| 1 |
commit: 4af98ae59360be2700bff0db38445628705223ce |
| 2 |
Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Wed Sep 28 08:39:32 2016 +0000 |
| 4 |
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Wed Sep 28 08:40:13 2016 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4af98ae5 |
| 7 |
|
| 8 |
net-misc/openssh: Removed old. |
| 9 |
|
| 10 |
Package-Manager: portage-2.3.1 |
| 11 |
Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org> |
| 12 |
|
| 13 |
net-misc/openssh/Manifest | 8 - |
| 14 |
.../openssh/files/openssh-4.7_p1-GSSAPI-dns.patch | 127 -------- |
| 15 |
.../openssh-6.8_p1-ssl-engine-configure.patch | 33 -- |
| 16 |
.../files/openssh-7.0_p1-sctp-x509-glue.patch | 74 ----- |
| 17 |
.../files/openssh-7.1_p2-x509-hpn14v10-glue.patch | 51 ---- |
| 18 |
.../openssh-7.3_p1-fix-segfault-with-x509.patch | 12 - |
| 19 |
net-misc/openssh/openssh-7.1_p2-r1.ebuild | 326 -------------------- |
| 20 |
net-misc/openssh/openssh-7.3_p1-r1.ebuild | 332 -------------------- |
| 21 |
net-misc/openssh/openssh-7.3_p1-r2.ebuild | 332 -------------------- |
| 22 |
net-misc/openssh/openssh-7.3_p1-r3.ebuild | 338 -------------------- |
| 23 |
net-misc/openssh/openssh-7.3_p1-r4.ebuild | 339 --------------------- |
| 24 |
net-misc/openssh/openssh-7.3_p1.ebuild | 331 -------------------- |
| 25 |
12 files changed, 2303 deletions(-) |
| 26 |
|
| 27 |
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest |
| 28 |
index 1d56f56..753ea13 100644 |
| 29 |
--- a/net-misc/openssh/Manifest |
| 30 |
+++ b/net-misc/openssh/Manifest |
| 31 |
@@ -1,17 +1,9 @@ |
| 32 |
-DIST openssh-6.8_p1-sctp.patch.xz 7388 SHA256 2c74dd00aaae9f4de908d8e5685ae982779a5069996b98d55e8408eada739a19 SHA512 f93a1d27bc3e57a6d4fa717c9d5ece4f28196f8539cb2f2efc4285dce9a2e94a3f5a59d18fc01ea73a94e90630cee7621240455fce146f781cf7091a828f2db0 WHIRLPOOL 7fb3346c3444654988303ff2a941345c00412a8012d6d419c9e4f870ef4c3362f92a4020d7bff2dc5d1ff9e42cf7287c4346909f8db07154783d5359a73a7476 |
| 33 |
-DIST openssh-7.1p2+x509-8.7.diff.gz 438584 SHA256 23030dff924a78718686fad6442b1083293b0c2a057714291bd0af9ed8ef5868 SHA512 d9aa43f5fc06b88b442285a9f9a15d01b52796c36f0cb228c756edca473a89eadb296c45503a14514fdb156d3bc9d90ff33271ccfa9461a9bb2b798a581cc007 WHIRLPOOL ef3f4486fff0addad1a6bdcde3ba606d55d6e3ea5d2cd6e79bfe2494d660c38f0e9f1c157af72c3b6ad5e6eb3731168f975b26c94f8357154e54c08e5d876652 |
| 34 |
-DIST openssh-7.1p2-hpnssh14v10.tar.xz 22388 SHA256 729e20a2627ca403da6cfff8ef251c03421022123a21c68003181b4e5409bcc5 SHA512 b8e88ac5891ed632416db8da6377512614f19f5f7a7c093b55ecfe3e3f50979c61c0674e9381c316632d8daed90f8cce958c9b77bd00084a4ee1b0297cf321ba WHIRLPOOL c466cc33dc4a40e9466148beb154c539e095ac1b9cdcc5b3d235cbcf12ca10255d63da2f0e1da10d1afa1a0d2ebd436ca0d9e542c732df6ef67fb8f4d2d0192c |
| 35 |
-DIST openssh-7.1p2.tar.gz 1475829 SHA256 dd75f024dcf21e06a0d6421d582690bf987a1f6323e32ad6619392f3bfde6bbd SHA512 d5be60f3645ec238b21e1f2dfd801b2136146674bbc086ebdb14be516c613819bc87c84b5089f3a45fe6e137a7458404f79f42572c69d91571e45ebed9d5e3af WHIRLPOOL 9f48952b82db3983c20e84bcff5b6761f5b284174072c828698dced3a53ca8bbc2e1f89d2e82b62a68f4606b52c980fcf097250f86c1a67ad343d20e3ec9d1f4 |
| 36 |
DIST openssh-7.2_p1-sctp.patch.xz 8088 SHA256 b9cc21336e23d44548e87964da9ff85ac83ce84693162abb172afb46be4a666e SHA512 b287684337a101a26ab8df6894b679b063cdaa7dfc7b78fcc0ce8350c27526f150a6463c515019beb0af2ff005cc109d2913998f95f828e553b835a4df8b64df WHIRLPOOL 16646a896f746946af84961974be08418b951c80249dce2fd4ae533a4d66e79d4372fd979aeda9c51aff51b86edf4178af18379e948195696a6fa114e2757306 |
| 37 |
DIST openssh-7.2p2+x509-8.9.diff.gz 449308 SHA256 bd77fcd285d10a86fb2934e90776fe39e4cd2da043384ec2ca45296a60669589 SHA512 c7ed07aae72fd4f967ab5717831c51ad639ca59633c3768f6930bab0947f5429391e3911a7570288a1c688c8c21747f3cb722538ae96de6b50a021010e1506fa WHIRLPOOL 7c1328e471b0e5e9576117ec563b66fea142886b0666b6d51ac9b8ec09286ba7a965b62796c32206e855e484180797a2c31d500c27289f3bc8c7db2d3af95e6f |
| 38 |
DIST openssh-7.2p2.tar.gz 1499808 SHA256 a72781d1a043876a224ff1b0032daa4094d87565a68528759c1c2cab5482548c SHA512 44f62b3a7bc50a0735d496a5aedeefb71550d8c10ad8f22b94e29fcc8084842db96e8c4ca41fced17af69e1aab09ed1182a12ad8650d9a46fd8743a0344df95b WHIRLPOOL 95e16af6d1d82f4a660b56854b8e9da947b89e47775c06fe277a612cd1a7cabe7454087eb45034aedfb9b08096ce4aa427b9a37f43f70ccf1073664bdec13386 |
| 39 |
DIST openssh-7.3_p1-hpn-14.10-r1.patch.xz 20584 SHA256 0bbbfeb1f9f975ad591ed4ec74927172c5299ec1a76210197c14575204efa85d SHA512 f0a1c84af85f7cfc7cb58b5117b3d0f57fc25ae0dd608e38b48ef42da43780fd5cf243d26ff9b3fbd6f4cb1567852b87bcb75f98791cf3ad1892e8579a7834d3 WHIRLPOOL b1a8bae14c8189745056c15c9ed45207aa06af1f4c598a1af7dc3cc56e47bd0211a63989a920727e20311a148bbcf3202c202eae94cd1512c7d87816a9f44bcb |
| 40 |
-DIST openssh-7.3_p1-hpn-14.10.patch.xz 20764 SHA256 1c3799d83b52fc5d9370a0d7ccc11f45db0cf089ece7b7b2f5f24943df16f918 SHA512 95e7dfbd3246678f997cb7818add9910136004b9e2e575122981f50b4eadd2517eb38a8de16bfe3a387e6cc65dbd15dae116649d55768767fc13f796a6d15a09 WHIRLPOOL 4167970087e17c8d9c2184109e85226f9a77d040868bd8b9ccab6ebc3d94f81b0d93489c3ad15b028e3fa842786cd2898dce54822b2e870470113634884285b4 |
| 41 |
DIST openssh-7.3_p1-sctp.patch.xz 9968 SHA256 18c3db45ed1e5495db29626938d8432aee509e88057494f052cfc09d40824c7f SHA512 f249b76898af0c6f1f65f2a1cfb422648aa712818d0dc051b85a171f26bdddf7980fff5de7761161aa41c309e528b3801b4234f5cdd9f79f8eef173ae83f1e3c WHIRLPOOL 1d92b969154b77d8ce9e3a6d0302aa17ec95e2d5ea4de72c0fb5680a8ee12f518ee5b1c47f22ad5d1a923a74c43829ed36cf478fe75fe400de967ab48d93dc99 |
| 42 |
-DIST openssh-7.3p1+x509-9.0.diff.gz 571918 SHA256 ed468fe2e6220065b2bf3e2ed9eb0c7c8183f32f50fa50d64505d5feaef2d900 SHA512 b6183f4441eb036a6e70e35290454faa67da411b60315f6d51779c187abdef377895d5ecfc4fbebac08d5a7a49ce16378b2ed208aee701337f256fd66f779dcd WHIRLPOOL 91107f0040a7d9e09340a1c67547df34c9ed2e7a61d0ca59161574d9e9db90d2a99b1f2a7fa1edf0f820db5712695287c5731cc46cc9264297b5d348d4ce53c4 |
| 43 |
-DIST openssh-7.3p1+x509-9.1.diff.gz 584945 SHA256 1ce361813d585fb543f632d19f73a583e257a404c013587a2ee7a1c57710ae95 SHA512 11165544513eaff2b2e1f6dd11b9fb2870e59eb7e16377cf8fc1bf7e459cf8d09a91cf52f0d252df1bf618423ea8fb93099b96670cebc42aa2523dd439e59a89 WHIRLPOOL 8732cc52ef851a35c0dc8b35e8b6666d347f40ee60792aa23bae8e193ec6fa24928b67e6d8ebfc2c52090e78c525e908596020071495452965fa6244df1e459e |
| 44 |
DIST openssh-7.3p1+x509-9.2.diff.gz 588078 SHA256 45f054cbb2b77ac8cc7ab01439e34083382137d47b840ca274555b7e2cf7098b SHA512 fab0da148b0833a651e8a7c36f344aacecef6fa92f8f1cb6302272d98c1ab018831f5850dcaa8f54a39f9ada9b7d5b0a0ea01defc3c6f603bbe211f6bff6a841 WHIRLPOOL 53f63d879f563909c57d23ced273e23eda1eace2a2ddfd54edf5f2ef15218cc7e5d927e54714b6850db541f361c459de50d79b0a4516b43ce4cba8eb66b49485 |
| 45 |
DIST openssh-7.3p1.tar.gz 1522617 SHA256 3ffb989a6dcaa69594c3b550d4855a5a2e1718ccdde7f5e36387b424220fbecc SHA512 7ba2d6140f38bd359ebf32ef17626e0ae1c00c3a38c01877b7c6b0317d030f10a8f82a0a51fc3b6273619de9ed73e24b8cf107b1e968f927053a3bedf97ff801 WHIRLPOOL f852026638d173d455f74e3fce16673fc4b10f32d954d5bb8c7c65df8d1ca7efd0938177dd9fb6e1f7354383f21c7bca8a2f01e89793e32f8ca68c30456a611c |
| 46 |
-DIST openssh-lpk-7.1p2-0.3.14.patch.xz 17704 SHA256 fbf2e1560cac707f819a539999c758a444ba6bfe140ef80d1af7ef1c9a95f0df SHA512 95851baa699da16720358249d54d2f6a3c57b0ae082375bef228b97697c501c626ab860916c5b17e3c649b44f14f4009ff369962597438dfd60480a0e4882471 WHIRLPOOL 4629b3a7d1f373a678935e889a6cd0d66d70b420e93e40ae0ad19aa7f91be7dcf2169fb797d89df93005a885d54ebaa0d46c2e5418bd2d0a77ad64e65897b518 |
| 47 |
DIST openssh-lpk-7.2p2-0.3.14.patch.xz 17692 SHA256 2cd4108d60112bd97402f9c27aac2c24d334a37afe0933ad9c6377a257a68aee SHA512 e6a25f8f0106fadcb799300452d6f22034d3fc69bd1c95a3365884873861f41b1e9d49f2c5223dde6fcd00562c652ba466bc8c48833ce5ab353af3a041f75b15 WHIRLPOOL 237343b320772a1588b64c4135758af840199214129d7e8cfa9798f976c32902ca5493ee0c33b16003854fea243556997bc688640a9872b82c06f72c86f2586d |
| 48 |
DIST openssh-lpk-7.3p1-0.3.14.patch.xz 17800 SHA256 cf1f60235cb8b0e561cd36cbf9e4f437e16fd748c2616d3f511c128c02deb76c SHA512 e9a73c5f13e41f6e11c744fdbcdb2e399c394479f79249e901cb3c101efb06f23d51d3ba4869db872184fa034a5910fc93a730fe906266c8d7409e39ad5b1ecd WHIRLPOOL bbdeadbed8f901148713bd9e4a082a4be2992c3151f995febd8be89bbb85d91185e1f0413b5a94a9340f2f404d18c9cee2aa6e032adaee0306aa1c624f6cc09c |
| 49 |
|
| 50 |
diff --git a/net-misc/openssh/files/openssh-4.7_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-4.7_p1-GSSAPI-dns.patch |
| 51 |
deleted file mode 100644 |
| 52 |
index c81ae5c..00000000 |
| 53 |
--- a/net-misc/openssh/files/openssh-4.7_p1-GSSAPI-dns.patch |
| 54 |
+++ /dev/null |
| 55 |
@@ -1,127 +0,0 @@ |
| 56 |
-http://bugs.gentoo.org/165444 |
| 57 |
-https://bugzilla.mindrot.org/show_bug.cgi?id=1008 |
| 58 |
- |
| 59 |
-Index: readconf.c |
| 60 |
-=================================================================== |
| 61 |
-RCS file: /cvs/openssh/readconf.c,v |
| 62 |
-retrieving revision 1.135 |
| 63 |
-diff -u -r1.135 readconf.c |
| 64 |
---- readconf.c 5 Aug 2006 02:39:40 -0000 1.135 |
| 65 |
-+++ readconf.c 19 Aug 2006 11:59:52 -0000 |
| 66 |
-@@ -126,6 +126,7 @@ |
| 67 |
- oClearAllForwardings, oNoHostAuthenticationForLocalhost, |
| 68 |
- oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, |
| 69 |
- oAddressFamily, oGssAuthentication, oGssDelegateCreds, |
| 70 |
-+ oGssTrustDns, |
| 71 |
- oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, |
| 72 |
- oSendEnv, oControlPath, oControlMaster, oHashKnownHosts, |
| 73 |
- oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, |
| 74 |
-@@ -163,9 +164,11 @@ |
| 75 |
- #if defined(GSSAPI) |
| 76 |
- { "gssapiauthentication", oGssAuthentication }, |
| 77 |
- { "gssapidelegatecredentials", oGssDelegateCreds }, |
| 78 |
-+ { "gssapitrustdns", oGssTrustDns }, |
| 79 |
- #else |
| 80 |
- { "gssapiauthentication", oUnsupported }, |
| 81 |
- { "gssapidelegatecredentials", oUnsupported }, |
| 82 |
-+ { "gssapitrustdns", oUnsupported }, |
| 83 |
- #endif |
| 84 |
- { "fallbacktorsh", oDeprecated }, |
| 85 |
- { "usersh", oDeprecated }, |
| 86 |
-@@ -444,6 +447,10 @@ |
| 87 |
- intptr = &options->gss_deleg_creds; |
| 88 |
- goto parse_flag; |
| 89 |
- |
| 90 |
-+ case oGssTrustDns: |
| 91 |
-+ intptr = &options->gss_trust_dns; |
| 92 |
-+ goto parse_flag; |
| 93 |
-+ |
| 94 |
- case oBatchMode: |
| 95 |
- intptr = &options->batch_mode; |
| 96 |
- goto parse_flag; |
| 97 |
-@@ -1010,6 +1017,7 @@ |
| 98 |
- options->challenge_response_authentication = -1; |
| 99 |
- options->gss_authentication = -1; |
| 100 |
- options->gss_deleg_creds = -1; |
| 101 |
-+ options->gss_trust_dns = -1; |
| 102 |
- options->password_authentication = -1; |
| 103 |
- options->kbd_interactive_authentication = -1; |
| 104 |
- options->kbd_interactive_devices = NULL; |
| 105 |
-@@ -1100,6 +1108,8 @@ |
| 106 |
- options->gss_authentication = 0; |
| 107 |
- if (options->gss_deleg_creds == -1) |
| 108 |
- options->gss_deleg_creds = 0; |
| 109 |
-+ if (options->gss_trust_dns == -1) |
| 110 |
-+ options->gss_trust_dns = 0; |
| 111 |
- if (options->password_authentication == -1) |
| 112 |
- options->password_authentication = 1; |
| 113 |
- if (options->kbd_interactive_authentication == -1) |
| 114 |
-Index: readconf.h |
| 115 |
-=================================================================== |
| 116 |
-RCS file: /cvs/openssh/readconf.h,v |
| 117 |
-retrieving revision 1.63 |
| 118 |
-diff -u -r1.63 readconf.h |
| 119 |
---- readconf.h 5 Aug 2006 02:39:40 -0000 1.63 |
| 120 |
-+++ readconf.h 19 Aug 2006 11:59:52 -0000 |
| 121 |
-@@ -45,6 +45,7 @@ |
| 122 |
- /* Try S/Key or TIS, authentication. */ |
| 123 |
- int gss_authentication; /* Try GSS authentication */ |
| 124 |
- int gss_deleg_creds; /* Delegate GSS credentials */ |
| 125 |
-+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */ |
| 126 |
- int password_authentication; /* Try password |
| 127 |
- * authentication. */ |
| 128 |
- int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ |
| 129 |
-Index: ssh_config.5 |
| 130 |
-=================================================================== |
| 131 |
-RCS file: /cvs/openssh/ssh_config.5,v |
| 132 |
-retrieving revision 1.97 |
| 133 |
-diff -u -r1.97 ssh_config.5 |
| 134 |
---- ssh_config.5 5 Aug 2006 01:34:51 -0000 1.97 |
| 135 |
-+++ ssh_config.5 19 Aug 2006 11:59:53 -0000 |
| 136 |
-@@ -483,7 +483,16 @@ |
| 137 |
- Forward (delegate) credentials to the server. |
| 138 |
- The default is |
| 139 |
- .Dq no . |
| 140 |
--Note that this option applies to protocol version 2 only. |
| 141 |
-+Note that this option applies to protocol version 2 connections using GSSAPI. |
| 142 |
-+.It Cm GSSAPITrustDns |
| 143 |
-+Set to |
| 144 |
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize |
| 145 |
-+the name of the host being connected to. If |
| 146 |
-+.Dq no, the hostname entered on the |
| 147 |
-+command line will be passed untouched to the GSSAPI library. |
| 148 |
-+The default is |
| 149 |
-+.Dq no . |
| 150 |
-+This option only applies to protocol version 2 connections using GSSAPI. |
