X-Git-Url: https://git.pld-linux.org/?a=blobdiff_plain;f=openssh.spec;h=827ab5a390b8f951284d7b2ece0a3961d079364f;hb=9805e7383f1e084b3ff868b60ed423f3863332c6;hp=cea9891405b252448917a790a5b59d533921c0e1;hpb=0ce7ef42c38bd8f7b4aa6ce37db1e4ab134f1bb1;p=packages%2Fopenssh.git diff --git a/openssh.spec b/openssh.spec index cea9891..827ab5a 100644 --- a/openssh.spec +++ b/openssh.spec @@ -5,30 +5,21 @@ # # Conditional build: %bcond_without audit # sshd audit support -%bcond_with gnome # with gnome-askpass (GNOME 1.x) utility -%bcond_without gtk # without GTK+ (2.x) -%bcond_without ldap # with ldap support -%bcond_without libedit # without libedit (editline/history support in sftp client) -%bcond_without kerberos5 # without kerberos5 support -%bcond_without selinux # build without SELinux support +%bcond_with gnome # gnome-askpass (GNOME 1.x) utility +%bcond_without gtk # gnome-askpass (GTK+ 2.x) utility +%bcond_without ldap # LDAP support +%bcond_with ldns # DNSSEC support via libldns +%bcond_without libedit # libedit (editline/history support in sftp client) +%bcond_without kerberos5 # Kerberos5 support +%bcond_without selinux # SELinux support %bcond_without libseccomp # use libseccomp for seccomp privsep (requires 3.5 kernel) %bcond_with hpn # High Performance SSH/SCP - HPN-SSH including Cipher NONE (broken too often) -%bcond_without tests +%bcond_without tests # test suite +%bcond_with tests_conch # run conch interoperability tests # gtk2-based gnome-askpass means no gnome1-based %{?with_gtk:%undefine with_gnome} -%ifnarch x32 -# libseccomp requires 3.5 kernel, avoid such requirement where possible (non-x32 arches) -%undefine with_libseccomp -%endif - -%define sandbox %{?with_libseccomp:lib}seccomp_filter - -%ifarch x32 -%{!?with_libseccomp:%error openssh seccomp implementation is broken! do not disable libseccomp on x32} -%endif - %if "%{pld_release}" == "ac" %define pam_ver 0.79.0 %else @@ -45,13 +36,13 @@ Summary(pt_BR.UTF-8): Implementação livre do SSH Summary(ru.UTF-8): OpenSSH - свободная реализация протокола Secure Shell (SSH) Summary(uk.UTF-8): OpenSSH - вільна реалізація протоколу Secure Shell (SSH) Name: openssh -Version: 7.5p1 +Version: 9.0p1 Release: 1 Epoch: 2 License: BSD Group: Applications/Networking -Source0: http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/%{name}-%{version}.tar.gz -# Source0-md5: 652fdc7d8392f112bef11cacf7e69e23 +Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/%{name}-%{version}.tar.gz +# Source0-md5: 5ed8252a0ee379c0f7c9e0d25d32424d Source1: http://www.mif.pg.gda.pl/homepages/ankry/man-PLD/%{name}-non-english-man-pages.tar.bz2 # Source1-md5: 66943d481cc422512b537bcc2c7400d1 Source2: %{name}d.init @@ -64,6 +55,9 @@ Source9: sshd.service Source10: sshd-keygen Source11: sshd.socket Source12: sshd@.service +#Patch100: %{name}-git.patch +## Patch100-md5: d41d8cd98f00b204e9800998ecf8427e +Patch0: %{name}-no-pty-tests.patch Patch1: %{name}-tests-reuseport.patch Patch2: %{name}-pam_misc.patch