commit: 6e98df030b16a3f80b8d257634ceb766649fd26f
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 8 15:36:54 2015 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Sun Nov 8 15:36:54 2015 +0000
URL: https://gitweb.gentoo.org/repo/proj/prefix.git/commit/?id=6e98df03
net-misc/openssh: sync latest version with gx86
Package-Manager: portage-2.2.20-prefix
net-misc/openssh/Manifest | 3 +
net-misc/openssh/openssh-6.9_p1-r2.ebuild | 45 ++++++------
...h-6.9_p1-r2.ebuild => openssh-7.1_p1-r2.ebuild} | 85 ++++++++++++----------
3 files changed, 71 insertions(+), 62 deletions(-)
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 6e58d60..e85eac1 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -6,4 +6,7 @@ DIST openssh-6.8p1.tar.gz 1475953 SHA256
3ff64ce73ee124480b5bf767b9830d7d3c03bbc
DIST openssh-6.9p1+x509-8.4.diff.gz 425687 SHA256
0ed8bfff0d2ecd9f3791ae1f168ca3270bb66d7ab7bc0a8ff2d61d2ab829c3fb SHA512
596cb65408db06fb299b92160147685b001dc23929ecf5c4bd11a8b0475d79695c7b4dbe8a878d7fbcd944155935fd62a14e35c79204b39e413f5eaa961ef76c
WHIRLPOOL
771fa0f4f6a20ed49ba201605fcdcbfc41a0f094ef4a89ca2433ee51b7c8bf99cc266f26bd7877c61ff92e9a50c7d65119ba75ba64eaa029bd567bab3ee243c2
DIST openssh-6.9p1-r1-hpnssh14v5.tar.xz 21396 SHA256
84e9e28a1488ccf66e29a7c90442b3bc4833a6fa186260fb6853b5a1b19c0beb SHA512
476064dbdb3d82b86ad7c481a4a301ff0d46bd281fe7ca0c29f34ae50b0034028760997ae2c934a265499c154f4534d35ead647aa63d1a4545ed503a5364eada
WHIRLPOOL
74eaf2fe0a6ecd0e2fa5078034628d4c76c75b121f3c813ff8a098ab28363daa3800d03936046aa3aebbfdab3afd31ef30a207399f5e305d7f71e5f3c7e4f4a7
DIST openssh-6.9p1.tar.gz 1487617 SHA256
6e074df538f357d440be6cf93dc581a21f22d39e236f217fcd8eacbb6c896cfe SHA512
68fec9b4e512fe126a5d35b01e2cc656d810b75052ed8a36bc85cd0a05de7318b15ed287bc95cf9bcb3fa2f385029151d85aced55e07fbcc79e6c779bee6751d
WHIRLPOOL
1dcb291383c9f934b512f61ce9f6e0319f22e112ce3f6eace2a868ca0f99c709c65bae14a9815e2ef237f8132fe72c583cffb7ea20bdfa2aaa77cf347967be7f
+DIST openssh-7.1p1+x509-8.6.diff.gz 413931 SHA256
cbf661a1fec080dc9ed335a290414154326c2a13f124985db050b86a91073d52 SHA512
c91d0f1b69b6d34984e94b391ad022271e73d0634cef2df355ba555366bc38d30649b478f245b6c51ce79d71adf1b693bc97826e6c6013a78e7ccfb7023b4bcc
WHIRLPOOL
4ed4427e80026996c43a188d7d45f2c53fa6a7fd842a248b1225b27f3e9037e761f0ed172d79b53ada81c24d958a2193e94d918f6ca1320e45d5e68379845981
+DIST openssh-7.1p1-hpnssh14v9.tar.xz 21580 SHA256
a795c2f2621f537b3fd98172cbd1f7c71869e4da78cd280d123fa19ae4262b97 SHA512
6ce151949bf81b5518b95092a2f18d2f24581954e2c629deaf3c1d10136f32f830567aafb9b4045547e95e3ab63cf750e240eac40e2b9caa6d71cb2b132821ec
WHIRLPOOL
8e3c9a1d79112092a6cb42c6766ccdf61e5d8fcd366ea5c7d3bab94cf309bcc12f3761476a288158638a340023aa24519d888caac19fb0ef25fa56bdab06412c
+DIST openssh-7.1p1.tar.gz 1493170 SHA256
fc0a6d2d1d063d5c66dffd952493d0cda256cad204f681de0f84ef85b2ad8428 SHA512
f1491ca5a0a733eb27ede966590642a412cb7be7178dcb7b9e5844bbdc8383032f4b00435192b95fc0365b6fe74d6c5ac8d6facbe9d51e1532d049e2f784e8f7
WHIRLPOOL
a650a93657f930d20dc3fa24ab720857f63f7cd0a82d1906cf1e58145e866129207851d5e587d678655e5731fa73221ab9b6ea0754533100c25fe2acaa442e05
DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256
d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512