| 151 |
- .It Cm HashKnownHosts |
| 152 |
- Indicates that |
| 153 |
- .Xr ssh 1 |
| 154 |
-Index: sshconnect2.c |
| 155 |
-=================================================================== |
| 156 |
-RCS file: /cvs/openssh/sshconnect2.c,v |
| 157 |
-retrieving revision 1.151 |
| 158 |
-diff -u -r1.151 sshconnect2.c |
| 159 |
---- sshconnect2.c 18 Aug 2006 14:33:34 -0000 1.151 |
| 160 |
-+++ sshconnect2.c 19 Aug 2006 11:59:53 -0000 |
| 161 |
-@@ -499,6 +499,12 @@ |
| 162 |
- static u_int mech = 0; |
| 163 |
- OM_uint32 min; |
| 164 |
- int ok = 0; |
| 165 |
-+ const char *gss_host; |
| 166 |
-+ |
| 167 |
-+ if (options.gss_trust_dns) |
| 168 |
-+ gss_host = get_canonical_hostname(1); |
| 169 |
-+ else |
| 170 |
-+ gss_host = authctxt->host; |
| 171 |
- |
| 172 |
- /* Try one GSSAPI method at a time, rather than sending them all at |
| 173 |
- * once. */ |
| 174 |
-@@ -511,7 +517,7 @@ |
| 175 |
- /* My DER encoding requires length<128 */ |
| 176 |
- if (gss_supported->elements[mech].length < 128 && |
| 177 |
- ssh_gssapi_check_mechanism(&gssctxt, |
| 178 |
-- &gss_supported->elements[mech], authctxt->host)) { |
| 179 |
-+ &gss_supported->elements[mech], gss_host)) { |
| 180 |
- ok = 1; /* Mechanism works */ |
| 181 |
- } else { |
| 182 |
- mech++; |
| 183 |
|
| 184 |
diff --git a/net-misc/openssh/files/openssh-6.8_p1-ssl-engine-configure.patch b/net-misc/openssh/files/openssh-6.8_p1-ssl-engine-configure.patch |
| 185 |
deleted file mode 100644 |
| 186 |
index a355e2c..00000000 |
| 187 |
--- a/net-misc/openssh/files/openssh-6.8_p1-ssl-engine-configure.patch |
| 188 |
+++ /dev/null |
| 189 |
@@ -1,33 +0,0 @@ |
| 190 |
-https://github.com/openssh/openssh-portable/pull/29 |
| 191 |
- |
| 192 |
-From 003ed46d1bd94bac29c53b26ae70f6321ea11c80 Mon Sep 17 00:00:00 2001 |
| 193 |
-From: Mike Frysinger <vapier@g.o> |
| 194 |
-Date: Wed, 18 Mar 2015 12:37:24 -0400 |
| 195 |
-Subject: [PATCH] do not abort when --without-ssl-engine --without-openssl is |
| 196 |
- set |
| 197 |
- |
| 198 |
---- |
| 199 |
- configure.ac | 6 +++--- |
| 200 |
- 1 file changed, 3 insertions(+), 3 deletions(-) |
| 201 |
- |
| 202 |
-diff --git a/configure.ac b/configure.ac |
| 203 |
-index b4d6598..7806d20 100644 |
| 204 |
---- a/configure.ac |
| 205 |
-+++ b/configure.ac |
| 206 |
-@@ -2276,10 +2276,10 @@ openssl_engine=no |
| 207 |
- AC_ARG_WITH([ssl-engine], |
| 208 |
- [ --with-ssl-engine Enable OpenSSL (hardware) ENGINE support ], |
| 209 |
- [ |
| 210 |
-- if test "x$openssl" = "xno" ; then |
| 211 |
-- AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled]) |
| 212 |
-- fi |
| 213 |
- if test "x$withval" != "xno" ; then |
| 214 |
-+ if test "x$openssl" = "xno" ; then |
| 215 |
-+ AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled]) |
| 216 |
-+ fi |
| 217 |
- openssl_engine=yes |
| 218 |
- fi |
| 219 |
- ] |
| 220 |
--- |
| 221 |
-2.3.2 |
| 222 |
- |
| 223 |
|
| 224 |
diff --git a/net-misc/openssh/files/openssh-7.0_p1-sctp-x509-glue.patch b/net-misc/openssh/files/openssh-7.0_p1-sctp-x509-glue.patch |
| 225 |
deleted file mode 100644 |
| 226 |
index d793f90..00000000 |
| 227 |
--- a/net-misc/openssh/files/openssh-7.0_p1-sctp-x509-glue.patch |
| 228 |
+++ /dev/null |
| 229 |
@@ -1,74 +0,0 @@ |
| 230 |
---- openssh-6.8_p1-sctp.patch.1 2015-08-12 16:01:13.854769013 -0700 |
| 231 |
-+++ openssh-6.8_p1-sctp.patch 2015-08-12 16:00:38.208488789 -0700 |
| 232 |
-@@ -195,14 +195,6 @@ |
| 233 |
- .Op Fl c Ar cipher |
| 234 |
- .Op Fl F Ar ssh_config |
| 235 |
- .Op Fl i Ar identity_file |
| 236 |
--@@ -178,6 +178,7 @@ For full details of the options listed b |
| 237 |
-- .It ServerAliveCountMax |
| 238 |
-- .It StrictHostKeyChecking |
| 239 |
-- .It TCPKeepAlive |
| 240 |
--+.It Transport |
| 241 |
-- .It UpdateHostKeys |
| 242 |
-- .It UsePrivilegedPort |
| 243 |
-- .It User |
| 244 |
- @@ -218,6 +219,8 @@ and |
| 245 |
- to print debugging messages about their progress. |
| 246 |
- This is helpful in |
| 247 |
-@@ -477,19 +469,11 @@ |
| 248 |
- .Sh SYNOPSIS |
| 249 |
- .Nm ssh |
| 250 |
- .Bk -words |
| 251 |
---.Op Fl 1246AaCfGgKkMNnqsTtVvXxYy |
| 252 |
--+.Op Fl 1246AaCfGgKkMNnqsTtVvXxYyz |
| 253 |
-+-.Op Fl 1246AaCdfgKkMNnqsTtVvXxYy |
| 254 |
-++.Op Fl 1246AaCdfgKkMNnqsTtVvXxYyz |
| 255 |
- .Op Fl b Ar bind_address |
| 256 |
- .Op Fl c Ar cipher_spec |
| 257 |
- .Op Fl D Oo Ar bind_address : Oc Ns Ar port |
| 258 |
--@@ -473,6 +473,7 @@ For full details of the options listed b |
| 259 |
-- .It StreamLocalBindUnlink |
| 260 |
-- .It StrictHostKeyChecking |
| 261 |
-- .It TCPKeepAlive |
| 262 |
--+.It Transport |
| 263 |
-- .It Tunnel |
| 264 |
-- .It TunnelDevice |
| 265 |
-- .It UsePrivilegedPort |
| 266 |
- @@ -665,6 +666,8 @@ Trusted X11 forwardings are not subjecte |
| 267 |
- controls. |
| 268 |
- .It Fl y |
| 269 |
-@@ -501,7 +485,7 @@ |
| 270 |
- By default this information is sent to stderr. |
| 271 |
- --- a/ssh.c |
| 272 |
- +++ b/ssh.c |
| 273 |
--@@ -194,12 +194,17 @@ extern int muxserver_sock; |
| 274 |
-+@@ -194,11 +194,16 @@ extern int muxserver_sock; |
| 275 |
- extern u_int muxclient_command; |
| 276 |
- |
| 277 |
- /* Prints a help message to the user. This function never returns. */ |
| 278 |
-@@ -515,18 +499,17 @@ |
| 279 |
- usage(void) |
| 280 |
- { |
| 281 |
- fprintf(stderr, |
| 282 |
---"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n" |
| 283 |
--+"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy" SCTP_OPT "] [-b bind_address] [-c cipher_spec]\n" |
| 284 |
-+-"usage: ssh [-1246AaCdfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n" |
| 285 |
-++"usage: ssh [-1246AaCdfgKkMNnqsTtVvXxYy" SCTP_OPT "] [-b bind_address] [-c cipher_spec]\n" |
| 286 |
- " [-D [bind_address:]port] [-E log_file] [-e escape_char]\n" |
| 287 |
- " [-F configfile] [-I pkcs11] [-i identity_file]\n" |
| 288 |
-- " [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]\n" |
| 289 |
- @@ -506,7 +512,7 @@ main(int ac, char **av) |
| 290 |
-- argv0 = av[0]; |
| 291 |
-+ # define ENGCONFIG "" |
| 292 |
-+ #endif |
| 293 |
- |
| 294 |
-- again: |
| 295 |
--- while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" |
| 296 |
--+ while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" SCTP_OPT |
| 297 |
-- "ACD:E:F:GI:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { |
| 298 |
-+- while ((opt = getopt(ac, av, "1246ab:c:de:fgi:kl:m:no:p:qstvx" |
| 299 |
-++ while ((opt = getopt(ac, av, "1246ab:c:de:fgi:kl:m:no:p:qstvx" SCTP_OPT |
| 300 |
-+ "ACD:E:F:" ENGCONFIG "I:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { |
| 301 |
- switch (opt) { |
| 302 |
- case '1': |
| 303 |
- @@ -732,6 +738,11 @@ main(int ac, char **av) |
| 304 |
|
| 305 |
diff --git a/net-misc/openssh/files/openssh-7.1_p2-x509-hpn14v10-glue.patch b/net-misc/openssh/files/openssh-7.1_p2-x509-hpn14v10-glue.patch |
| 306 |
deleted file mode 100644 |
| 307 |
index 5124569..00000000 |
| 308 |
--- a/net-misc/openssh/files/openssh-7.1_p2-x509-hpn14v10-glue.patch |
| 309 |
+++ /dev/null |
| 310 |
@@ -1,51 +0,0 @@ |
| 311 |
---- openssh-7.1p2/Makefile.in |
| 312 |
-+++ openssh-7.1p2/Makefile.in |
| 313 |
-@@ -45,7 +45,7 @@ |
| 314 |
- CC=@CC@ |
| 315 |
- LD=@LD@ |
| 316 |
- CFLAGS=@CFLAGS@ |
| 317 |
--CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@ |
| 318 |
-+CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ |
| 319 |
- LIBS=@LIBS@ |
| 320 |
- K5LIBS=@K5LIBS@ |
| 321 |
- GSSLIBS=@GSSLIBS@ |
| 322 |
-@@ -53,6 +53,7 @@ |
| 323 |
- SSHDLIBS=@SSHDLIBS@ |
| 324 |
- LIBEDIT=@LIBEDIT@ |
| 325 |
- LIBLDAP=@LDAP_LDFLAGS@ @LDAP_LIBS@ |
| 326 |
-+CPPFLAGS+=@LDAP_CPPFLAGS@ |
| 327 |
- AR=@AR@ |
| 328 |
- AWK=@AWK@ |
| 329 |
- RANLIB=@RANLIB@ |
| 330 |
---- openssh-7.1p2/sshconnect.c |
| 331 |
-+++ openssh-7.1p2/sshconnect.c |
| 332 |
-@@ -465,7 +465,7 @@ |
| 333 |
- { |
| 334 |
- /* Send our own protocol version identification. */ |
| 335 |
- if (compat20) { |
| 336 |
-- xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX\r\n", |
| 337 |
-+ xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n", |
| 338 |
- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION); |
| 339 |
- } else { |
| 340 |
- xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n", |
| 341 |
---- openssh-7.1p2/sshd.c |
| 342 |
-+++ openssh-7.1p2/sshd.c |
| 343 |
-@@ -472,8 +472,8 @@ |
| 344 |
- comment = ""; |
| 345 |
- } |
| 346 |
- |
| 347 |
-- xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s%s", |
| 348 |
-- major, minor, SSH_VERSION, comment, |
| 349 |
-+ xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", |
| 350 |
-+ major, minor, SSH_VERSION, |
| 351 |
- *options.version_addendum == '\0' ? "" : " ", |
| 352 |
- options.version_addendum, newline); |
| 353 |
- |
| 354 |
---- openssh-7.1p2/version.h |
| 355 |
-+++ openssh-7.1p2/version.h |
| 356 |
-@@ -3,4 +3,5 @@ |
| 357 |
- #define SSH_VERSION "OpenSSH_7.1" |
| 358 |
- |
| 359 |
- #define SSH_PORTABLE "p2" |
| 360 |
-+#define SSH_X509 " PKIX" |
| 361 |
- #define SSH_RELEASE SSH_VERSION SSH_PORTABLE |
| 362 |
|
| 363 |
diff --git a/net-misc/openssh/files/openssh-7.3_p1-fix-segfault-with-x509.patch b/net-misc/openssh/files/openssh-7.3_p1-fix-segfault-with-x509.patch |
| 364 |
deleted file mode 100644 |
| 365 |
index dca4457..00000000 |
| 366 |
--- a/net-misc/openssh/files/openssh-7.3_p1-fix-segfault-with-x509.patch |
| 367 |
+++ /dev/null |
| 368 |
@@ -1,12 +0,0 @@ |
| 369 |
-diff --git a/sshkey.c b/sshkey.c |
| 370 |
-index c9f04cd..4f00e9a 100644 |
| 371 |
---- a/sshkey.c |
| 372 |
-+++ b/sshkey.c |
| 373 |
-@@ -1237,6 +1237,7 @@ sshkey_read(struct sshkey *ret, char **cpp) |
| 374 |
- #endif /* WITH_SSH1 */ |
| 375 |
- |
| 376 |
- cp = *cpp; |
| 377 |
-+ ep = cp; |
| 378 |
- |
| 379 |
- switch (ret->type) { |
| 380 |
- case KEY_RSA1: |
| 381 |
|
| 382 |
diff --git a/net-misc/openssh/openssh-7.1_p2-r1.ebuild b/net-misc/openssh/openssh-7.1_p2-r1.ebuild |
| 383 |
deleted file mode 100644 |
| 384 |
index 5c418d4..00000000 |
| 385 |
--- a/net-misc/openssh/openssh-7.1_p2-r1.ebuild |
| 386 |
+++ /dev/null |
| 387 |
@@ -1,326 +0,0 @@ |
| 388 |
-# Copyright 1999-2016 Gentoo Foundation |
| 389 |
-# Distributed under the terms of the GNU General Public License v2 |
| 390 |
-# $Id$ |
| 391 |
- |
| 392 |
-EAPI="5" |
| 393 |
- |
| 394 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 395 |
- |
| 396 |
-# Make it more portable between straight releases |
| 397 |
-# and _p? releases. |
| 398 |
-PARCH=${P/_} |
| 399 |
- |
| 400 |
-HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz" |
| 401 |
-LDAP_PATCH="${PN}-lpk-7.1p2-0.3.14.patch.xz" |
| 402 |
-X509_VER="8.7" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 403 |
- |
| 404 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 405 |
-HOMEPAGE="http://www.openssh.org/" |
| 406 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 407 |
- mirror://gentoo/${PN}-6.8_p1-sctp.patch.xz |
| 408 |
- ${HPN_PATCH:+hpn? ( |
| 409 |
- mirror://gentoo/${HPN_PATCH} |
| 410 |
- mirror://sourceforge/hpnssh/${HPN_PATCH} |
| 411 |
- )} |
| 412 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 413 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 414 |
- " |
| 415 |
- |
| 416 |
-LICENSE="BSD GPL-2" |
| 417 |
-SLOT="0" |
| 418 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 419 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 420 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl pam +pie sctp selinux skey ssh1 +ssl static X X509" |
| 421 |
-REQUIRED_USE="ldns? ( ssl ) |
| 422 |
- pie? ( !static ) |
| 423 |
- ssh1? ( ssl ) |
| 424 |
- static? ( !kerberos !pam ) |
| 425 |
- X509? ( !ldap ssl )" |
| 426 |
- |
| 427 |
-LIB_DEPEND=" |
| 428 |
- ldns? ( |
| 429 |
- net-libs/ldns[static-libs(+)] |
| 430 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 431 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 432 |
- ) |
| 433 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 434 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 435 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 436 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 437 |
- ssl? ( |
| 438 |
- !libressl? ( |
| 439 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 440 |
- dev-libs/openssl:0[static-libs(+)] |
| 441 |
- ) |
| 442 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 443 |
- ) |
| 444 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 445 |
-RDEPEND=" |
| 446 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 447 |
- pam? ( virtual/pam ) |
| 448 |
- kerberos? ( virtual/krb5 ) |
| 449 |
- ldap? ( net-nds/openldap )" |
| 450 |
-DEPEND="${RDEPEND} |
| 451 |
- static? ( ${LIB_DEPEND} ) |
| 452 |
- virtual/pkgconfig |
| 453 |
- virtual/os-headers |
| 454 |
- sys-devel/autoconf" |
| 455 |
-RDEPEND="${RDEPEND} |
| 456 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 457 |
- userland_GNU? ( virtual/shadow ) |
| 458 |
- X? ( x11-apps/xauth )" |
| 459 |
- |
| 460 |
-S=${WORKDIR}/${PARCH} |
| 461 |
- |
| 462 |
-pkg_setup() { |
| 463 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 464 |
