) - local shell=$(egetshell "${UID}") - if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then - ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" - ewarn "user, so we will skip testing" - return 0 - else - tests+=( tests ) - fi - - local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 - mkdir -p "${HOME}"/.ssh || die - emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" /dev/null 2>&1; then - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" - systemctl try-restart sshd - eend $? - elif [[ -d /run/openrc ]]; then - # We don't check for sshd -t here because the OpenRC init script - # has a stop_pre() which does checkconfig, i.e. we defer to it - # to give nicer output for a failed sanity check. - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" - rc-service -q --ifstarted --nodeps sshd restart - eend $? - fi -} diff --git a/net-misc/pkixssh/pkixssh-17.1.2.ebuild b/net-misc/pkixssh/pkixssh-17.1.2.ebuild deleted file mode 100644 index 8a9b6ec2e3b47..0000000000000 --- a/net-misc/pkixssh/pkixssh-17.1.2.ebuild +++ /dev/null @@ -1,377 +0,0 @@ -# Copyright 1999-2025 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -# not sure how to get the signing keys for this yet, but upstream provides a signature -#VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pkixssh.org.asc -#inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver -inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver - -DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" -HOMEPAGE="https://roumenpetrov.info/secsh/" -SRC_URI=" - https://roumenpetrov.info/secsh/src/${P}.tar.xz -" -# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="~amd64" -IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie selinux +ssl-engine static test xmss" - -RESTRICT="!test? ( test )" - -REQUIRED_USE=" - pie? ( !static ) - static? ( !kerberos !pam ) - test? ( ssl-engine ) -" - -# tests currently fail with XMSS -REQUIRED_USE+="test? ( !xmss )" - -LIB_DEPEND=" - audit? ( sys-process/audit[static-libs(+)] ) - ldns? ( - net-libs/ldns[static-libs(+)] - net-libs/ldns[ecdsa(+),ssl(+)] - ) - libedit? ( dev-libs/libedit:=[static-libs(+)] ) - selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) - >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] - virtual/libcrypt:=[static-libs(+)] - >=virtual/zlib-1.2.3:=[static-libs(+)] -" -RDEPEND=" - acct-group/sshd - acct-user/sshd - !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) - pam? ( sys-libs/pam ) - kerberos? ( virtual/krb5 ) - !net-misc/openssh - !net-misc/openssh-contrib -" -DEPEND=" - ${RDEPEND} - virtual/os-headers - kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) - static? ( ${LIB_DEPEND} ) -" -RDEPEND=" - ${RDEPEND} - !net-misc/openssh-contrib - pam? ( >=sys-auth/pambase-20081028 ) - !prefix? ( sys-apps/shadow ) -" -BDEPEND=" - dev-build/autoconf - virtual/pkgconfig -" -# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) - -PATCHES=( - "${FILESDIR}/pkixssh-17.0-no-rundir.patch" - "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" - # Backports from upstream release branch - #"${FILESDIR}/${PV}" - # Our own backports -) - -src_prepare() { - # don't break .ssh/authorized_keys2 for fun - sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die - - [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) - - default - - # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox - sed -e '/\t\tpercent \\/ d' \ - -i regress/Makefile || die - - tc-export PKG_CONFIG - local sed_args=( - -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" - # Disable fortify flags ... our gcc does this for us - -e 's:-D_FORTIFY_SOURCE=2::' - ) - - # _XOPEN_SOURCE causes header conflicts on Solaris - [[ ${CHOST} == *-solaris* ]] && sed_args+=( - -e 's/-D_XOPEN_SOURCE//' - ) - sed -i "${sed_args[@]}" configure{.ac,} || die - - eautoreconf -} - -src_configure() { - addwrite /dev/ptmx - - use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG - use static && append-ldflags -static - use xmss && append-cflags -DWITH_XMSS - - if [[ ${CHOST} == *-solaris* ]] ; then - # Solaris' glob.h doesn't have things like GLOB_TILDE, configure - # doesn't check for this, so force the replacement to be put in - # place - append-cppflags -DBROKEN_GLOB - fi - - # use replacement, RPF_ECHO_ON doesn't exist here - [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no - - local myconf=( - --with-ldflags="${LDFLAGS}" - --disable-strip - --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run - --sysconfdir="${EPREFIX}"/etc/ssh - --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc - --datadir="${EPREFIX}"/usr/share/openssh - --with-privsep-path="${EPREFIX}"/var/empty - --with-privsep-user=sshd - # optional at runtime; guarantee a known path - --with-xauth="${EPREFIX}"/usr/bin/xauth - - # --with-hardening adds the following in addition to flags we - # already set in our toolchain: - # * -ftrapv (which is broken with GCC anyway), - # * -ftrivial-auto-var-init=zero (which is nice, but not the end of - # the world to not have) - # * -fzero-call-used-regs=used (history of miscompilations with - # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, - # gcc PR104820, gcc PR104817, gcc PR110934)). - # - # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK - # util 17.1, so we cannot just disable -fzero-call-used-regs=used. - # - # Therefore, just pass --without-hardening, given it doesn't negate - # our already hardened toolchain defaults, and avoids adding flags - # which are known-broken in both Clang and GCC and haven't been - # proven reliable. - --without-hardening - - # wtmpdb not yet packaged - --without-wtmpdb - - $(use_with audit audit linux) - $(use_with kerberos kerberos5 "${EPREFIX}"/usr) - $(use_with ldns) - $(use_with libedit) - $(use_with pam) - $(use_with pie) - $(use_with selinux) - $(use_with ssl-engine ssl-engine) - ) - - if use elibc_musl; then - # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) - myconf+=( --disable-utmp --disable-wtmp ) - fi - - econf "${myconf[@]}" -} - -create_config_dropins() { - local locale_vars=( - # These are language variables that POSIX defines. - # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 - LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME - - # These are the GNU extensions. - # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html - LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE - ) - - mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die - # Send locale environment variables (bug #367017) - SendEnv ${locale_vars[*]} - - # Send COLORTERM to match TERM (bug #658540) - SendEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die - RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die - # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die - # Allow client to pass locale environment variables (bug #367017) - AcceptEnv ${locale_vars[*]} - - # Allow client to pass COLORTERM to match TERM (bug #658540) - AcceptEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die - # override default of no subsystems - Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server - EOF - - if use pam ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die - UsePAM yes - # This interferes with PAM. - PasswordAuthentication no - # PAM can do its own handling of MOTD. - PrintMotd no - PrintLastLog no - EOF - fi - - if use livecd ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die - # Allow root login with password on livecds. - PermitRootLogin Yes - EOF - fi -} - -src_compile() { - default - create_config_dropins -} - -src_test() { - local tests=( compat-tests ) - local shell=$(egetshell "${UID}") - if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then - ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" - ewarn "user, so we will skip testing" - return 0 - else - tests+=( tests ) - fi - - local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 - mkdir -p "${HOME}"/.ssh || die - emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" /dev/null 2>&1; then - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" - systemctl try-restart sshd - eend $? - elif [[ -d /run/openrc ]]; then - # We don't check for sshd -t here because the OpenRC init script - # has a stop_pre() which does checkconfig, i.e. we defer to it - # to give nicer output for a failed sanity check. - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" - rc-service -q --ifstarted --nodeps