diff mbox series

[scarthgap,13/33] dropbear: Disable DSS correctly

Message ID 56f5e0e276a5f39e5ae7fb9e61a4ef64aa51bd7e.1784567958.git.yoann.congal@smile.fr
State New
Headers show
Series [scarthgap,01/33] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx | expand

Commit Message

Yoann Congal July 20, 2026, 5:22 p.m. UTC 
From: Mike Crowe <mac@mcrowe.com>

Take upstream patch that stops sysoptions.h unconditionally turning
DROPBEAR_DSS back on even when it has been disabled (which is the
default).

Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 30 +++++++++++++++++++
 .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
 2 files changed, 31 insertions(+)
 create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch

Comments

Paul Barker July 20, 2026, 7:35 p.m. UTC | #1 
On Mon, 2026-07-20 at 19:22 +0200, Yoann Congal via
lists.openembedded.org wrote:
> From: Mike Crowe <mac@mcrowe.com>
> 
> Take upstream patch that stops sysoptions.h unconditionally turning
> DROPBEAR_DSS back on even when it has been disabled (which is the
> default).
> 
> Signed-off-by: Mike Crowe <mac@mcrowe.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>

Hi Mike, Yoann,

It looks like we've been building dropbear with DSS support enabled for
the life of the scarthgap release until now, due to a bug in the
assignment of DROPBEAR_DSS. Fixing this now will forcibly disable DSS
support for all users, which is not something we should do on a stable
branch.

Best regards,
diff mbox series

Patch

diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
new file mode 100644
index 00000000000..250cbb7a6f0
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
@@ -0,0 +1,30 @@ 
+From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Tue, 6 Dec 2022 22:34:11 +0800
+Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
+
+Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
+was missing fuzzing conditional
+
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
+Signed-off-by: Mike Crowe <mac@mcrowe.com>
+---
+ sysoptions.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sysoptions.h b/sysoptions.h
+index fb6adc7..12db59c 100644
+--- a/sysoptions.h
++++ b/sysoptions.h
+@@ -383,9 +383,11 @@
+ #endif
+ 
+ /* Fuzzing expects all key types to be enabled */
++#if DROPBEAR_FUZZ
+ #if defined(DROPBEAR_DSS)
+ #undef DROPBEAR_DSS
+ #endif
+ #define DROPBEAR_DSS 1
++#endif
+ 
+ /* no include guard for this file */
diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2022.83.bb
index 93563aa3b47..d203fee34b3 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.83.bb
+++ b/meta/recipes-core/dropbear/dropbear_2022.83.bb
@@ -28,6 +28,7 @@  SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch \
            file://0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch \
            file://0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch \
+           file://0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch \
            file://CVE-2025-47203.patch \
            file://CVE-2019-6111.patch \
            "