2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081
WHIRLPOOL
b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
index 628a85d..2cbcfa5 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-6.9_p1-r2.ebuild
@@ -1,6 +1,6 @@
# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-6.9_p1-r2.ebuild,v
1.1 2015/07/08 09:09:13 vapier Exp $
+# $Id$
EAPI="4"
inherit eutils user flag-o-matic multilib autotools pam systemd versionator
@@ -19,7 +19,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
${HPN_PATCH:+hpn? (
mirror://gentoo/${HPN_PATCH}
- http://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
+ https://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
mirror://sourceforge/hpnssh/${HPN_PATCH}
)}
${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
@@ -31,39 +31,34 @@ SLOT="0"
KEYWORDS="~ppc-aix ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux
~x86-interix ~amd64-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos
~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit
pam +pie sctp selinux skey ssh1 +ssl static X X509"
-REQUIRED_USE="pie? ( !static )
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
ssh1? ( ssl )
static? ( !kerberos !pam )
X509? ( !ldap ssl )"
-LIB_DEPEND="sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- libedit? ( dev-libs/libedit[static-libs(+)] )
ssl? (
- >=dev-libs/openssl-0.9.6d:0[bindist=]
- dev-libs/openssl[static-libs(+)]
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
RDEPEND="
- !static? (
- ${LIB_DEPEND//\[static-libs(+)]}
- ldns? (
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- )
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
pam? ( virtual/pam )
kerberos? ( virtual/krb5 )
ldap? ( net-nds/openldap )"
DEPEND="${RDEPEND}
- static? (
- ${LIB_DEPEND}
- ldns? (
- !bindist? ( net-libs/ldns[ecdsa,ssl,static-libs(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl,static-libs(+)] )
- )
- )
+ static? ( ${LIB_DEPEND} )
virtual/pkgconfig
virtual/os-headers
sys-devel/autoconf"
@@ -94,9 +89,8 @@ pkg_setup() {
# Make sure people who are using tcp wrappers are notified of its
removal. #531156
if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- eerror "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
- eerror "you're trying to use it. Update your
${EROOT}etc/hosts.{allow,deny} please."
- die "USE=tcpd no longer works"
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
+ ewarn "you're trying to use it. Update your
${EROOT}etc/hosts.{allow,deny} please."
fi
}
@@ -207,6 +201,9 @@ src_configure() {
$(use_with ssl ssl-engine)
)
+ # The seccomp sandbox is broken on x32, so use the older method for
now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
# Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed
's/\(.\..\).*/\1/')" ; then
myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
diff --git a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
similarity index 79%
copy from net-misc/openssh/openssh-6.9_p1-r2.ebuild
copy to net-misc/openssh/openssh-7.1_p1-r2.ebuild
index 628a85d..1a1e9a2 100644
--- a/net-misc/openssh/openssh-6.9_p1-r2.ebuild
+++ b/net-misc/openssh/openssh-7.1_p1-r2.ebuild
@@ -1,6 +1,6 @@
# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-6.9_p1-r2.ebuild,v
1.1 2015/07/08 09:09:13 vapier Exp $
+# $Id$
EAPI="4"