Patch3: %{name}-sigpipe.patch @@ -76,11 +70,13 @@ Patch8: ldap-helper-sigpipe.patch # High Performance SSH/SCP - HPN-SSH - http://www.psc.edu/networking/projects/hpn-ssh/ # http://www.psc.edu/networking/projects/hpn-ssh/openssh-5.2p1-hpn13v6.diff.gz Patch9: %{name}-5.2p1-hpn13v6.diff -Patch10: %{name}-include.patch + Patch11: %{name}-chroot.patch + +Patch13: %{name}-skip-interop-tests.patch Patch14: %{name}-bind.patch Patch15: %{name}-disable_ldap.patch -Patch16: libseccomp-sandbox.patch +Patch16: openssl3.0.patch URL: http://www.openssh.com/portable.html BuildRequires: %{__perl} %{?with_audit:BuildRequires: audit-libs-devel} @@ -89,15 +85,20 @@ BuildRequires: automake %{?with_gnome:BuildRequires: gnome-libs-devel} %{?with_gtk:BuildRequires: gtk+2-devel} %{?with_kerberos5:BuildRequires: heimdal-devel >= 0.7} +%{?with_ldns:BuildRequires: ldns-devel} %{?with_libedit:BuildRequires: libedit-devel} -BuildRequires: libseccomp-devel +BuildRequires: libfido2-devel >= 1.5.0 +%{?with_libseccomp:BuildRequires: libseccomp-devel} %{?with_selinux:BuildRequires: libselinux-devel} %{?with_ldap:BuildRequires: openldap-devel} -BuildRequires: openssl-devel >= 1.0.1 +BuildRequires: openssl-devel >= 1.1.0g BuildRequires: pam-devel %{?with_gtk:BuildRequires: pkgconfig} +%if %{with tests} && %{with tests_conch} +BuildRequires: python-TwistedConch +%endif BuildRequires: rpm >= 4.4.9-56 -BuildRequires: rpmbuild(macros) >= 1.627 +BuildRequires: rpmbuild(macros) >= 1.752 BuildRequires: sed >= 4.0 BuildRequires: zlib-devel >= 1.2.3 %if %{with tests} && 0%(id -u sshd >/dev/null 2>&1; echo $?) @@ -268,6 +269,7 @@ Summary(ru.UTF-8): OpenSSH - клиенты протокола Secure Shell Summary(uk.UTF-8): OpenSSH - клієнти протоколу Secure Shell Group: Applications/Networking Requires: %{name} +Suggests: %{name}-clients-helper-fido = %{epoch}:%{version}-%{release} Provides: ssh-clients Obsoletes: ssh-clients %requires_eq_to openssl openssl-devel @@ -341,6 +343,19 @@ xinitrc scripts for starting SSH agent. %description clients-agent-xinitrc -l pl.UTF-8 Skrypty xinitrc do uruchamiania agenta SSH. +%package clients-helper-fido +Summary: OpenSSH helper for FIDO authenticator +Summary(pl.UTF-8): OpenSSH helper obsługujący klucz autoryzujący FIDO +Group: Applications/Networking +Requires: %{name}-clients = %{epoch}:%{version}-%{release} +Requires: libfido2 >= 1.5.0 + +%description clients-helper-fido +OpenSSH helper for FIDO authenticator. + +%description clients-helper-fido -l pl.UTF-8 +OpenSSH helper obsługujący klucz autoryzujący FIDO. + %package server Summary: OpenSSH Secure Shell protocol server (sshd) Summary(de.UTF-8): OpenSSH Secure Shell Protocol-Server (sshd) @@ -516,9 +531,7 @@ Summary(pl.UTF-8): Schemat klucza publicznego LDAP dla OpenSSH Group: Networking/Daemons Requires(post,postun): sed >= 4.0 Requires: openldap-servers -%if "%{_rpmversion}" >= "5" BuildArch: noarch -%endif %description -n openldap-schema-openssh-lpk This package contains OpenSSH