[ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92

[ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92

[Alexander Dahl via ptxdist]

Two security fixes.  Adding a patch for a build issue.

Noteworthy compatibility/configuration changes from the changelog:

- >> server auth plugins have been deprecated, the configure option
  has been renamed to --enable-plugin-deprecated.
  Planned to be removed in future.

- >> Two factor auth "-t" has been deprecated, it now requires
  a configuration option DEPRECATED_TWO_FACTOR.
  Planned to be removed in future.

- Security: server: Don't allow -B (accept blank password) with
  -t (two factor auth). If run with -t and -B a user configured with a
  blank password would be allowed to log in without pubkey auth.
  https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740
  Reported by nvidia

- Security: server: Fix parsing of long authorized_keys lines.
  The remainder of a long line would be handled as the start of a new line.
  In the case where external programs add semi-trusted public keys to
  authorized_keys, a crafted key might bypass restrictions such as "command=".
  https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6
  Reported by nvidia

- >> authorized_keys is now limited to 300 lines.

- >> all programs and scp: Disallow following symlinks when writing output
  files. This could prevent symlink attacks. Writing keys to an untrusted
  directory is not recommended regardless.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 ...nfigure-Fix-deprecated-plugin-option.patch | 109 ++++++++++++++++++
 patches/dropbear-2026.92/series               |   4 +
 rules/dropbear.make                           |   6 +-
 3 files changed, 116 insertions(+), 3 deletions(-)
 create mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
 create mode 100644 patches/dropbear-2026.92/series

diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
new file mode 100644
index 000000000..d12d292d2
--- /dev/null
+++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
@@ -0,0 +1,109 @@
+From: Alexander Dahl <ada@thorsis.com>
+Date: Wed, 8 Jul 2026 13:02:37 +0200
+Subject: [PATCH] configure: Fix (deprecated) plugin option
+
+Actually two issues here.
+
+On one hand there was the incomplete rename from --enable-plugin to
+--enable-plugin-deprecated triggering new warnings with
+dropbear-2026.92.  Technically new options where ignored while the old
+--enable-plugin and --disable-plugin where still considered.
+
+On the other hand the previous option was broken from the beginning,
+because when passing --enable-plugin or --disable-plugin explicitly the
+option was not evaluated correctly.
+
+Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
+Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
+Fixes: #298
+Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
+Signed-off-by: Alexander Dahl <ada@thorsis.com>
+Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
+---
+ configure    | 23 +++++++++++++++++------
+ configure.ac | 15 +++++++++++----
+ 2 files changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/configure b/configure
+index b8e90be06083..9b7b9b56f6f4 100755
+--- a/configure
++++ b/configure
+@@ -736,7 +736,7 @@ enable_pam
+ enable_openpty
+ enable_syslog
+ enable_shadow
+-enable_plugin
++enable_plugin_deprecated
+ enable_fuzz
+ enable_bundled_libtom
+ enable_lastlog
+@@ -5838,22 +5838,33 @@ fi
+ 
+ 
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-# Check whether --enable-plugin was given.
+-if test ${enable_plugin+y}
++# Check whether --enable-plugin-deprecated was given.
++if test ${enable_plugin_deprecated+y}
+ then :
+-  enableval=$enable_plugin;
++  enableval=$enable_plugin_deprecated;
++		if test "x$enableval" = "xyes"; then
+ 
+ printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
+ 
+-		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
++			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
+ printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
+-		DROPBEAR_PLUGIN=1
++			DROPBEAR_PLUGIN=1
++		else
++
++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
++
++			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
++			DROPBEAR_PLUGIN=0
++		fi
+ 
+ else $as_nop
+ 
+ 
+ printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
+ 
++		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
+ 		DROPBEAR_PLUGIN=0
+ 
+ 
+diff --git a/configure.ac b/configure.ac
+index 25a13ee78e88..6dfeacf1f57f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
+ )
+ 
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-AC_ARG_ENABLE(plugin,
++AC_ARG_ENABLE(plugin-deprecated,
+ 	[AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
+ 	[
+-		AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
+-		AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
+-		DROPBEAR_PLUGIN=1
++		if test "x$enableval" = "xyes"; then
++			AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
++			AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
++			DROPBEAR_PLUGIN=1
++		else
++			AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++			AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
++			DROPBEAR_PLUGIN=0
++		fi
+ 	],
+ 	[
+ 		AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++		AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
+ 		DROPBEAR_PLUGIN=0
+ 	]
+ 
diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
new file mode 100644
index 000000000..b8f33b5c2
--- /dev/null
+++ b/patches/dropbear-2026.92/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-configure-Fix-deprecated-plugin-option.patch
+# 5e7edc37cce39b1dd92d69f9a2cf364c  - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index bc93b0047..3dded0d5b 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2026.91
-DROPBEAR_SHA256		:= defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34
+DROPBEAR_VERSION	:= 2026.92
+DROPBEAR_SHA256		:= 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= \
@@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT 	:= \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
 	--enable-shadow \
-	--disable-plugin \
+	--disable-plugin-deprecated \
 	--disable-fuzz \
 	--enable-bundled-libtom \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \

base-commit: ad8c2c3283df6fc624b7dfeb83a0449e2f4b92ed
-- 
2.47.3