inherit eutils user flag-o-matic multilib autotools pam systemd versionator
@@ -9,9 +9,9 @@ inherit eutils user flag-o-matic multilib autotools pam systemd
versionator
# and _p? releases.
PARCH=${P/_}
-HPN_PATCH="${PN}-6.9p1-r1-hpnssh14v5.tar.xz"
+HPN_PATCH="${PARCH}-hpnssh14v9.tar.xz"
LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz"
-X509_VER="8.4" X509_PATCH="${PN}-6.9p1+x509-${X509_VER}.diff.gz"
+X509_VER="8.6" X509_PATCH="${PN}-${PV//_/}+x509-${X509_VER}.diff.gz"
DESCRIPTION="Port of OpenBSD's free SSH release"
HOMEPAGE="http://www.openssh.org/";
@@ -19,7 +19,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz
${HPN_PATCH:+hpn? (
mirror://gentoo/${HPN_PATCH}
- http://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
+ https://dev.gentoo.org/~polynomial-c/${HPN_PATCH}
mirror://sourceforge/hpnssh/${HPN_PATCH}
)}
${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
@@ -30,40 +30,38 @@ LICENSE="BSD GPL-2"
SLOT="0"
KEYWORDS="~ppc-aix ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux
~x86-interix ~amd64-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos
~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
# Probably want to drop ssl defaulting to on in a future version.
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit
pam +pie sctp selinux skey ssh1 +ssl static X X509"
-REQUIRED_USE="pie? ( !static )
+IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit
libressl pam +pie sctp selinux skey ssh1 +ssl static X X509"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
ssh1? ( ssl )
static? ( !kerberos !pam )
X509? ( !ldap ssl )"
-LIB_DEPEND="sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+LIB_DEPEND="
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl] )
+ )
+ libedit? ( dev-libs/libedit[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- libedit? ( dev-libs/libedit[static-libs(+)] )
ssl? (
- >=dev-libs/openssl-0.9.6d:0[bindist=]
- dev-libs/openssl[static-libs(+)]
+ !libressl? (
+ >=dev-libs/openssl-0.9.8f:0[bindist=]
+ dev-libs/openssl:0[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl[static-libs(+)] )
)
>=sys-libs/zlib-1.2.3[static-libs(+)]"
RDEPEND="
- !static? (
- ${LIB_DEPEND//\[static-libs(+)]}
- ldns? (
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- )
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
pam? ( virtual/pam )
kerberos? ( virtual/krb5 )
ldap? ( net-nds/openldap )"
DEPEND="${RDEPEND}
- static? (
- ${LIB_DEPEND}
- ldns? (
- !bindist? ( net-libs/ldns[ecdsa,ssl,static-libs(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl,static-libs(+)] )
- )
- )
+ static? ( ${LIB_DEPEND} )
virtual/pkgconfig
virtual/os-headers
sys-devel/autoconf"
@@ -94,9 +92,8 @@ pkg_setup() {
# Make sure people who are using tcp wrappers are notified of its
removal. #531156
if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- eerror "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
- eerror "you're trying to use it. Update your
${EROOT}etc/hosts.{allow,deny} please."
- die "USE=tcpd no longer works"
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and
it seems like"
+ ewarn "you're trying to use it. Update your
${EROOT}etc/hosts.{allow,deny} please."
fi
}
@@ -119,8 +116,10 @@ src_prepare() {
if use X509 ; then
pushd .. >/dev/null
- #epatch "${WORKDIR}"/${PN}-6.8_p1-x509-${X509_VER}-glue.patch
- epatch "${FILESDIR}"/${PN}-6.8_p1-sctp-x509-glue.patch
+ pushd ${HPN_PATCH%.*.*} >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch
+ popd >/dev/null
+ epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch
popd >/dev/null
epatch "${WORKDIR}"/${X509_PATCH%.*}
epatch "${FILESDIR}"/${PN}-6.3_p1-x509-hpn14v2-glue.patch
@@ -207,11 +206,8 @@ src_configure() {
$(use_with ssl ssl-engine)
)
- # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011)
- if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed
's/\(.\..\).*/\1/')" ; then
- myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx )
- append-ldflags -lutil
- fi
+ # The seccomp sandbox is broken on x32, so use the older method for
now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
econf "${myconf[@]}"
}
@@ -311,8 +307,21 @@ pkg_postinst() {
if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
elog "Starting with openssh-6.9p1, ssh1 support is disabled by
default."
fi
- ewarn "Remember to merge your config files in /etc/ssh/ and then"
- ewarn "reload sshd: '/etc/init.d/sshd reload'."
- elog "Note: openssh-6.7 versions no longer support USE=tcpd as upstream
has"
- elog " dropped it. Make sure to update any configs that you might
have."
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been
dropped by upstream."
+ elog "Make sure to update any configs that you might have.
Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388
+ elog "Starting with openssh-7.0, support for ssh-dss keys were
disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can
re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or
ed25519."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh,
the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to
generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
}