- # than not be able to log in to their server any more |
| 465 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 466 |
- local fail=" |
| 467 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 468 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 469 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 470 |
- " |
| 471 |
- fail=$(echo ${fail}) |
| 472 |
- if [[ -n ${fail} ]] ; then |
| 473 |
- eerror "Sorry, but this version does not yet support features" |
| 474 |
- eerror "that you requested: ${fail}" |
| 475 |
- eerror "Please mask ${PF} for now and check back later:" |
| 476 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 477 |
- die "booooo" |
| 478 |
- fi |
| 479 |
- |
| 480 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 481 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 482 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 483 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 484 |
- fi |
| 485 |
-} |
| 486 |
- |
| 487 |
-save_version() { |
| 488 |
- # version.h patch conflict avoidence |
| 489 |
- mv version.h version.h.$1 |
| 490 |
- cp -f version.h.pristine version.h |
| 491 |
-} |
| 492 |
- |
| 493 |
-src_prepare() { |
| 494 |
- sed -i \ |
| 495 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 496 |
- pathnames.h || die |
| 497 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 498 |
- # this file. |
| 499 |
- cp version.h version.h.pristine |
| 500 |
- |
| 501 |
- # don't break .ssh/authorized_keys2 for fun |
| 502 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 503 |
- |
| 504 |
- if use X509 ; then |
| 505 |
- pushd .. >/dev/null |
| 506 |
- if use hpn ; then |
| 507 |
- pushd ${HPN_PATCH%.*.*} >/dev/null |
| 508 |
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch |
| 509 |
- popd >/dev/null |
| 510 |
- fi |
| 511 |
- epatch "${FILESDIR}"/${PN}-7.0_p1-sctp-x509-glue.patch |
| 512 |
- popd >/dev/null |
| 513 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 514 |
- epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch |
| 515 |
- save_version X509 |
| 516 |
- fi |
| 517 |
- if use ldap ; then |
| 518 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 519 |
- save_version LPK |
| 520 |
- fi |
| 521 |
- epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 522 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 523 |
- # The X509 patchset fixes this independently. |
| 524 |
- use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch |
| 525 |
- epatch "${WORKDIR}"/${PN}-6.8_p1-sctp.patch |
| 526 |
- if use hpn ; then |
| 527 |
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 528 |
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 529 |
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 530 |
- save_version HPN |
| 531 |
- fi |
| 532 |
- |
| 533 |
- tc-export PKG_CONFIG |
| 534 |
- local sed_args=( |
| 535 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 536 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 537 |
- -e 's:^PATH=/:#PATH=/:' |
| 538 |
- # Disable fortify flags ... our gcc does this for us |
| 539 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 540 |
- ) |
| 541 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 542 |
- use hppa && sed_args+=( |
| 543 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 544 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 545 |
- ) |
| 546 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 547 |
- |
| 548 |
- epatch_user #473004 |
| 549 |
- |
| 550 |
- # Now we can build a sane merged version.h |
| 551 |
- ( |
| 552 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 553 |
- macros=() |
| 554 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 555 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 556 |
- ) > version.h |
| 557 |
- |
| 558 |
- eautoreconf |
| 559 |
-} |
| 560 |
- |
| 561 |
-src_configure() { |
| 562 |
- addwrite /dev/ptmx |
| 563 |
- |
| 564 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 565 |
- use static && append-ldflags -static |
| 566 |
- |
| 567 |
- local myconf=( |
| 568 |
- --with-ldflags="${LDFLAGS}" |
| 569 |
- --disable-strip |
| 570 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 571 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 572 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 573 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 574 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 575 |
- --with-privsep-user=sshd |
| 576 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 577 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 578 |
- # unconditionally else we get unknown flag warnings. |
| 579 |
- $(use ldap && use_with ldap) |
| 580 |
- $(use_with ldns) |
| 581 |
- $(use_with libedit) |
| 582 |
- $(use_with pam) |
| 583 |
- $(use_with pie) |
| 584 |
- $(use_with sctp) |
| 585 |
- $(use_with selinux) |
| 586 |
- $(use_with skey) |
| 587 |
- $(use_with ssh1) |
| 588 |
- $(use_with ssl openssl) |
| 589 |
- $(use_with ssl md5-passwords) |
| 590 |
- $(use_with ssl ssl-engine) |
| 591 |
- ) |
| 592 |
- |
| 593 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 594 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 595 |
- |
| 596 |
- econf "${myconf[@]}" |
| 597 |
-} |
| 598 |
- |
| 599 |
-src_install() { |
| 600 |
- emake install-nokeys DESTDIR="${D}" |
| 601 |
- fperms 600 /etc/ssh/sshd_config |
| 602 |
- dobin contrib/ssh-copy-id |
| 603 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 604 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 605 |
- keepdir /var/empty |
| 606 |
- |
| 607 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 608 |
- if use pam ; then |
| 609 |
- sed -i \ |
| 610 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 611 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 612 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 613 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 614 |
- "${ED}"/etc/ssh/sshd_config || die |
| 615 |
- fi |
| 616 |
- |
| 617 |
- # Gentoo tweaks to default config files |
| 618 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 619 |
- |
| 620 |
- # Allow client to pass locale environment variables #367017 |
| 621 |
- AcceptEnv LANG LC_* |
| 622 |
- EOF |
| 623 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 624 |
- |
| 625 |
- # Send locale environment variables #367017 |
| 626 |
- SendEnv LANG LC_* |
| 627 |
- EOF |
| 628 |
- |
| 629 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 630 |
- insinto /etc/openldap/schema/ |
| 631 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 632 |
- fi |
| 633 |
- |
| 634 |
- doman contrib/ssh-copy-id.1 |
| 635 |
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config |
| 636 |
- |
| 637 |
- diropts -m 0700 |
| 638 |
- dodir /etc/skel/.ssh |
| 639 |
- |
| 640 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 641 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 642 |
-} |
| 643 |
- |
| 644 |
-src_test() { |
| 645 |
- local t tests skipped failed passed shell |
| 646 |
- tests="interop-tests compat-tests" |
| 647 |
- skipped="" |
| 648 |
- shell=$(egetshell ${UID}) |
| 649 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 650 |
- elog "Running the full OpenSSH testsuite" |
| 651 |
- elog "requires a usable shell for the 'portage'" |
| 652 |
- elog "user, so we will run a subset only." |
| 653 |
- skipped="${skipped} tests" |
| 654 |
- else |
| 655 |
- tests="${tests} tests" |
| 656 |
- fi |
| 657 |
- # It will also attempt to write to the homedir .ssh |
| 658 |
- local sshhome=${T}/homedir |
| 659 |
- mkdir -p "${sshhome}"/.ssh |
| 660 |
- for t in ${tests} ; do |
| 661 |
- # Some tests read from stdin ... |
| 662 |
- HOMEDIR="${sshhome}" \ |
| 663 |
- emake -k -j1 ${t} </dev/null \ |
| 664 |
- && passed="${passed}${t} " \ |
| 665 |
- || failed="${failed}${t} " |
| 666 |
- done |
| 667 |
- einfo "Passed tests: ${passed}" |
| 668 |
- ewarn "Skipped tests: ${skipped}" |
| 669 |
- if [[ -n ${failed} ]] ; then |
| 670 |
- ewarn "Failed tests: ${failed}" |
| 671 |
- die "Some tests failed: ${failed}" |
| 672 |
- else |
| 673 |
- einfo "Failed tests: ${failed}" |
| 674 |
- return 0 |
| 675 |
- fi |
| 676 |
-} |
| 677 |
- |
| 678 |
-pkg_preinst() { |
| 679 |
- enewgroup sshd 22 |
| 680 |
- enewuser sshd 22 -1 /var/empty sshd |
| 681 |
-} |
| 682 |
- |
| 683 |
-pkg_postinst() { |
| 684 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 685 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 686 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 687 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 688 |
- fi |
| 689 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 690 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 691 |
- fi |
| 692 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 693 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 694 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 695 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 696 |
- fi |
| 697 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 698 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 699 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 700 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 701 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 702 |
- elog "You should however generate new keys using rsa or ed25519." |
| 703 |
- |
| 704 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 705 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 706 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 707 |
- fi |
| 708 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 709 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 710 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 711 |
- elog "and update all clients/servers that utilize them." |
| 712 |
- fi |
| 713 |
-} |
| 714 |
|
| 715 |
diff --git a/net-misc/openssh/openssh-7.3_p1-r1.ebuild b/net-misc/openssh/openssh-7.3_p1-r1.ebuild |
| 716 |
deleted file mode 100644 |
| 717 |
index a915481..00000000 |
| 718 |
--- a/net-misc/openssh/openssh-7.3_p1-r1.ebuild |
| 719 |
+++ /dev/null |
| 720 |
@@ -1,332 +0,0 @@ |
| 721 |
-# Copyright 1999-2016 Gentoo Foundation |
| 722 |
-# Distributed under the terms of the GNU General Public License v2 |
| 723 |
-# $Id$ |
| 724 |
- |
| 725 |
-EAPI="5" |
| 726 |
- |
| 727 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 728 |
- |
| 729 |
-# Make it more portable between straight releases |
| 730 |
-# and _p? releases. |
| 731 |
-PARCH=${P/_} |
| 732 |
- |
| 733 |
-#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz" |
| 734 |
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz" |
| 735 |
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz" |
| 736 |
-X509_VER="9.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 737 |
- |
| 738 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 739 |
-HOMEPAGE="http://www.openssh.org/" |
| 740 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 741 |
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} |
| 742 |
- ${HPN_PATCH:+hpn? ( |
| 743 |
- mirror://gentoo/${HPN_PATCH} |
| 744 |
- mirror://sourceforge/hpnssh/${HPN_PATCH} |
| 745 |
- )} |
| 746 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 747 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 748 |
- " |
| 749 |
- |
| 750 |
-LICENSE="BSD GPL-2" |
| 751 |
-SLOT="0" |
| 752 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 753 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 754 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509" |
| 755 |
-REQUIRED_USE="ldns? ( ssl ) |
| 756 |
- pie? ( !static ) |
| 757 |
- ssh1? ( ssl ) |
| 758 |
- static? ( !kerberos !pam ) |
| 759 |
- X509? ( !ldap ssl )" |
| 760 |
- |
| 761 |
-LIB_DEPEND=" |
| 762 |
- ldns? ( |
| 763 |
- net-libs/ldns[static-libs(+)] |
| 764 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 765 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 766 |
- ) |
| 767 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 768 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 769 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 770 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 771 |
- ssl? ( |
| 772 |
- !libressl? ( |
| 773 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 774 |
- dev-libs/openssl:0[static-libs(+)] |
| 775 |
- ) |
| 776 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 777 |
- ) |
| 778 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 779 |
-RDEPEND=" |
| 780 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 781 |
- pam? ( virtual/pam ) |
| 782 |
- kerberos? ( virtual/krb5 ) |
| 783 |
- ldap? ( net-nds/openldap )" |
| 784 |
-DEPEND="${RDEPEND} |
| 785 |
- static? ( ${LIB_DEPEND} ) |
| 786 |
- virtual/pkgconfig |
| 787 |
- virtual/os-headers |
| 788 |
- sys-devel/autoconf" |
| 789 |
-RDEPEND="${RDEPEND} |
| 790 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 791 |
- userland_GNU? ( virtual/shadow ) |
| 792 |
- X? ( x11-apps/xauth )" |
| 793 |
- |
| 794 |
-S=${WORKDIR}/${PARCH} |
| 795 |
- |
| 796 |
-pkg_setup() { |
| 797 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 798 |