sshd restart - eend $? - fi -} diff --git a/net-misc/pkixssh/pkixssh-18.0.2.ebuild b/net-misc/pkixssh/pkixssh-18.0.2.ebuild deleted file mode 100644 index e61b191170cc1..0000000000000 --- a/net-misc/pkixssh/pkixssh-18.0.2.ebuild +++ /dev/null @@ -1,373 +0,0 @@ -# Copyright 1999-2026 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -# not sure how to get the signing keys for this yet, but upstream provides a signature -#VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pkixssh.org.asc -#inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver -inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs eapi9-ver - -DESCRIPTION="OpenSSH fork with X.509 v3 certificate support" -HOMEPAGE="https://roumenpetrov.info/secsh/" -SRC_URI=" - https://roumenpetrov.info/secsh/src/${P}.tar.xz -" -# verify-sig? ( https://roumenpetrov.info/secsh/src/${P}.tar.sig ) - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="~amd64" -IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam selinux +ssl-engine static test" - -RESTRICT="!test? ( test )" - -REQUIRED_USE=" - static? ( !kerberos !pam ) - test? ( ssl-engine ) -" - -LIB_DEPEND=" - audit? ( sys-process/audit[static-libs(+)] ) - ldns? ( - net-libs/ldns[static-libs(+)] - net-libs/ldns[ecdsa(+),ssl(+)] - ) - libedit? ( dev-libs/libedit:=[static-libs(+)] ) - selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) - >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] - virtual/libcrypt:=[static-libs(+)] - >=virtual/zlib-1.2.3:=[static-libs(+)] -" -RDEPEND=" - acct-group/sshd - acct-user/sshd - !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) - pam? ( sys-libs/pam ) - kerberos? ( virtual/krb5 ) - !net-misc/openssh - !net-misc/openssh-contrib -" -DEPEND=" - ${RDEPEND} - virtual/os-headers - kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) - static? ( ${LIB_DEPEND} ) -" -RDEPEND=" - ${RDEPEND} - !net-misc/openssh-contrib - pam? ( >=sys-auth/pambase-20081028 ) - !prefix? ( sys-apps/shadow ) -" -BDEPEND=" - dev-build/autoconf - virtual/pkgconfig -" -# verify-sig? ( sec-keys/openpgp-keys-pkixssh ) - -PATCHES=( - "${FILESDIR}/pkixssh-17.0-no-rundir.patch" - "${FILESDIR}/openssh-9.7_p1-config-tweaks.patch" - # Backports from upstream release branch - #"${FILESDIR}/${PV}" - # Our own backports -) - -src_prepare() { - # don't break .ssh/authorized_keys2 for fun - sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die - - [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) - - default - - # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox - sed -e '/\t\tpercent \\/ d' \ - -i regress/Makefile || die - - tc-export PKG_CONFIG - local sed_args=( - -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" - # Disable fortify flags ... our gcc does this for us - -e 's:-D_FORTIFY_SOURCE=2::' - ) - - # _XOPEN_SOURCE causes header conflicts on Solaris - [[ ${CHOST} == *-solaris* ]] && sed_args+=( - -e 's/-D_XOPEN_SOURCE//' - ) - sed -i "${sed_args[@]}" configure{.ac,} || die - - eautoreconf -} - -src_configure() { - addwrite /dev/ptmx - - use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG - use static && append-ldflags -static - - if [[ ${CHOST} == *-solaris* ]] ; then - # Solaris' glob.h doesn't have things like GLOB_TILDE, configure - # doesn't check for this, so force the replacement to be put in - # place - append-cppflags -DBROKEN_GLOB - fi - - # use replacement, RPF_ECHO_ON doesn't exist here - [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no - - local myconf=( - --with-ldflags="${LDFLAGS}" - --disable-strip - --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run - --sysconfdir="${EPREFIX}"/etc/ssh - --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc - --datadir="${EPREFIX}"/usr/share/openssh - --with-privsep-path="${EPREFIX}"/var/empty - --with-privsep-user=sshd - # optional at runtime; guarantee a known path - --with-xauth="${EPREFIX}"/usr/bin/xauth - - # --with-hardening adds the following in addition to flags we - # already set in our toolchain: - # * -ftrapv (which is broken with GCC anyway), - # * -ftrivial-auto-var-init=zero (which is nice, but not the end of - # the world to not have) - # * -fzero-call-used-regs=used (history of miscompilations with - # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, - # gcc PR104820, gcc PR104817, gcc PR110934)). - # - # Furthermore, OSSH_CHECK_CFLAG_COMPILE did not use AC_CACHE_CHECK - # until 10.1_p1, so we couldn't disable -fzero-call-used-regs=used. - # - # Therefore, just pass --without-hardening, given it doesn't negate - # our already hardened toolchain defaults, and avoids adding flags - # which are known-broken in both Clang and GCC and haven't been - # proven reliable. - --without-hardening - --without-pie - --without-stackprotect - - # wtmpdb not yet packaged - --without-wtmpdb - - $(use_with audit audit linux) - $(use_with kerberos kerberos5 "${EPREFIX}"/usr) - $(use_with ldns) - $(use_with libedit) - $(use_with pam) - $(use_with selinux) - $(use_with ssl-engine ssl-engine) - ) - - if use elibc_musl; then - # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) - myconf+=( --disable-utmp --disable-wtmp ) - fi - - econf "${myconf[@]}" -} - -create_config_dropins() { - local locale_vars=( - # These are language variables that POSIX defines. - # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 - LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME - - # These are the GNU extensions. - # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html - LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE - ) - - mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die - # Send locale environment variables (bug #367017) - SendEnv ${locale_vars[*]} - - # Send COLORTERM to match TERM (bug #658540) - SendEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die - RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die - # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die - # Allow client to pass locale environment variables (bug #367017) - AcceptEnv ${locale_vars[*]} - - # Allow client to pass COLORTERM to match TERM (bug #658540) - AcceptEnv COLORTERM - EOF - - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die - # override default of no subsystems - Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server - EOF - - if use pam ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die - UsePAM yes - # This interferes with PAM. - PasswordAuthentication no - # PAM can do its own handling of MOTD. - PrintMotd no - PrintLastLog no - EOF - fi - - if use livecd ; then - cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die - # Allow root login with password on livecds. - PermitRootLogin Yes - EOF - fi -} - -src_compile() { - default - create_config_dropins -} - -src_test() { - local tests=( compat-tests ) - local shell=$(egetshell "${UID}") - if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then - ewarn "Running the pkixssh testsuite requires a usable shell for the 'portage'" - ewarn "user, so we will skip testing" - return 0 - else - tests+=( tests ) - fi - - local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 - mkdir -p "${HOME}"/.ssh || die - emake -j1 TEST_SHELL=/bin/bash "${tests[@]}" /dev/null 2>&1; then - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" - systemctl try-restart sshd - eend $? - elif [[ -d /run/openrc ]]; then - # We don't check for sshd -t here because the OpenRC init script - # has a stop_pre() which does checkconfig, i.e. we defer to it - # to give nicer output for a failed sanity check. - ewarn "The ebuild will now attempt to restart OpenSSH to avoid" - ewarn "bricking the running instance. See bug #709748." - ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" - rc-service -q --ifstarted --nodeps sshd restart - eend $? - fi -} From d57048d45f221a675c23dd3bfaae15367c0d435e Mon Sep 17 00:00:00 2001 From: Patrick McLean Date: Thu, 27 Aug 2026 12:11:42 -0700 Subject: [PATCH 11/11] net-misc/pkixssh: Drop xmss USE flag from metadata.xml Signed-off-by: Patrick McLean --- net-misc/pkixssh/metadata.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/net-misc/pkixssh/metadata.xml b/net-misc/pkixssh/metadata.xml index 96a22d0ca35bc..73f928de26bf9 100644 --- a/net-misc/pkixssh/metadata.xml +++ b/net-misc/pkixssh/metadata.xml @@ -8,7 +8,6 @@ Use LDNS for DNSSEC/SSHFP validation. Enable OpenSSL (hardware) ENGINE support - Enable XMSS post-quantum authentication algorithm secsh/pkixssh