From patchwork Tue Aug 11 07:23:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 94925 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6980DC5B56D for ; Tue, 11 Aug 2026 07:23:50 +0000 (UTC) Received: from a27-23.smtp-out.us-west-2.amazonses.com (a27-23.smtp-out.us-west-2.amazonses.com [54.240.27.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.49437.1786433028783807243 for ; Tue, 11 Aug 2026 00:23:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=RAkdx0Q9; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=KjpnIqIB; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.23, mailfrom: 0101019fefb4bebb-a56cc437-f658-4f6b-8d2f-27b9139cb96c-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1786433027; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date; bh=TqT7GORDUWTOOXORWXeWeaEuykdNFLOODIdU8f1RVR0=; b=RAkdx0Q9lZW8KJhCGun2b9OF8ohKp5sEkTkj02x8wUCehPg+zB7HES3GQQX7vR9z P0ETo/JtJevb2LnolPluv4ApiSd+zvg2+peRJOx+bN6pKryxFd/3U/hXVM2IKDFa28H +AqY8ZQTMouGOicUmVNyo1xLvhNbIQWXjvTbl7+o= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1786433027; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date:Feedback-ID; bh=TqT7GORDUWTOOXORWXeWeaEuykdNFLOODIdU8f1RVR0=; b=KjpnIqIBrzUo/5PfVexeG2G0SL94QV311Ex+RqDcuronce08e3O+EDi0zyh+7TQO QsQFqag+fFIg8/OOLYOuTHoOMts6MK9NC1YhZLUHzII8RErk9rOzYfZzpcKdf2aY+ci 0CK0tTrcOSemyltMhO9njdeYTJdde0fXSk29UX2o= MIME-Version: 1.0 From: auh@yoctoproject.org To: openembedded-core@lists.openembedded.org Subject: [AUH] openssh: upgrading to 10.5p1 SUCCEEDED Message-ID: <0101019fefb4bebb-a56cc437-f658-4f6b-8d2f-27b9139cb96c-000000@us-west-2.amazonses.com> Date: Tue, 11 Aug 2026 07:23:47 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.08.11-54.240.27.23 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 11 Aug 2026 07:23:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243156 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *openssh* to *10.5p1* has Succeeded. Next steps: - apply the patch: git am 0001-openssh-upgrade-10.4p1-10.5p1.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From d014df9577ee7807ff1b45dc0a7dbfe86d397f3c Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 11 Aug 2026 05:27:02 +0000 Subject: [PATCH] openssh: upgrade 10.4p1 -> 10.5p1 Source: ChangeLog depend update version upstream: add regress test for servers that hang durig banner write; upstream: openssh-10.5 upstream: remove ml-dsa/x25519 from the default algorithm list for upstream: make reading server banner non-blocking; prevents one Use clang-20 when building hardenedmalloc for tests. upstream: remove mlkem768brainpoolp256r1-sha256; requested by upstream: move comment to a better place; suggested by markus@ upstream: add some options to allow setting or clearing the upstream: Allow session-bind@openssh.com requests when the agent is upstream: avoid potential realloc use-after-free in the client if a upstream: fix up synopsis and tweak wording for -Z upstream: document existence of Re-allow PAMServiceName inside a Match block. Rerun VM tests on regress Makefile change too Run tests on regress Makefile changes too. upstream: disable pubkey-priority test until I can fix it to not pick upstream: Fix expected output for implicit ordering test. ok djm@ Don't enable Brainpool on AWS-LC or BoringSSL. Correct filename in comment. Fix OpenSSL ECC detection message. Make EC_KEY_METHOD_new optional again. upstream: crank up MaxAuthTries to avoid failures here upstream: regression test for pubkey ordering in the client; ok upstream: Tweak ordering of certificates tried during pubkey upstream: Add a "ssh -Z user@host" mode that dumps the pubkeys that upstream: fix ML-KEM/ECDH interop problem (does not affect Require NISTP521 in libcrypto. Remove support for libcrypto w/out ECC. Add includes.h for compat interfaces. upstream: Use ssh_mldsa44_ed25519_cleanup consistently to avoid upstream: Fix $OpenBSD marker for easier syncing. upstream: ssh: update kex unit test upstream: Make mlkem768ecdh build with OPENSSL=no. ok djm@ upstream: pass back errors from ed25519 key generation, which upstream: Move check of public key type against allowed algorithms upstream: Fix double frees (impossible to reach outside of a test upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@ upstream: ssh: implement mlkem768nistp256-sha256; ok djm@ upstream: use sshpkt_fatal instead of plain fatal() for errors in upstream: Automatically detect IPv6 support upstream: Factor out all of the IPv6 addresses into variables. Sync missed case-insensitivity changes. Add obsd79 target. Wording. upstream: verify that ChannelTimeout in a Match block is effective upstream: verify that RekeyLimit in a Match block is effective upstream: Use -Ohashalg to restrict output to specfic hash instead upstream: fix ChannelTimeout and RekeyLimit not being applied in upstream: s/= - 1/= -1/; from serity--- upstream: move to a better place upstream: use crypto_api.h #define constants for lengths; no upstream: make authorized_keys "restrict" keyword apply correctly upstream: in sshd config dump mode, write all directives in mixed upstream: read ~/.ssh/id_mldsa44_ed25519 private key files by upstream: document mldsa44-ed25519 host key and public key upstream: when signing ho [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- ...1-regress-banner.sh-log-input-and-output-files-on-erro.patch | 2 +- .../openssh/{openssh_10.4p1.bb => openssh_10.5p1.bb} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename meta/recipes-connectivity/openssh/{openssh_10.4p1.bb => openssh_10.5p1.bb} (99%) diff --git a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch index f424288e37..2c1c3f45ae 100644 --- a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch +++ b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch @@ -1,4 +1,4 @@ -From 5cc897fe2effe549e1e280c2f606bce8b532b61e Mon Sep 17 00:00:00 2001 +From 207d3428c1182de6c169f34a9e33a07c1bd00554 Mon Sep 17 00:00:00 2001 From: Mikko Rapeli Date: Mon, 11 Sep 2023 09:55:21 +0100 Subject: [PATCH] regress/banner.sh: log input and output files on error diff --git a/meta/recipes-connectivity/openssh/openssh_10.4p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb similarity index 99% rename from meta/recipes-connectivity/openssh/openssh_10.4p1.bb rename to meta/recipes-connectivity/openssh/openssh_10.5p1.bb index 96903bbc0c..e4b6ddef9d 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.4p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb @@ -25,7 +25,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://sshd_check_keys \ file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ " -SRC_URI[sha256sum] = "ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238" +SRC_URI[sha256sum] = "d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11" CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here."