- # than not be able to log in to their server any more |
| 799 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 800 |
- local fail=" |
| 801 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 802 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 803 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 804 |
- " |
| 805 |
- fail=$(echo ${fail}) |
| 806 |
- if [[ -n ${fail} ]] ; then |
| 807 |
- eerror "Sorry, but this version does not yet support features" |
| 808 |
- eerror "that you requested: ${fail}" |
| 809 |
- eerror "Please mask ${PF} for now and check back later:" |
| 810 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 811 |
- die "booooo" |
| 812 |
- fi |
| 813 |
- |
| 814 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 815 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 816 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 817 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 818 |
- fi |
| 819 |
-} |
| 820 |
- |
| 821 |
-save_version() { |
| 822 |
- # version.h patch conflict avoidence |
| 823 |
- mv version.h version.h.$1 |
| 824 |
- cp -f version.h.pristine version.h |
| 825 |
-} |
| 826 |
- |
| 827 |
-src_prepare() { |
| 828 |
- sed -i \ |
| 829 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 830 |
- pathnames.h || die |
| 831 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 832 |
- # this file. |
| 833 |
- cp version.h version.h.pristine |
| 834 |
- |
| 835 |
- # don't break .ssh/authorized_keys2 for fun |
| 836 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 837 |
- |
| 838 |
- if use X509 ; then |
| 839 |
- pushd .. >/dev/null |
| 840 |
- if use hpn ; then |
| 841 |
- pushd ${HPN_PATCH%.*.*} >/dev/null |
| 842 |
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch |
| 843 |
- popd >/dev/null |
| 844 |
- fi |
| 845 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch |
| 846 |
- popd >/dev/null |
| 847 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 848 |
- #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch |
| 849 |
- #save_version X509 |
| 850 |
- fi |
| 851 |
- if use ldap ; then |
| 852 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 853 |
- save_version LPK |
| 854 |
- fi |
| 855 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 856 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 857 |
- epatch "${WORKDIR}"/${SCTP_PATCH%.*} |
| 858 |
- if use hpn ; then |
| 859 |
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 860 |
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 861 |
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 862 |
- save_version HPN |
| 863 |
- fi |
| 864 |
- |
| 865 |
- tc-export PKG_CONFIG |
| 866 |
- local sed_args=( |
| 867 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 868 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 869 |
- -e 's:^PATH=/:#PATH=/:' |
| 870 |
- # Disable fortify flags ... our gcc does this for us |
| 871 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 872 |
- ) |
| 873 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 874 |
- use hppa && sed_args+=( |
| 875 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 876 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 877 |
- ) |
| 878 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 879 |
- |
| 880 |
- epatch_user #473004 |
| 881 |
- |
| 882 |
- # Now we can build a sane merged version.h |
| 883 |
- ( |
| 884 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 885 |
- macros=() |
| 886 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 887 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 888 |
- ) > version.h |
| 889 |
- |
| 890 |
- eautoreconf |
| 891 |
-} |
| 892 |
- |
| 893 |
-src_configure() { |
| 894 |
- addwrite /dev/ptmx |
| 895 |
- |
| 896 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 897 |
- use static && append-ldflags -static |
| 898 |
- |
| 899 |
- local myconf=( |
| 900 |
- --with-ldflags="${LDFLAGS}" |
| 901 |
- --disable-strip |
| 902 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 903 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 904 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 905 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 906 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 907 |
- --with-privsep-user=sshd |
| 908 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 909 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 910 |
- # unconditionally else we get unknown flag warnings. |
| 911 |
- $(use ldap && use_with ldap) |
| 912 |
- $(use_with ldns) |
| 913 |
- $(use_with libedit) |
| 914 |
- $(use_with pam) |
| 915 |
- $(use_with pie) |
| 916 |
- $(use_with sctp) |
| 917 |
- $(use_with selinux) |
| 918 |
- $(use_with skey) |
| 919 |
- $(use_with ssh1) |
| 920 |
- $(use_with ssl openssl) |
| 921 |
- $(use_with ssl md5-passwords) |
| 922 |
- $(use_with ssl ssl-engine) |
| 923 |
- ) |
| 924 |
- |
| 925 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 926 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 927 |
- |
| 928 |
- econf "${myconf[@]}" |
| 929 |
-} |
| 930 |
- |
| 931 |
-src_install() { |
| 932 |
- emake install-nokeys DESTDIR="${D}" |
| 933 |
- fperms 600 /etc/ssh/sshd_config |
| 934 |
- dobin contrib/ssh-copy-id |
| 935 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 936 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 937 |
- keepdir /var/empty |
| 938 |
- |
| 939 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 940 |
- if use pam ; then |
| 941 |
- sed -i \ |
| 942 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 943 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 944 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 945 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 946 |
- "${ED}"/etc/ssh/sshd_config || die |
| 947 |
- fi |
| 948 |
- |
| 949 |
- # Gentoo tweaks to default config files |
| 950 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 951 |
- |
| 952 |
- # Allow client to pass locale environment variables #367017 |
| 953 |
- AcceptEnv LANG LC_* |
| 954 |
- EOF |
| 955 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 956 |
- |
| 957 |
- # Send locale environment variables #367017 |
| 958 |
- SendEnv LANG LC_* |
| 959 |
- EOF |
| 960 |
- |
| 961 |
- if use livecd ; then |
| 962 |
- sed -i \ |
| 963 |
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ |
| 964 |
- "${ED}"/etc/ssh/sshd_config || die |
| 965 |
- fi |
| 966 |
- |
| 967 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 968 |
- insinto /etc/openldap/schema/ |
| 969 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 970 |
- fi |
| 971 |
- |
| 972 |
- doman contrib/ssh-copy-id.1 |
| 973 |
- dodoc CREDITS OVERVIEW README* TODO sshd_config |
| 974 |
- use X509 || dodoc ChangeLog |
| 975 |
- |
| 976 |
- diropts -m 0700 |
| 977 |
- dodir /etc/skel/.ssh |
| 978 |
- |
| 979 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 980 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 981 |
-} |
| 982 |
- |
| 983 |
-src_test() { |
| 984 |
- local t tests skipped failed passed shell |
| 985 |
- tests="interop-tests compat-tests" |
| 986 |
- skipped="" |
| 987 |
- shell=$(egetshell ${UID}) |
| 988 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 989 |
- elog "Running the full OpenSSH testsuite" |
| 990 |
- elog "requires a usable shell for the 'portage'" |
| 991 |
- elog "user, so we will run a subset only." |
| 992 |
- skipped="${skipped} tests" |
| 993 |
- else |
| 994 |
- tests="${tests} tests" |
| 995 |
- fi |
| 996 |
- # It will also attempt to write to the homedir .ssh |
| 997 |
- local sshhome=${T}/homedir |
| 998 |
- mkdir -p "${sshhome}"/.ssh |
| 999 |
- for t in ${tests} ; do |
| 1000 |
- # Some tests read from stdin ... |
| 1001 |
- HOMEDIR="${sshhome}" \ |
| 1002 |
- emake -k -j1 ${t} </dev/null \ |
| 1003 |
- && passed="${passed}${t} " \ |
| 1004 |
- || failed="${failed}${t} " |
| 1005 |
- done |
| 1006 |
- einfo "Passed tests: ${passed}" |
| 1007 |
- ewarn "Skipped tests: ${skipped}" |
| 1008 |
- if [[ -n ${failed} ]] ; then |
| 1009 |
- ewarn "Failed tests: ${failed}" |
| 1010 |
- die "Some tests failed: ${failed}" |
| 1011 |
- else |
| 1012 |
- einfo "Failed tests: ${failed}" |
| 1013 |
- return 0 |
| 1014 |
- fi |
| 1015 |
-} |
| 1016 |
- |
| 1017 |
-pkg_preinst() { |
| 1018 |
- enewgroup sshd 22 |
| 1019 |
- enewuser sshd 22 -1 /var/empty sshd |
| 1020 |
-} |
| 1021 |
- |
| 1022 |
-pkg_postinst() { |
| 1023 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 1024 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 1025 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 1026 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 1027 |
- fi |
| 1028 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 1029 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 1030 |
- fi |
| 1031 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 1032 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 1033 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 1034 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 1035 |
- fi |
| 1036 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 1037 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 1038 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 1039 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 1040 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 1041 |
- elog "You should however generate new keys using rsa or ed25519." |
| 1042 |
- |
| 1043 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 1044 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 1045 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 1046 |
- fi |
| 1047 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 1048 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 1049 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 1050 |
- elog "and update all clients/servers that utilize them." |
| 1051 |
- fi |
| 1052 |
-} |
| 1053 |
|
| 1054 |
diff --git a/net-misc/openssh/openssh-7.3_p1-r2.ebuild b/net-misc/openssh/openssh-7.3_p1-r2.ebuild |
| 1055 |
deleted file mode 100644 |
| 1056 |
index 753d73e..00000000 |
| 1057 |
--- a/net-misc/openssh/openssh-7.3_p1-r2.ebuild |
| 1058 |
+++ /dev/null |
| 1059 |
@@ -1,332 +0,0 @@ |
| 1060 |
-# Copyright 1999-2016 Gentoo Foundation |
| 1061 |
-# Distributed under the terms of the GNU General Public License v2 |
| 1062 |
-# $Id$ |
| 1063 |
- |
| 1064 |
-EAPI="5" |
| 1065 |
- |
| 1066 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 1067 |
- |
| 1068 |
-# Make it more portable between straight releases |
| 1069 |
-# and _p? releases. |
| 1070 |
-PARCH=${P/_} |
| 1071 |
- |
| 1072 |
-#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz" |
| 1073 |
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz" |
| 1074 |
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz" |
| 1075 |
-X509_VER="9.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 1076 |
- |
| 1077 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 1078 |
-HOMEPAGE="http://www.openssh.org/" |
| 1079 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 1080 |
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} |
| 1081 |
- ${HPN_PATCH:+hpn? ( |
| 1082 |
- mirror://gentoo/${HPN_PATCH} |
| 1083 |
- mirror://sourceforge/hpnssh/${HPN_PATCH} |
| 1084 |
- )} |
| 1085 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 1086 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 1087 |
- " |
| 1088 |
- |
| 1089 |
-LICENSE="BSD GPL-2" |
| 1090 |
-SLOT="0" |
| 1091 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 1092 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 1093 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509" |
| 1094 |
-REQUIRED_USE="ldns? ( ssl ) |
| 1095 |
- pie? ( !static ) |
| 1096 |
- ssh1? ( ssl ) |
| 1097 |
- static? ( !kerberos !pam ) |
| 1098 |
- X509? ( !ldap ssl )" |
| 1099 |
- |
| 1100 |
-LIB_DEPEND=" |
| 1101 |
- ldns? ( |
| 1102 |
- net-libs/ldns[static-libs(+)] |
| 1103 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 1104 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 1105 |
- ) |
| 1106 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 1107 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 1108 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 1109 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 1110 |
- ssl? ( |
| 1111 |
- !libressl? ( |
| 1112 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 1113 |
- dev-libs/openssl:0[static-libs(+)] |
| 1114 |
- ) |
| 1115 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 1116 |
- ) |
| 1117 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 1118 |
-RDEPEND=" |
| 1119 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 1120 |
- pam? ( virtual/pam ) |
| 1121 |
- kerberos? ( virtual/krb5 ) |
| 1122 |
- ldap? ( net-nds/openldap )" |
| 1123 |
-DEPEND="${RDEPEND} |
| 1124 |
- static? ( ${LIB_DEPEND} ) |
| 1125 |
- virtual/pkgconfig |
| 1126 |
- virtual/os-headers |
| 1127 |
- sys-devel/autoconf" |
| 1128 |
-RDEPEND="${RDEPEND} |