LDAP Public Key schema for openldap. @@ -529,6 +542,9 @@ openldap-a. %prep %setup -q +#%patch100 -p1 + +%patch0 -p1 %patch1 -p1 %patch2 -p1 %patch3 -p1 @@ -539,12 +555,14 @@ openldap-a. %patch8 -p1 %{?with_hpn:%patch9 -p1} -%patch10 -p1 + %patch11 -p1 +%patch13 -p1 + %patch14 -p1 %{!?with_ldap:%patch15 -p1} -%{?with_libseccomp:%patch16 -p1} +%patch16 -p1 %if "%{pld_release}" == "ac" # fix for missing x11.pc @@ -558,10 +576,9 @@ grep -rl /usr/libexec/openssh/ssh-ldap-helper . | xargs \ %{__sed} -i -e 's,/usr/libexec/openssh/ssh-ldap-helper,%{_libexecdir}/ssh-ldap-helper,' # prevent being ovewritten by aclocal calls -mv aclocal.m4 acinclude.m4 +%{__mv} aclocal.m4 acinclude.m4 %build -cp /usr/share/automake/config.sub . %{__aclocal} %{__autoconf} %{__autoheader} @@ -576,6 +593,7 @@ CPPFLAGS="%{rpmcppflags} -DCHROOT -std=gnu99" --with-ipaddr-display \ %{?with_kerberos5:--with-kerberos5=/usr} \ --with-ldap%{!?with_ldap:=no} \ + %{?with_ldns:--with-ldns} \ %{?with_libedit:--with-libedit} \ --with-mantype=man \ --with-md5-passwords \ @@ -583,11 +601,16 @@ CPPFLAGS="%{rpmcppflags} -DCHROOT -std=gnu99" --with-pid-dir=%{_localstatedir}/run \ --with-privsep-path=%{_privsepdir} \ --with-privsep-user=sshd \ + --with-security-key-builtin \ %{?with_selinux:--with-selinux} \ %if "%{pld_release}" == "ac" --with-xauth=/usr/X11R6/bin/xauth %else - --with-sandbox=%{sandbox} \ +%if %{with libseccomp} + --with-sandbox=seccomp_filter \ +%else + --with-sandbox=rlimit \ +%endif --with-xauth=%{_bindir}/xauth %endif @@ -595,7 +618,14 @@ echo '#define LOGIN_PROGRAM "/bin/login"' >>config.h %{__make} -%{?with_tests:%{__make} -j1 tests} +%if %{with tests} +%{__make} -j1 tests \ + TEST_SSH_PORT=$((4242 + ${RANDOM:-$$} % 1000)) \ + TEST_SSH_TRACE="yes" \ +%if %{without tests_conch} + SKIP_LTESTS="conch-ciphers" +%endif +%endif cd contrib %if %{with gnome} @@ -632,6 +662,7 @@ install -p %{SOURCE10} $RPM_BUILD_ROOT%{_libexecdir}/sshd-keygen %{__sed} -i -e 's|@@LIBEXECDIR@@|%{_libexecdir}|g' \ $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd \ $RPM_BUILD_ROOT%{systemdunitdir}/sshd.service \ + $RPM_BUILD_ROOT%{systemdunitdir}/sshd@.service \ $RPM_BUILD_ROOT%{_libexecdir}/sshd-keygen %if %{with gnome} @@ -810,6 +841,11 @@ fi %defattr(644,root,root,755) %attr(755,root,root) /etc/X11/xinit/xinitrc.d/ssh-agent.sh +%files clients-helper-fido +%defattr(644,root,root,755) +%attr(755,root,root) %{_libexecdir}/ssh-sk-helper +%{_mandir}/man8/ssh-sk-helper.8* + %files server %defattr(644,root,root,755) %attr(755,root,root) %{_sbindir}/sshd @@ -825,7 +861,7 @@ fi %{_mandir}/man5/moduli.5* %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/sshd_config %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/pam.d/sshd -%attr(640,root,root) %{_sysconfdir}/moduli +%{_sysconfdir}/moduli %attr(754,root,root) /etc/rc.d/init.d/sshd %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/sshd %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/security/blacklist.sshd