From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id AD0C0158013 for ; Thu, 17 Oct 2024 05:59:25 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 93ED6E0805; Thu, 17 Oct 2024 05:59:04 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5D861E07F1 for ; Thu, 17 Oct 2024 05:59:04 +0000 (UTC) From: =?UTF-8?q?Ulrich=20M=C3=BCller?= To: gentoo-dev@lists.gentoo.org Cc: =?UTF-8?q?Ulrich=20M=C3=BCller?= Subject: [gentoo-dev] [PATCH 2/4] cvs.eclass: Rewrite the ssh wrapper script in bash Date: Thu, 17 Oct 2024 07:58:29 +0200 Message-ID: <20241017055843.16396-2-ulm@gentoo.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20241017055843.16396-1-ulm@gentoo.org> References: <20241017055843.16396-1-ulm@gentoo.org> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Archives-Salt: c5c778ee-7f6c-45a2-828a-85476b7683ab X-Archives-Hash: 79eb14e16ad1347d86c2f31a80d34bef OpenSSH version 8.4 and later supports the SSH_ASKPASS_REQUIRE environment variable which allows to force the use of the SSH_ASKPASS program. This makes detaching the process from its controlling terminal (TIOCNOTTY ioctl) unnecessary, as well as setting the DISPLAY variable. Signed-off-by: Ulrich Müller --- eclass/cvs.eclass | 62 +++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 45 deletions(-) diff --git a/eclass/cvs.eclass b/eclass/cvs.eclass index ec0ad2ec8f71..1289ee54cc3b 100644 --- a/eclass/cvs.eclass +++ b/eclass/cvs.eclass @@ -192,7 +192,7 @@ if [[ ${ECVS_AUTH} == "ext" ]] ; then if [[ ${CVS_RSH} != "ssh" ]] ; then die "Support for ext auth with clients other than ssh has not been implemented yet" fi - BDEPEND+=" net-misc/openssh" + BDEPEND+=" >=net-misc/openssh-8.4" fi # @FUNCTION: cvs_fetch @@ -362,40 +362,9 @@ cvs_fetch() { # Hack to support SSH password authentication if [[ ${CVS_RSH} == "ssh" ]] ; then - # Force SSH to use SSH_ASKPASS by creating python wrapper - - local -x CVS_RSH="${T}/cvs_sshwrapper" - cat > "${CVS_RSH}" < - echo "newarglist.insert(1, '-oClearAllForwardings=yes')" \ - >> "${CVS_RSH}" || die - echo "newarglist.insert(1, '-oForwardX11=no')" \ - >> "${CVS_RSH}" || die - # Handle SSH host key checking local known_hosts_file="${T}/cvs_ssh_known_hosts" - echo "newarglist.insert(1, '-oUserKnownHostsFile=${known_hosts_file}')" \ - >> "${CVS_RSH}" || die - local strict_host_key_checking if [[ -z ${ECVS_SSH_HOST_KEY} ]] ; then ewarn "Warning: The SSH host key of the remote server will not be verified." @@ -407,28 +376,31 @@ EOF echo "${ECVS_SSH_HOST_KEY}" > "${known_hosts_file}" || die fi - echo -n "newarglist.insert(1, '-oStrictHostKeyChecking=" \ - >> "${CVS_RSH}" || die - echo "${strict_host_key_checking}')" \ - >> "${CVS_RSH}" || die - echo "os.execv('${EPREFIX}/usr/bin/ssh', newarglist)" \ - >> "${CVS_RSH}" || die + # Create a wrapper script to pass additional options to SSH + # Disable X11 forwarding which causes .xauth access violations + local -x CVS_RSH="${T}/cvs_sshwrapper" + cat > "${CVS_RSH}" <<-EOF || die + #!${BROOT}/bin/bash + exec "${BROOT}/usr/bin/ssh" \\ + -oStrictHostKeyChecking=${strict_host_key_checking} \\ + -oUserKnownHostsFile="${known_hosts_file}" \\ + -oForwardX11=no \\ + -oClearAllForwardings=yes \\ + "\$@" + EOF chmod a+x "${CVS_RSH}" || die - # Make sure DISPLAY is set (SSH will not use SSH_ASKPASS - # if DISPLAY is not set) - - local -x DISPLAY="${DISPLAY:-DISPLAY}" - # Create a dummy executable to echo ${ECVS_PASS} local -x SSH_ASKPASS="${T}/cvs_sshechopass" + local -x SSH_ASKPASS_REQUIRE="force" + if [[ ${ECVS_AUTH} != "no" ]] ; then - echo -en "#!/bin/bash\necho \"${ECVS_PASS}\"\n" \ + echo -en "#!${BROOT}/bin/bash\necho \"${ECVS_PASS}\"\n" \ > "${SSH_ASKPASS}" || die else - echo -en "#!/bin/bash\nreturn\n" \ + echo -en "#!${BROOT}/bin/bash\nreturn\n" \ > "${SSH_ASKPASS}" || die fi chmod a+x "${SSH_ASKPASS}" || die -- 2.47.0