| 1129 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 1130 |
- userland_GNU? ( virtual/shadow ) |
| 1131 |
- X? ( x11-apps/xauth )" |
| 1132 |
- |
| 1133 |
-S=${WORKDIR}/${PARCH} |
| 1134 |
- |
| 1135 |
-pkg_setup() { |
| 1136 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 1137 |
- # than not be able to log in to their server any more |
| 1138 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 1139 |
- local fail=" |
| 1140 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 1141 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 1142 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 1143 |
- " |
| 1144 |
- fail=$(echo ${fail}) |
| 1145 |
- if [[ -n ${fail} ]] ; then |
| 1146 |
- eerror "Sorry, but this version does not yet support features" |
| 1147 |
- eerror "that you requested: ${fail}" |
| 1148 |
- eerror "Please mask ${PF} for now and check back later:" |
| 1149 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 1150 |
- die "booooo" |
| 1151 |
- fi |
| 1152 |
- |
| 1153 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 1154 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 1155 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 1156 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 1157 |
- fi |
| 1158 |
-} |
| 1159 |
- |
| 1160 |
-save_version() { |
| 1161 |
- # version.h patch conflict avoidence |
| 1162 |
- mv version.h version.h.$1 |
| 1163 |
- cp -f version.h.pristine version.h |
| 1164 |
-} |
| 1165 |
- |
| 1166 |
-src_prepare() { |
| 1167 |
- sed -i \ |
| 1168 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 1169 |
- pathnames.h || die |
| 1170 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 1171 |
- # this file. |
| 1172 |
- cp version.h version.h.pristine |
| 1173 |
- |
| 1174 |
- # don't break .ssh/authorized_keys2 for fun |
| 1175 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 1176 |
- |
| 1177 |
- if use X509 ; then |
| 1178 |
- pushd .. >/dev/null |
| 1179 |
- if use hpn ; then |
| 1180 |
- pushd ${HPN_PATCH%.*.*} >/dev/null |
| 1181 |
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch |
| 1182 |
- popd >/dev/null |
| 1183 |
- fi |
| 1184 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch |
| 1185 |
- popd >/dev/null |
| 1186 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 1187 |
- #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch |
| 1188 |
- #save_version X509 |
| 1189 |
- fi |
| 1190 |
- if use ldap ; then |
| 1191 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 1192 |
- save_version LPK |
| 1193 |
- fi |
| 1194 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 1195 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 1196 |
- epatch "${WORKDIR}"/${SCTP_PATCH%.*} |
| 1197 |
- if use hpn ; then |
| 1198 |
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 1199 |
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 1200 |
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 1201 |
- save_version HPN |
| 1202 |
- fi |
| 1203 |
- |
| 1204 |
- tc-export PKG_CONFIG |
| 1205 |
- local sed_args=( |
| 1206 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 1207 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 1208 |
- -e 's:^PATH=/:#PATH=/:' |
| 1209 |
- # Disable fortify flags ... our gcc does this for us |
| 1210 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 1211 |
- ) |
| 1212 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 1213 |
- use hppa && sed_args+=( |
| 1214 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 1215 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 1216 |
- ) |
| 1217 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 1218 |
- |
| 1219 |
- epatch_user #473004 |
| 1220 |
- |
| 1221 |
- # Now we can build a sane merged version.h |
| 1222 |
- ( |
| 1223 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 1224 |
- macros=() |
| 1225 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 1226 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 1227 |
- ) > version.h |
| 1228 |
- |
| 1229 |
- eautoreconf |
| 1230 |
-} |
| 1231 |
- |
| 1232 |
-src_configure() { |
| 1233 |
- addwrite /dev/ptmx |
| 1234 |
- |
| 1235 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 1236 |
- use static && append-ldflags -static |
| 1237 |
- |
| 1238 |
- local myconf=( |
| 1239 |
- --with-ldflags="${LDFLAGS}" |
| 1240 |
- --disable-strip |
| 1241 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 1242 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 1243 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 1244 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 1245 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 1246 |
- --with-privsep-user=sshd |
| 1247 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 1248 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 1249 |
- # unconditionally else we get unknown flag warnings. |
| 1250 |
- $(use ldap && use_with ldap) |
| 1251 |
- $(use_with ldns) |
| 1252 |
- $(use_with libedit) |
| 1253 |
- $(use_with pam) |
| 1254 |
- $(use_with pie) |
| 1255 |
- $(use_with sctp) |
| 1256 |
- $(use_with selinux) |
| 1257 |
- $(use_with skey) |
| 1258 |
- $(use_with ssh1) |
| 1259 |
- $(use_with ssl openssl) |
| 1260 |
- $(use_with ssl md5-passwords) |
| 1261 |
- $(use_with ssl ssl-engine) |
| 1262 |
- ) |
| 1263 |
- |
| 1264 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 1265 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 1266 |
- |
| 1267 |
- econf "${myconf[@]}" |
| 1268 |
-} |
| 1269 |
- |
| 1270 |
-src_install() { |
| 1271 |
- emake install-nokeys DESTDIR="${D}" |
| 1272 |
- fperms 600 /etc/ssh/sshd_config |
| 1273 |
- dobin contrib/ssh-copy-id |
| 1274 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 1275 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 1276 |
- keepdir /var/empty |
| 1277 |
- |
| 1278 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 1279 |
- if use pam ; then |
| 1280 |
- sed -i \ |
| 1281 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 1282 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 1283 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 1284 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 1285 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1286 |
- fi |
| 1287 |
- |
| 1288 |
- # Gentoo tweaks to default config files |
| 1289 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 1290 |
- |
| 1291 |
- # Allow client to pass locale environment variables #367017 |
| 1292 |
- AcceptEnv LANG LC_* |
| 1293 |
- EOF |
| 1294 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 1295 |
- |
| 1296 |
- # Send locale environment variables #367017 |
| 1297 |
- SendEnv LANG LC_* |
| 1298 |
- EOF |
| 1299 |
- |
| 1300 |
- if use livecd ; then |
| 1301 |
- sed -i \ |
| 1302 |
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ |
| 1303 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1304 |
- fi |
| 1305 |
- |
| 1306 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 1307 |
- insinto /etc/openldap/schema/ |
| 1308 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 1309 |
- fi |
| 1310 |
- |
| 1311 |
- doman contrib/ssh-copy-id.1 |
| 1312 |
- dodoc CREDITS OVERVIEW README* TODO sshd_config |
| 1313 |
- use X509 || dodoc ChangeLog |
| 1314 |
- |
| 1315 |
- diropts -m 0700 |
| 1316 |
- dodir /etc/skel/.ssh |
| 1317 |
- |
| 1318 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 1319 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 1320 |
-} |
| 1321 |
- |
| 1322 |
-src_test() { |
| 1323 |
- local t tests skipped failed passed shell |
| 1324 |
- tests="interop-tests compat-tests" |
| 1325 |
- skipped="" |
| 1326 |
- shell=$(egetshell ${UID}) |
| 1327 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 1328 |
- elog "Running the full OpenSSH testsuite" |
| 1329 |
- elog "requires a usable shell for the 'portage'" |
| 1330 |
- elog "user, so we will run a subset only." |
| 1331 |
- skipped="${skipped} tests" |
| 1332 |
- else |
| 1333 |
- tests="${tests} tests" |
| 1334 |
- fi |
| 1335 |
- # It will also attempt to write to the homedir .ssh |
| 1336 |
- local sshhome=${T}/homedir |
| 1337 |
- mkdir -p "${sshhome}"/.ssh |
| 1338 |
- for t in ${tests} ; do |
| 1339 |
- # Some tests read from stdin ... |
| 1340 |
- HOMEDIR="${sshhome}" \ |
| 1341 |
- emake -k -j1 ${t} </dev/null \ |
| 1342 |
- && passed="${passed}${t} " \ |
| 1343 |
- || failed="${failed}${t} " |
| 1344 |
- done |
| 1345 |
- einfo "Passed tests: ${passed}" |
| 1346 |
- ewarn "Skipped tests: ${skipped}" |
| 1347 |
- if [[ -n ${failed} ]] ; then |
| 1348 |
- ewarn "Failed tests: ${failed}" |
| 1349 |
- die "Some tests failed: ${failed}" |
| 1350 |
- else |
| 1351 |
- einfo "Failed tests: ${failed}" |
| 1352 |
- return 0 |
| 1353 |
- fi |
| 1354 |
-} |
| 1355 |
- |
| 1356 |
-pkg_preinst() { |
| 1357 |
- enewgroup sshd 22 |
| 1358 |
- enewuser sshd 22 -1 /var/empty sshd |
| 1359 |
-} |
| 1360 |
- |
| 1361 |
-pkg_postinst() { |
| 1362 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 1363 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 1364 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 1365 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 1366 |
- fi |
| 1367 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 1368 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 1369 |
- fi |
| 1370 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 1371 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 1372 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 1373 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 1374 |
- fi |
| 1375 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 1376 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 1377 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 1378 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 1379 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 1380 |
- elog "You should however generate new keys using rsa or ed25519." |
| 1381 |
- |
| 1382 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 1383 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 1384 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 1385 |
- fi |
| 1386 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 1387 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 1388 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 1389 |
- elog "and update all clients/servers that utilize them." |
| 1390 |
- fi |
| 1391 |
-} |
| 1392 |
|
| 1393 |
diff --git a/net-misc/openssh/openssh-7.3_p1-r3.ebuild b/net-misc/openssh/openssh-7.3_p1-r3.ebuild |
| 1394 |
deleted file mode 100644 |
| 1395 |
index 0e26a92..00000000 |
| 1396 |
--- a/net-misc/openssh/openssh-7.3_p1-r3.ebuild |
| 1397 |
+++ /dev/null |
| 1398 |
@@ -1,338 +0,0 @@ |
| 1399 |
-# Copyright 1999-2016 Gentoo Foundation |
| 1400 |
-# Distributed under the terms of the GNU General Public License v2 |
| 1401 |
-# $Id$ |
| 1402 |
- |
| 1403 |
-EAPI="5" |
| 1404 |
- |
| 1405 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 1406 |
- |
| 1407 |
-# Make it more portable between straight releases |
| 1408 |
-# and _p? releases. |
| 1409 |
-PARCH=${P/_} |
| 1410 |
-HPN_PV="${PV}" |
| 1411 |
-HPN_VER="14.10" |
| 1412 |
- |
| 1413 |
-HPN_PATCH="${PN}-${HPN_PV}-hpn-14.10.patch" |
| 1414 |
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz" |
| 1415 |
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz" |
| 1416 |
-X509_VER="9.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 1417 |
- |
| 1418 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 1419 |
-HOMEPAGE="http://www.openssh.org/" |
| 1420 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 1421 |
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} |
| 1422 |
- ${HPN_PATCH:+hpn? ( |
| 1423 |
- mirror://gentoo/${HPN_PATCH}.xz |
| 1424 |
- http://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz |
| 1425 |
- )} |
| 1426 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 1427 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 1428 |
- " |
| 1429 |
- |
| 1430 |
-LICENSE="BSD GPL-2" |
| 1431 |
-SLOT="0" |
| 1432 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 1433 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 1434 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509" |
| 1435 |
-REQUIRED_USE="ldns? ( ssl ) |
| 1436 |
- pie? ( !static ) |
| 1437 |
- ssh1? ( ssl ) |
| 1438 |
- static? ( !kerberos !pam ) |
| 1439 |
- X509? ( !ldap ssl ) |
| 1440 |
- test? ( ssl )" |
| 1441 |
- |
| 1442 |
-LIB_DEPEND=" |
| 1443 |
- ldns? ( |
| 1444 |
- net-libs/ldns[static-libs(+)] |
| 1445 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 1446 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 1447 |
- ) |
| 1448 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 1449 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 1450 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 1451 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 1452 |
- ssl? ( |
| 1453 |
- !libressl? ( |
| 1454 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 1455 |
