Hello! Somewhat recently, I submitted a PR for OpenSSH 8.9p1 to bring it -current with the release on openssh.com, and it was merged, and all seemed well with the world, or at least that port, ever so briefly. ;)
Not long after, via Trac, thetrial (alabay) indicated an error with the +gsskex variant on OS X El Capitan, which I certainly hadn't tested with my initial Portfile diff and merged PR. After a bit of rummaging around for a laptop I could access which still had OS X El Capitan installed, I determined that while the issue indicated was reproducible, it had more to do with the +gsskex variant and attempting to apply a patch for 8.8p1. In other words: the issue is not constrained to El Capitan, it is instead related to the +gsskex variant and a patch which no longer applies cleanly to the 8.9p1 codebase. However, this is a patch (i.e. GSSAPI/gsskex) which has been rejected from the upstream OpenSSH project, for over two decades now. The wording in the patch itself is rather cautionary in nature with some salient quotes from the OpenSSH developer community as far as why they rejected it and I pasted that quote as an excerpt in the comments in my next PR effort, which removed references to the patch, as well as removed the patch itself from the files subdirectory for the OpenSSH port. That PR is here: https://github.com/macports/macports-ports/pull/14193 Additionally, it appears as if the original author of the patch, Simon Wilkinson, has also abandoned it, with http://www.sxw.org.uk/computing/patches/ where it previously resided, presently redirecting to what appears to be his Lighting and Design career website? Looking a little bit more deeply into this, aside from getting some helpful suggestions from Herby (who also suggested I email this mailing list, hence this message) I couldn't help but notice that there are still various patches in the OpenSSH port files subdirectory related to the no longer extant in the Portfile HPN variant, which also appears to have been deprecated for quite some time? I know FreeBSD's port also abandoned their HPN related OpenSSH patches some years ago as well, though I admit I never paid close attention to that variant with MacPorts to know its lifecycle. In other words: the OpenSSH port has been without a maintainer, and the Portfile and associated files subdirectory seem to have accrued some bitrot. While I can presumably amend my last PR or submit another PR with a bit of additional housekeeping to remove the HPN related files for example, in addition to my extant minimalist effort to simply eliminate errors in the +gsskex variant (admittedly, without actually removing references to it with the variant stanzas entirely from the Portfile, which is probably a wiser decision along that line of thought) it seems as if it might be worthwhile to bring some of these issues to the attention of the larger MacPorts developer community for perspective and hopefully helpful suggestions? Maybe it is my nerves talking, but especially given that I do not have commit access and am not the most facile with GitHub having only had three PRs merged into MacPorts thus far; I don't feel as if I have a lot of confidence in my actions as related to git presently (I'm an older than CVS kind of coder, some newfangled Linuxisms rife tools don't sit well with me). Moreover, maybe some people really liked the +gsskex/GSSAPI patch for OpenSSH which is why they had refactored it for 8.8p1? To me, the gsskex variant kind of screams: "yikes, plausible attack surface" and like the deprecated HPN patches, it and its associated references and files are worth jettisoning, but I do not profess to be an authoritative source for any of that so much as I am sharing my opinion. What do others think? Feedback is welcome! I didn't mean to harsh on Renee in the PR comments either, but Renee was pretty up front about not actually using the OpenSSH port, so I would mostly appreciate perspective from individuals who do actually use the OpenSSH port and have some "skin in the game" as the idiomatic expression goes. For the life of me, I can't really see much good coming from the +gsskex/GSSAPI variant, but I also do not presently administer any Kerberos related infrastructure at the moment (thankfully, if slightly tangentially, I also do not administer any yp related infrastructure these days anymore and can blissfully only recall them and their associated security holes with ypcat abuses as distant early 1990s memories now). Thank you in advance for any wisdom you may be able to share on this issue! ｜ グ レ ェ ーgrey p.s. Happy π day!