- dev-libs/openssl:0[static-libs(+)] |
| 1456 |
- ) |
| 1457 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 1458 |
- ) |
| 1459 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 1460 |
-RDEPEND=" |
| 1461 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 1462 |
- pam? ( virtual/pam ) |
| 1463 |
- kerberos? ( virtual/krb5 ) |
| 1464 |
- ldap? ( net-nds/openldap )" |
| 1465 |
-DEPEND="${RDEPEND} |
| 1466 |
- static? ( ${LIB_DEPEND} ) |
| 1467 |
- virtual/pkgconfig |
| 1468 |
- virtual/os-headers |
| 1469 |
- sys-devel/autoconf" |
| 1470 |
-RDEPEND="${RDEPEND} |
| 1471 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 1472 |
- userland_GNU? ( virtual/shadow ) |
| 1473 |
- X? ( x11-apps/xauth )" |
| 1474 |
- |
| 1475 |
-S=${WORKDIR}/${PARCH} |
| 1476 |
- |
| 1477 |
-pkg_setup() { |
| 1478 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 1479 |
- # than not be able to log in to their server any more |
| 1480 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 1481 |
- local fail=" |
| 1482 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 1483 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 1484 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 1485 |
- " |
| 1486 |
- fail=$(echo ${fail}) |
| 1487 |
- if [[ -n ${fail} ]] ; then |
| 1488 |
- eerror "Sorry, but this version does not yet support features" |
| 1489 |
- eerror "that you requested: ${fail}" |
| 1490 |
- eerror "Please mask ${PF} for now and check back later:" |
| 1491 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 1492 |
- die "booooo" |
| 1493 |
- fi |
| 1494 |
- |
| 1495 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 1496 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 1497 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 1498 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 1499 |
- fi |
| 1500 |
-} |
| 1501 |
- |
| 1502 |
-save_version() { |
| 1503 |
- # version.h patch conflict avoidence |
| 1504 |
- mv version.h version.h.$1 |
| 1505 |
- cp -f version.h.pristine version.h |
| 1506 |
-} |
| 1507 |
- |
| 1508 |
-src_prepare() { |
| 1509 |
- sed -i \ |
| 1510 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 1511 |
- pathnames.h || die |
| 1512 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 1513 |
- # this file. |
| 1514 |
- cp version.h version.h.pristine |
| 1515 |
- |
| 1516 |
- # don't break .ssh/authorized_keys2 for fun |
| 1517 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 1518 |
- |
| 1519 |
- if use X509 ; then |
| 1520 |
- pushd .. >/dev/null |
| 1521 |
- if use hpn ; then |
| 1522 |
- pushd "${WORKDIR}" >/dev/null |
| 1523 |
- epatch "${FILESDIR}"/${P}-hpn-x509-glue.patch |
| 1524 |
- popd >/dev/null |
| 1525 |
- fi |
| 1526 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch |
| 1527 |
- popd >/dev/null |
| 1528 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 1529 |
- save_version X509 |
| 1530 |
- fi |
| 1531 |
- if use ldap ; then |
| 1532 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 1533 |
- save_version LPK |
| 1534 |
- fi |
| 1535 |
- |
| 1536 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 1537 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 1538 |
- epatch "${WORKDIR}"/${SCTP_PATCH%.*} |
| 1539 |
- |
| 1540 |
- if use hpn ; then |
| 1541 |
- #EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 1542 |
- # EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 1543 |
- # epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 1544 |
- epatch "${WORKDIR}"/${HPN_PATCH} |
| 1545 |
- epatch "${FILESDIR}"/${P}-hpn-cipher-ctr-mt-no-deadlocks.patch |
| 1546 |
- save_version HPN |
| 1547 |
- fi |
| 1548 |
- |
| 1549 |
- tc-export PKG_CONFIG |
| 1550 |
- local sed_args=( |
| 1551 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 1552 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 1553 |
- -e 's:^PATH=/:#PATH=/:' |
| 1554 |
- # Disable fortify flags ... our gcc does this for us |
| 1555 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 1556 |
- ) |
| 1557 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 1558 |
- use hppa && sed_args+=( |
| 1559 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 1560 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 1561 |
- ) |
| 1562 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 1563 |
- |
| 1564 |
- epatch_user #473004 |
| 1565 |
- |
| 1566 |
- # Now we can build a sane merged version.h |
| 1567 |
- ( |
| 1568 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 1569 |
- macros=() |
| 1570 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 1571 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 1572 |
- ) > version.h |
| 1573 |
- |
| 1574 |
- eautoreconf |
| 1575 |
-} |
| 1576 |
- |
| 1577 |
-src_configure() { |
| 1578 |
- addwrite /dev/ptmx |
| 1579 |
- |
| 1580 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 1581 |
- use static && append-ldflags -static |
| 1582 |
- |
| 1583 |
- local myconf=( |
| 1584 |
- --with-ldflags="${LDFLAGS}" |
| 1585 |
- --disable-strip |
| 1586 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 1587 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 1588 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 1589 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 1590 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 1591 |
- --with-privsep-user=sshd |
| 1592 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 1593 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 1594 |
- # unconditionally else we get unknown flag warnings. |
| 1595 |
- $(use ldap && use_with ldap) |
| 1596 |
- $(use_with ldns) |
| 1597 |
- $(use_with libedit) |
| 1598 |
- $(use_with pam) |
| 1599 |
- $(use_with pie) |
| 1600 |
- $(use_with sctp) |
| 1601 |
- $(use_with selinux) |
| 1602 |
- $(use_with skey) |
| 1603 |
- $(use_with ssh1) |
| 1604 |
- $(use_with ssl openssl) |
| 1605 |
- $(use_with ssl md5-passwords) |
| 1606 |
- $(use_with ssl ssl-engine) |
| 1607 |
- ) |
| 1608 |
- |
| 1609 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 1610 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 1611 |
- |
| 1612 |
- econf "${myconf[@]}" |
| 1613 |
-} |
| 1614 |
- |
| 1615 |
-src_install() { |
| 1616 |
- emake install-nokeys DESTDIR="${D}" |
| 1617 |
- fperms 600 /etc/ssh/sshd_config |
| 1618 |
- dobin contrib/ssh-copy-id |
| 1619 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 1620 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 1621 |
- keepdir /var/empty |
| 1622 |
- |
| 1623 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 1624 |
- if use pam ; then |
| 1625 |
- sed -i \ |
| 1626 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 1627 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 1628 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 1629 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 1630 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1631 |
- fi |
| 1632 |
- |
| 1633 |
- # Gentoo tweaks to default config files |
| 1634 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 1635 |
- |
| 1636 |
- # Allow client to pass locale environment variables #367017 |
| 1637 |
- AcceptEnv LANG LC_* |
| 1638 |
- EOF |
| 1639 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 1640 |
- |
| 1641 |
- # Send locale environment variables #367017 |
| 1642 |
- SendEnv LANG LC_* |
| 1643 |
- EOF |
| 1644 |
- |
| 1645 |
- if use livecd ; then |
| 1646 |
- sed -i \ |
| 1647 |
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ |
| 1648 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1649 |
- fi |
| 1650 |
- |
| 1651 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 1652 |
- insinto /etc/openldap/schema/ |
| 1653 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 1654 |
- fi |
| 1655 |
- |
| 1656 |
- doman contrib/ssh-copy-id.1 |
| 1657 |
- dodoc CREDITS OVERVIEW README* TODO sshd_config |
| 1658 |
- use X509 || dodoc ChangeLog |
| 1659 |
- |
| 1660 |
- diropts -m 0700 |
| 1661 |
- dodir /etc/skel/.ssh |
| 1662 |
- |
| 1663 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 1664 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 1665 |
-} |
| 1666 |
- |
| 1667 |
-src_test() { |
| 1668 |
- local t tests skipped failed passed shell |
| 1669 |
- tests="interop-tests compat-tests" |
| 1670 |
- skipped="" |
| 1671 |
- shell=$(egetshell ${UID}) |
| 1672 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 1673 |
- elog "Running the full OpenSSH testsuite" |
| 1674 |
- elog "requires a usable shell for the 'portage'" |
| 1675 |
- elog "user, so we will run a subset only." |
| 1676 |
- skipped="${skipped} tests" |
| 1677 |
- else |
| 1678 |
- tests="${tests} tests" |
| 1679 |
- fi |
| 1680 |
- # It will also attempt to write to the homedir .ssh |
| 1681 |
- local sshhome=${T}/homedir |
| 1682 |
- mkdir -p "${sshhome}"/.ssh |
| 1683 |
- for t in ${tests} ; do |
| 1684 |
- # Some tests read from stdin ... |
| 1685 |
- HOMEDIR="${sshhome}" HOME="${sshhome}" \ |
| 1686 |
- emake -k -j1 ${t} </dev/null \ |
| 1687 |
- && passed="${passed}${t} " \ |
| 1688 |
- || failed="${failed}${t} " |
| 1689 |
- done |
| 1690 |
- einfo "Passed tests: ${passed}" |
| 1691 |
- ewarn "Skipped tests: ${skipped}" |
| 1692 |
- if [[ -n ${failed} ]] ; then |
| 1693 |
- ewarn "Failed tests: ${failed}" |
| 1694 |
- die "Some tests failed: ${failed}" |
| 1695 |
- else |
| 1696 |
- einfo "Failed tests: ${failed}" |
| 1697 |
- return 0 |
| 1698 |
- fi |
| 1699 |
-} |
| 1700 |
- |
| 1701 |
-pkg_preinst() { |
| 1702 |
- enewgroup sshd 22 |
| 1703 |
- enewuser sshd 22 -1 /var/empty sshd |
| 1704 |
-} |
| 1705 |
- |
| 1706 |
-pkg_postinst() { |
| 1707 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 1708 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 1709 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 1710 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 1711 |
- fi |
| 1712 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 1713 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 1714 |
- fi |
| 1715 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 1716 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 1717 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 1718 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 1719 |
- fi |
| 1720 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 1721 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 1722 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 1723 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 1724 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 1725 |
- elog "You should however generate new keys using rsa or ed25519." |
| 1726 |
- |
| 1727 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 1728 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 1729 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 1730 |
- fi |
| 1731 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 1732 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 1733 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 1734 |
- elog "and update all clients/servers that utilize them." |
| 1735 |
- fi |
| 1736 |
-} |
| 1737 |
|
| 1738 |
diff --git a/net-misc/openssh/openssh-7.3_p1-r4.ebuild b/net-misc/openssh/openssh-7.3_p1-r4.ebuild |
| 1739 |
deleted file mode 100644 |
| 1740 |
index 27291c9..00000000 |
| 1741 |
--- a/net-misc/openssh/openssh-7.3_p1-r4.ebuild |
| 1742 |
+++ /dev/null |
| 1743 |
@@ -1,339 +0,0 @@ |
| 1744 |
-# Copyright 1999-2016 Gentoo Foundation |
| 1745 |
-# Distributed under the terms of the GNU General Public License v2 |
| 1746 |
-# $Id$ |
| 1747 |
- |
| 1748 |
-EAPI="5" |
| 1749 |
- |
| 1750 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 1751 |
- |
| 1752 |
-# Make it more portable between straight releases |
| 1753 |
-# and _p? releases. |
| 1754 |
-PARCH=${P/_} |
| 1755 |
-HPN_PV="${PV}" |
| 1756 |
-HPN_VER="14.10" |
| 1757 |
- |
| 1758 |
-HPN_PATCH="${PN}-${HPN_PV}-hpn-14.10.patch" |
| 1759 |
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz" |
| 1760 |
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz" |
| 1761 |
-X509_VER="9.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 1762 |
- |
| 1763 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 1764 |
-HOMEPAGE="http://www.openssh.org/" |
| 1765 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 1766 |
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} |
| 1767 |
- ${HPN_PATCH:+hpn? ( |
| 1768 |
- mirror://gentoo/${HPN_PATCH}.xz |
| 1769 |
- http://dev.gentoo.org/~chutzpah/${HPN_PATCH}.xz |
| 1770 |
- )} |
| 1771 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 1772 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 1773 |
- " |
| 1774 |
- |
| 1775 |
-LICENSE="BSD GPL-2" |
| 1776 |
-SLOT="0" |
| 1777 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 1778 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 1779 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509" |
| 1780 |
-REQUIRED_USE="ldns? ( ssl ) |
| 1781 |
- pie? ( !static ) |
| 1782 |
- ssh1? ( ssl ) |
| 1783 |
- static? ( !kerberos !pam ) |
| 1784 |
- X509? ( !ldap ssl ) |
| 1785 |
- test? ( ssl )" |
| 1786 |
- |
| 1787 |
-LIB_DEPEND=" |
| 1788 |
- ldns? ( |
| 1789 |
- net-libs/ldns[static-libs(+)] |
| 1790 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 1791 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 1792 |
- ) |
| 1793 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 1794 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 1795 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 1796 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 1797 |
- ssl? ( |
| 1798 |
- !libressl? ( |
| 1799 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 1800 |
- dev-libs/openssl:0[static-libs(+)] |
| 1801 |
- ) |
| 1802 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 1803 |
- ) |
| 1804 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 1805 |
-RDEPEND=" |
| 1806 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 1807 |
- pam? ( virtual/pam ) |
| 1808 |
- kerberos? ( virtual/krb5 ) |
| 1809 |
- ldap? ( net-nds/openldap )" |
| 1810 |
-DEPEND="${RDEPEND} |
| 1811 |
- static? ( ${LIB_DEPEND} ) |
| 1812 |
- virtual/pkgconfig |
| 1813 |
- virtual/os-headers |
| 1814 |
- sys-devel/autoconf" |
| 1815 |
-RDEPEND="${RDEPEND} |
| 1816 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 1817 |
- userland_GNU? ( virtual/shadow ) |
| 1818 |
- X? ( x11-apps/xauth )" |
| 1819 |
- |
| 1820 |
-S=${WORKDIR}/${PARCH} |
| 1821 |
- |
| 1822 |
-pkg_setup() { |
| 1823 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 1824 |
- # than not be able to log in to their server any more |
| 1825 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 1826 |
- local fail=" |
| 1827 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 1828 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 1829 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 1830 |
- " |
| 1831 |
- fail=$(echo ${fail}) |
| 1832 |
- if [[ -n ${fail} ]] ; then |
| 1833 |
- eerror "Sorry, but this version does not yet support features" |
| 1834 |
- eerror "that you requested: ${fail}" |
| 1835 |
- eerror "Please mask ${PF} for now and check back later:" |
| 1836 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 1837 |
- die "booooo" |
| 1838 |
- fi |
| 1839 |
- |
| 1840 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 1841 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 1842 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 1843 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 1844 |
- fi |
| 1845 |
-} |
| 1846 |
- |
| 1847 |
-save_version() { |
| 1848 |
- # version.h patch conflict avoidence |
| 1849 |
- mv version.h version.h.$1 |
| 1850 |
- cp -f version.h.pristine version.h |
| 1851 |
-} |
| 1852 |
- |
| 1853 |
-src_prepare() { |
| 1854 |
- sed -i \ |
| 1855 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 1856 |
- pathnames.h || die |
| 1857 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 1858 |
- # this file. |
| 1859 |
- cp version.h version.h.pristine |
| 1860 |
- |
| 1861 |
- # don't break .ssh/authorized_keys2 for fun |
| 1862 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 1863 |
- |
| 1864 |
- if use X509 ; then |
| 1865 |
- pushd .. >/dev/null |
| 1866 |
- if use hpn ; then |
| 1867 |
- pushd "${WORKDIR}" >/dev/null |
| 1868 |
- epatch "${FILESDIR}"/${P}-hpn-x509-glue.patch |
| 1869 |
- popd >/dev/null |
| 1870 |
- fi |
| 1871 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-sctp-x509-glue.patch |
| 1872 |
- popd >/dev/null |
| 1873 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 1874 |
- epatch "${FILESDIR}"/${P}-fix-segfault-with-x509.patch |
| 1875 |
- #save_version X509 |
| 1876 |
- fi |
| 1877 |
- if use ldap ; then |
| 1878 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 1879 |
- save_version LPK |
| 1880 |
- fi |
| 1881 |
- |
| 1882 |
- epatch "${FILESDIR}"/${PN}-7.3_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 1883 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 1884 |
- epatch "${WORKDIR}"/${SCTP_PATCH%.*} |
| 1885 |
- |
| 1886 |
- if use hpn ; then |
| 1887 |
- #EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 1888 |
- # EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 1889 |
- # epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 1890 |
- epatch "${WORKDIR}"/${HPN_PATCH} |
| 1891 |
- epatch "${FILESDIR}"/${P}-hpn-cipher-ctr-mt-no-deadlocks.patch |
| 1892 |
- save_version HPN |
| 1893 |
- fi |
| 1894 |
- |
| 1895 |
- tc-export PKG_CONFIG |
| 1896 |
- local sed_args=( |
| 1897 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 1898 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 1899 |
- -e 's:^PATH=/:#PATH=/:' |
| 1900 |
- # Disable fortify flags ... our gcc does this for us |
| 1901 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 1902 |
- ) |
| 1903 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 1904 |
- use hppa && sed_args+=( |
| 1905 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 1906 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 1907 |
- ) |
| 1908 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 1909 |
- |
| 1910 |
- epatch_user #473004 |
| 1911 |
- |
| 1912 |
- # Now we can build a sane merged version.h |
| 1913 |
- ( |
| 1914 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 1915 |
- macros=() |
| 1916 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 1917 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 1918 |
- ) > version.h |
| 1919 |
- |
| 1920 |
- eautoreconf |
| 1921 |
-} |
| 1922 |
- |
| 1923 |
-src_configure() { |
| 1924 |
- addwrite /dev/ptmx |
| 1925 |
- |
| 1926 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 1927 |
- use static && append-ldflags -static |
| 1928 |
- |
| 1929 |
- local myconf=( |
| 1930 |
- --with-ldflags="${LDFLAGS}" |
| 1931 |
- --disable-strip |
| 1932 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 1933 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 1934 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 1935 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 1936 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 1937 |
- --with-privsep-user=sshd |
| 1938 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 1939 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 1940 |
- # unconditionally else we get unknown flag warnings. |
| 1941 |
- $(use ldap && use_with ldap) |
| 1942 |
- $(use_with ldns) |
| 1943 |
- $(use_with libedit) |
| 1944 |
- $(use_with pam) |
| 1945 |
- $(use_with pie) |
| 1946 |
- $(use_with sctp) |
| 1947 |
- $(use_with selinux) |
| 1948 |
- $(use_with skey) |
| 1949 |
- $(use_with ssh1) |
| 1950 |
- $(use_with ssl openssl) |
| 1951 |
- $(use_with ssl md5-passwords) |
| 1952 |
- $(use_with ssl ssl-engine) |
| 1953 |
- ) |
| 1954 |
- |
| 1955 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 1956 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 1957 |
- |
| 1958 |
- econf "${myconf[@]}" |
| 1959 |
-} |
| 1960 |
- |
| 1961 |
-src_install() { |
| 1962 |
- emake install-nokeys DESTDIR="${D}" |
| 1963 |
- fperms 600 /etc/ssh/sshd_config |
| 1964 |
- dobin contrib/ssh-copy-id |
| 1965 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 1966 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 1967 |
- keepdir /var/empty |
| 1968 |
- |
| 1969 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 1970 |
- if use pam ; then |
| 1971 |
- sed -i \ |
| 1972 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 1973 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 1974 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 1975 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 1976 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1977 |
- fi |
| 1978 |
- |
| 1979 |
- # Gentoo tweaks to default config files |
| 1980 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 1981 |
- |
| 1982 |
- # Allow client to pass locale environment variables #367017 |
| 1983 |
- AcceptEnv LANG LC_* |
| 1984 |
- EOF |
| 1985 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 1986 |
- |
| 1987 |
- # Send locale environment variables #367017 |
| 1988 |
- SendEnv LANG LC_* |
| 1989 |
- EOF |
| 1990 |
- |
| 1991 |
- if use livecd ; then |
| 1992 |
- sed -i \ |
| 1993 |
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ |
| 1994 |
- "${ED}"/etc/ssh/sshd_config || die |
| 1995 |
- fi |
| 1996 |
- |
| 1997 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 1998 |
- insinto /etc/openldap/schema/ |
| 1999 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 2000 |
- fi |
| 2001 |
- |
| 2002 |
- doman contrib/ssh-copy-id.1 |
| 2003 |
- dodoc CREDITS OVERVIEW README* TODO sshd_config |
| 2004 |
- use X509 || dodoc ChangeLog |
| 2005 |
- |
| 2006 |
- diropts -m 0700 |
| 2007 |
- dodir /etc/skel/.ssh |
| 2008 |
- |
| 2009 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 2010 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 2011 |
-} |
| 2012 |
- |
| 2013 |
-src_test() { |
| 2014 |
- local t tests skipped failed passed shell |
| 2015 |
- tests="interop-tests compat-tests" |
| 2016 |
- skipped="" |
| 2017 |
- shell=$(egetshell ${UID}) |
| 2018 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 2019 |
- elog "Running the full OpenSSH testsuite" |
| 2020 |
- elog "requires a usable shell for the 'portage'" |
| 2021 |
- elog "user, so we will run a subset only." |
| 2022 |
- skipped="${skipped} tests" |
| 2023 |
- else |
| 2024 |
- tests="${tests} tests" |
| 2025 |
- fi |
| 2026 |
- # It will also attempt to write to the homedir .ssh |
| 2027 |
- local sshhome=${T}/homedir |
| 2028 |
- mkdir -p "${sshhome}"/.ssh |
| 2029 |
- for t in ${tests} ; do |
| 2030 |
- # Some tests read from stdin ... |
| 2031 |
- HOMEDIR="${sshhome}" HOME="${sshhome}" \ |
| 2032 |
- emake -k -j1 ${t} </dev/null \ |
| 2033 |
- && passed="${passed}${t} " \ |
| 2034 |
- || failed="${failed}${t} " |
| 2035 |
- done |
| 2036 |
- einfo "Passed tests: ${passed}" |
| 2037 |
- ewarn "Skipped tests: ${skipped}" |
| 2038 |
- if [[ -n ${failed} ]] ; then |
| 2039 |
- ewarn "Failed tests: ${failed}" |
| 2040 |
- die "Some tests failed: ${failed}" |
| 2041 |
- else |
| 2042 |
- einfo "Failed tests: ${failed}" |
| 2043 |
- return 0 |
| 2044 |
- fi |
| 2045 |
-} |
| 2046 |
- |
| 2047 |
-pkg_preinst() { |
| 2048 |
- enewgroup sshd 22 |
| 2049 |
- enewuser sshd 22 -1 /var/empty sshd |
| 2050 |
-} |
| 2051 |
- |
| 2052 |
-pkg_postinst() { |
| 2053 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 2054 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 2055 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 2056 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 2057 |
- fi |
| 2058 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 2059 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 2060 |
- fi |
| 2061 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 2062 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 2063 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 2064 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 2065 |
- fi |
| 2066 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 2067 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 2068 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 2069 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 2070 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 2071 |
- elog "You should however generate new keys using rsa or ed25519." |
| 2072 |
- |
| 2073 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 2074 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 2075 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 2076 |
- fi |
| 2077 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 2078 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 2079 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 2080 |
- elog "and update all clients/servers that utilize them." |
| 2081 |
- fi |
| 2082 |
-} |
| 2083 |
|
| 2084 |
diff --git a/net-misc/openssh/openssh-7.3_p1.ebuild b/net-misc/openssh/openssh-7.3_p1.ebuild |
| 2085 |
deleted file mode 100644 |
| 2086 |
index 871c3c4..00000000 |
| 2087 |
--- a/net-misc/openssh/openssh-7.3_p1.ebuild |
| 2088 |
+++ /dev/null |
| 2089 |
@@ -1,331 +0,0 @@ |
| 2090 |
-# Copyright 1999-2016 Gentoo Foundation |
| 2091 |
-# Distributed under the terms of the GNU General Public License v2 |
| 2092 |
-# $Id$ |
| 2093 |
- |
| 2094 |
-EAPI="5" |
| 2095 |
- |
| 2096 |
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator |
| 2097 |
- |
| 2098 |
-# Make it more portable between straight releases |
| 2099 |
-# and _p? releases. |
| 2100 |
-PARCH=${P/_} |
| 2101 |
- |
| 2102 |
-#HPN_PATCH="${PARCH}-hpnssh14v10.tar.xz" |
| 2103 |
-SCTP_PATCH="${PN}-7.3_p1-sctp.patch.xz" |
| 2104 |
-LDAP_PATCH="${PN}-lpk-7.3p1-0.3.14.patch.xz" |
| 2105 |
-#X509_VER="8.9" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" |
| 2106 |
- |
| 2107 |
-DESCRIPTION="Port of OpenBSD's free SSH release" |
| 2108 |
-HOMEPAGE="http://www.openssh.org/" |
| 2109 |
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz |
| 2110 |
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} |
| 2111 |
- ${HPN_PATCH:+hpn? ( |
| 2112 |
- mirror://gentoo/${HPN_PATCH} |
| 2113 |
- mirror://sourceforge/hpnssh/${HPN_PATCH} |
| 2114 |
- )} |
| 2115 |
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} |
| 2116 |
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} |
| 2117 |
- " |
| 2118 |
- |
| 2119 |
-LICENSE="BSD GPL-2" |
| 2120 |
-SLOT="0" |
| 2121 |
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" |
| 2122 |
-# Probably want to drop ssl defaulting to on in a future version. |
| 2123 |
-IUSE="bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static X X509" |
| 2124 |
-REQUIRED_USE="ldns? ( ssl ) |
| 2125 |
- pie? ( !static ) |
| 2126 |
- ssh1? ( ssl ) |
| 2127 |
- static? ( !kerberos !pam ) |
| 2128 |
- X509? ( !ldap ssl )" |
| 2129 |
- |
| 2130 |
-LIB_DEPEND=" |
| 2131 |
- ldns? ( |
| 2132 |
- net-libs/ldns[static-libs(+)] |
| 2133 |
- !bindist? ( net-libs/ldns[ecdsa,ssl] ) |
| 2134 |
- bindist? ( net-libs/ldns[-ecdsa,ssl] ) |
| 2135 |
- ) |
| 2136 |
- libedit? ( dev-libs/libedit[static-libs(+)] ) |
| 2137 |
- sctp? ( net-misc/lksctp-tools[static-libs(+)] ) |
| 2138 |
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) |
| 2139 |
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) |
| 2140 |
- ssl? ( |
| 2141 |
- !libressl? ( |
| 2142 |
- >=dev-libs/openssl-0.9.8f:0[bindist=] |
| 2143 |
- dev-libs/openssl:0[static-libs(+)] |
| 2144 |
- ) |
| 2145 |
- libressl? ( dev-libs/libressl[static-libs(+)] ) |
| 2146 |
- ) |
| 2147 |
- >=sys-libs/zlib-1.2.3[static-libs(+)]" |
| 2148 |
-RDEPEND=" |
| 2149 |
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) |
| 2150 |
- pam? ( virtual/pam ) |
| 2151 |
- kerberos? ( virtual/krb5 ) |
| 2152 |
- ldap? ( net-nds/openldap )" |
| 2153 |
-DEPEND="${RDEPEND} |
| 2154 |
- static? ( ${LIB_DEPEND} ) |
| 2155 |
- virtual/pkgconfig |
| 2156 |
- virtual/os-headers |
| 2157 |
- sys-devel/autoconf" |
| 2158 |
-RDEPEND="${RDEPEND} |
| 2159 |
- pam? ( >=sys-auth/pambase-20081028 ) |
| 2160 |
- userland_GNU? ( virtual/shadow ) |
| 2161 |
- X? ( x11-apps/xauth )" |
| 2162 |
- |
| 2163 |
-S=${WORKDIR}/${PARCH} |
| 2164 |
- |
| 2165 |
-pkg_setup() { |
| 2166 |
- # this sucks, but i'd rather have people unable to `emerge -u openssh` |
| 2167 |
- # than not be able to log in to their server any more |
| 2168 |
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } |
| 2169 |
- local fail=" |
| 2170 |
- $(use X509 && maybe_fail X509 X509_PATCH) |
| 2171 |
- $(use ldap && maybe_fail ldap LDAP_PATCH) |
| 2172 |
- $(use hpn && maybe_fail hpn HPN_PATCH) |
| 2173 |
- " |
| 2174 |
- fail=$(echo ${fail}) |
| 2175 |
- if [[ -n ${fail} ]] ; then |
| 2176 |
- eerror "Sorry, but this version does not yet support features" |
| 2177 |
- eerror "that you requested: ${fail}" |
| 2178 |
- eerror "Please mask ${PF} for now and check back later:" |
| 2179 |
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" |
| 2180 |
- die "booooo" |
| 2181 |
- fi |
| 2182 |
- |
| 2183 |
- # Make sure people who are using tcp wrappers are notified of its removal. #531156 |
| 2184 |
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then |
| 2185 |
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" |
| 2186 |
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." |
| 2187 |
- fi |
| 2188 |
-} |
| 2189 |
- |
| 2190 |
-save_version() { |
| 2191 |
- # version.h patch conflict avoidence |
| 2192 |
- mv version.h version.h.$1 |
| 2193 |
- cp -f version.h.pristine version.h |
| 2194 |
-} |
| 2195 |
- |
| 2196 |
-src_prepare() { |
| 2197 |
- sed -i \ |
| 2198 |
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ |
| 2199 |
- pathnames.h || die |
| 2200 |
- # keep this as we need it to avoid the conflict between LPK and HPN changing |
| 2201 |
- # this file. |
| 2202 |
- cp version.h version.h.pristine |
| 2203 |
- |
| 2204 |
- # don't break .ssh/authorized_keys2 for fun |
| 2205 |
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die |
| 2206 |
- |
| 2207 |
- if use X509 ; then |
| 2208 |
- pushd .. >/dev/null |
| 2209 |
- if use hpn ; then |
| 2210 |
- pushd ${HPN_PATCH%.*.*} >/dev/null |
| 2211 |
- epatch "${FILESDIR}"/${PN}-7.1_p1-hpn-x509-glue.patch |
| 2212 |
- popd >/dev/null |
| 2213 |
- fi |
| 2214 |
- epatch "${FILESDIR}"/${PN}-7.2_p1-sctp-x509-glue.patch |
| 2215 |
- popd >/dev/null |
| 2216 |
- epatch "${WORKDIR}"/${X509_PATCH%.*} |
| 2217 |
- #epatch "${FILESDIR}"/${PN}-7.1_p2-x509-hpn14v10-glue.patch |
| 2218 |
- #save_version X509 |
| 2219 |
- fi |
| 2220 |
- if use ldap ; then |
| 2221 |
- epatch "${WORKDIR}"/${LDAP_PATCH%.*} |
| 2222 |
- save_version LPK |
| 2223 |
- fi |
| 2224 |
- epatch "${FILESDIR}"/${PN}-7.2_p1-GSSAPI-dns.patch #165444 integrated into gsskex |
| 2225 |
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch |
| 2226 |
- epatch "${WORKDIR}"/${SCTP_PATCH%.*} |
| 2227 |
- if use hpn ; then |
| 2228 |
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ |
| 2229 |
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \ |
| 2230 |
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*} |
| 2231 |
- save_version HPN |
| 2232 |
- fi |
| 2233 |
- |
| 2234 |
- tc-export PKG_CONFIG |
| 2235 |
- local sed_args=( |
| 2236 |
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" |
| 2237 |
- # Disable PATH reset, trust what portage gives us #254615 |
| 2238 |
- -e 's:^PATH=/:#PATH=/:' |
| 2239 |
- # Disable fortify flags ... our gcc does this for us |
| 2240 |
- -e 's:-D_FORTIFY_SOURCE=2::' |
| 2241 |
- ) |
| 2242 |
- # The -ftrapv flag ICEs on hppa #505182 |
| 2243 |
- use hppa && sed_args+=( |
| 2244 |
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' |
| 2245 |
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' |
| 2246 |
- ) |
| 2247 |
- sed -i "${sed_args[@]}" configure{.ac,} || die |
| 2248 |
- |
| 2249 |
- epatch_user #473004 |
| 2250 |
- |
| 2251 |
- # Now we can build a sane merged version.h |
| 2252 |
- ( |
| 2253 |
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u |
| 2254 |
- macros=() |
| 2255 |
- for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done |
| 2256 |
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" |
| 2257 |
- ) > version.h |
| 2258 |
- |
| 2259 |
- eautoreconf |
| 2260 |
-} |
| 2261 |
- |
| 2262 |
-src_configure() { |
| 2263 |
- addwrite /dev/ptmx |
| 2264 |
- |
| 2265 |
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG |
| 2266 |
- use static && append-ldflags -static |
| 2267 |
- |
| 2268 |
- local myconf=( |
| 2269 |
- --with-ldflags="${LDFLAGS}" |
| 2270 |
- --disable-strip |
| 2271 |
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run |
| 2272 |
- --sysconfdir="${EPREFIX}"/etc/ssh |
| 2273 |
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc |
| 2274 |
- --datadir="${EPREFIX}"/usr/share/openssh |
| 2275 |
- --with-privsep-path="${EPREFIX}"/var/empty |
| 2276 |
- --with-privsep-user=sshd |
| 2277 |
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr) |
| 2278 |
- # We apply the ldap patch conditionally, so can't pass --without-ldap |
| 2279 |
- # unconditionally else we get unknown flag warnings. |
| 2280 |
- $(use ldap && use_with ldap) |
| 2281 |
- $(use_with ldns) |
| 2282 |
- $(use_with libedit) |
| 2283 |
- $(use_with pam) |
| 2284 |
- $(use_with pie) |
| 2285 |
- $(use_with sctp) |
| 2286 |
- $(use_with selinux) |
| 2287 |
- $(use_with skey) |
| 2288 |
- $(use_with ssh1) |
| 2289 |
- $(use_with ssl openssl) |
| 2290 |
- $(use_with ssl md5-passwords) |
| 2291 |
- $(use_with ssl ssl-engine) |
| 2292 |
- ) |
| 2293 |
- |
| 2294 |
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748 |
| 2295 |
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit ) |
| 2296 |
- |
| 2297 |
- econf "${myconf[@]}" |
| 2298 |
-} |
| 2299 |
- |
| 2300 |
-src_install() { |
| 2301 |
- emake install-nokeys DESTDIR="${D}" |
| 2302 |
- fperms 600 /etc/ssh/sshd_config |
| 2303 |
- dobin contrib/ssh-copy-id |
| 2304 |
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd |
| 2305 |
- newconfd "${FILESDIR}"/sshd.confd sshd |
| 2306 |
- keepdir /var/empty |
| 2307 |
- |
| 2308 |
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd |
| 2309 |
- if use pam ; then |
| 2310 |
- sed -i \ |
| 2311 |
- -e "/^#UsePAM /s:.*:UsePAM yes:" \ |
| 2312 |
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ |
| 2313 |
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \ |
| 2314 |
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ |
| 2315 |
- "${ED}"/etc/ssh/sshd_config || die |
| 2316 |
- fi |
| 2317 |
- |
| 2318 |
- # Gentoo tweaks to default config files |
| 2319 |
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config |
| 2320 |
- |
| 2321 |
- # Allow client to pass locale environment variables #367017 |
| 2322 |
- AcceptEnv LANG LC_* |
| 2323 |
- EOF |
| 2324 |
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config |
| 2325 |
- |
| 2326 |
- # Send locale environment variables #367017 |
| 2327 |
- SendEnv LANG LC_* |
| 2328 |
- EOF |
| 2329 |
- |
| 2330 |
- if use livecd ; then |
| 2331 |
- sed -i \ |
| 2332 |
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ |
| 2333 |
- "${ED}"/etc/ssh/sshd_config || die |
| 2334 |
- fi |
| 2335 |
- |
| 2336 |
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then |
| 2337 |
- insinto /etc/openldap/schema/ |
| 2338 |
- newins openssh-lpk_openldap.schema openssh-lpk.schema |
| 2339 |
- fi |
| 2340 |
- |
| 2341 |
- doman contrib/ssh-copy-id.1 |
| 2342 |
- dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config |
| 2343 |
- |
| 2344 |
- diropts -m 0700 |
| 2345 |
- dodir /etc/skel/.ssh |
| 2346 |
- |
| 2347 |
- systemd_dounit "${FILESDIR}"/sshd.{service,socket} |
| 2348 |
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' |
| 2349 |
-} |
| 2350 |
- |
| 2351 |
-src_test() { |
| 2352 |
- local t tests skipped failed passed shell |
| 2353 |
- tests="interop-tests compat-tests" |
| 2354 |
- skipped="" |
| 2355 |
- shell=$(egetshell ${UID}) |
| 2356 |
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then |
| 2357 |
- elog "Running the full OpenSSH testsuite" |
| 2358 |
- elog "requires a usable shell for the 'portage'" |
| 2359 |
- elog "user, so we will run a subset only." |
| 2360 |
- skipped="${skipped} tests" |
| 2361 |
- else |
| 2362 |
- tests="${tests} tests" |
| 2363 |
- fi |
| 2364 |
- # It will also attempt to write to the homedir .ssh |
| 2365 |
- local sshhome=${T}/homedir |
| 2366 |
- mkdir -p "${sshhome}"/.ssh |
| 2367 |
- for t in ${tests} ; do |
| 2368 |
- # Some tests read from stdin ... |
| 2369 |
- HOMEDIR="${sshhome}" \ |
| 2370 |
- emake -k -j1 ${t} </dev/null \ |
| 2371 |
- && passed="${passed}${t} " \ |
| 2372 |
- || failed="${failed}${t} " |
| 2373 |
- done |
| 2374 |
- einfo "Passed tests: ${passed}" |
| 2375 |
- ewarn "Skipped tests: ${skipped}" |
| 2376 |
- if [[ -n ${failed} ]] ; then |
| 2377 |
- ewarn "Failed tests: ${failed}" |
| 2378 |
- die "Some tests failed: ${failed}" |
| 2379 |
- else |
| 2380 |
- einfo "Failed tests: ${failed}" |
| 2381 |
- return 0 |
| 2382 |
- fi |
| 2383 |
-} |
| 2384 |
- |
| 2385 |
-pkg_preinst() { |
| 2386 |
- enewgroup sshd 22 |
| 2387 |
- enewuser sshd 22 -1 /var/empty sshd |
| 2388 |
-} |
| 2389 |
- |
| 2390 |
-pkg_postinst() { |
| 2391 |
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then |
| 2392 |
- elog "Starting with openssh-5.8p1, the server will default to a newer key" |
| 2393 |
- elog "algorithm (ECDSA). You are encouraged to manually update your stored" |
| 2394 |
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." |
| 2395 |
- fi |
| 2396 |
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then |
| 2397 |
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." |
| 2398 |
- fi |
| 2399 |
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then |
| 2400 |
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." |
| 2401 |
- elog "Make sure to update any configs that you might have. Note that xinetd might" |
| 2402 |
- elog "be an alternative for you as it supports USE=tcpd." |
| 2403 |
- fi |
| 2404 |
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518 |
| 2405 |
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" |
| 2406 |
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by" |
| 2407 |
- elog "adding to your sshd_config or ~/.ssh/config files:" |
| 2408 |
- elog " PubkeyAcceptedKeyTypes=+ssh-dss" |
| 2409 |
- elog "You should however generate new keys using rsa or ed25519." |
| 2410 |
- |
| 2411 |
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" |
| 2412 |
- elog "to 'prohibit-password'. That means password auth for root users no longer works" |
| 2413 |
- elog "out of the box. If you need this, please update your sshd_config explicitly." |
| 2414 |
- fi |
| 2415 |
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then |
| 2416 |
- elog "Be aware that by disabling openssl support in openssh, the server and clients" |
| 2417 |
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" |
| 2418 |
- elog "and update all clients/servers that utilize them." |
| 2419 |
- fi |
| 2420 |
-} |
Archives