Re: [ptxdist] [APPLIED] dropbear: version bump 2026.91 -> 2026.92

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as 70fff79697d92205e1d47478bc76186dc4584bbd.

Michael

[sent from post-receive hook]

On Wed, 15 Jul 2026 12:01:50 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Two security fixes.  Adding a patch for a build issue.
> 
> Noteworthy compatibility/configuration changes from the changelog:
> 
> - >> server auth plugins have been deprecated, the configure option
>   has been renamed to --enable-plugin-deprecated.
>   Planned to be removed in future.
> 
> - >> Two factor auth "-t" has been deprecated, it now requires
>   a configuration option DEPRECATED_TWO_FACTOR.
>   Planned to be removed in future.
> 
> - Security: server: Don't allow -B (accept blank password) with
>   -t (two factor auth). If run with -t and -B a user configured with a
>   blank password would be allowed to log in without pubkey auth.
>   https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740
>   Reported by nvidia
> 
> - Security: server: Fix parsing of long authorized_keys lines.
>   The remainder of a long line would be handled as the start of a new line.
>   In the case where external programs add semi-trusted public keys to
>   authorized_keys, a crafted key might bypass restrictions such as "command=".
>   https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6
>   Reported by nvidia
> 
> - >> authorized_keys is now limited to 300 lines.
> 
> - >> all programs and scp: Disallow following symlinks when writing output
>   files. This could prevent symlink attacks. Writing keys to an untrusted
>   directory is not recommended regardless.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260708114733.3505462-1-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> new file mode 100644
> index 000000000000..d12d292d273c
> --- /dev/null
> +++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> @@ -0,0 +1,109 @@
> +From: Alexander Dahl <ada@thorsis.com>
> +Date: Wed, 8 Jul 2026 13:02:37 +0200
> +Subject: [PATCH] configure: Fix (deprecated) plugin option
> +
> +Actually two issues here.
> +
> +On one hand there was the incomplete rename from --enable-plugin to
> +--enable-plugin-deprecated triggering new warnings with
> +dropbear-2026.92.  Technically new options where ignored while the old
> +--enable-plugin and --disable-plugin where still considered.
> +
> +On the other hand the previous option was broken from the beginning,
> +because when passing --enable-plugin or --disable-plugin explicitly the
> +option was not evaluated correctly.
> +
> +Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
> +Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
> +Fixes: #298
> +Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
> +Signed-off-by: Alexander Dahl <ada@thorsis.com>
> +Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
> +---
> + configure    | 23 +++++++++++++++++------
> + configure.ac | 15 +++++++++++----
> + 2 files changed, 28 insertions(+), 10 deletions(-)
> +
> +diff --git a/configure b/configure
> +index b8e90be06083..9b7b9b56f6f4 100755
> +--- a/configure
> ++++ b/configure
> +@@ -736,7 +736,7 @@ enable_pam
> + enable_openpty
> + enable_syslog
> + enable_shadow
> +-enable_plugin
> ++enable_plugin_deprecated
> + enable_fuzz
> + enable_bundled_libtom
> + enable_lastlog
> +@@ -5838,22 +5838,33 @@ fi
> + 
> + 
> + # Plugin support will be removed soon. Open a github issue if you're using it.
> +-# Check whether --enable-plugin was given.
> +-if test ${enable_plugin+y}
> ++# Check whether --enable-plugin-deprecated was given.
> ++if test ${enable_plugin_deprecated+y}
> + then :
> +-  enableval=$enable_plugin;
> ++  enableval=$enable_plugin_deprecated;
> ++		if test "x$enableval" = "xyes"; then
> + 
> + printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
> + 
> +-		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> ++			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> + printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
> +-		DROPBEAR_PLUGIN=1
> ++			DROPBEAR_PLUGIN=1
> ++		else
> ++
> ++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> ++
> ++			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> ++			DROPBEAR_PLUGIN=0
> ++		fi
> + 
> + else $as_nop
> + 
> + 
> + printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> + 
> ++		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> + 		DROPBEAR_PLUGIN=0
> + 
> + 
> +diff --git a/configure.ac b/configure.ac
> +index 25a13ee78e88..6dfeacf1f57f 100644
> +--- a/configure.ac
> ++++ b/configure.ac
> +@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
> + )
> + 
> + # Plugin support will be removed soon. Open a github issue if you're using it.
> +-AC_ARG_ENABLE(plugin,
> ++AC_ARG_ENABLE(plugin-deprecated,
> + 	[AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
> + 	[
> +-		AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> +-		AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> +-		DROPBEAR_PLUGIN=1
> ++		if test "x$enableval" = "xyes"; then
> ++			AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> ++			AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> ++			DROPBEAR_PLUGIN=1
> ++		else
> ++			AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> ++			AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> ++			DROPBEAR_PLUGIN=0
> ++		fi
> + 	],
> + 	[
> + 		AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> ++		AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> + 		DROPBEAR_PLUGIN=0
> + 	]
> + 
> diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
> new file mode 100644
> index 000000000000..b8f33b5c25c1
> --- /dev/null
> +++ b/patches/dropbear-2026.92/series
> @@ -0,0 +1,4 @@
> +# generated by git-ptx-patches
> +#tag:base --start-number 1
> +0001-configure-Fix-deprecated-plugin-option.patch
> +# 5e7edc37cce39b1dd92d69f9a2cf364c  - git-ptx-patches magic
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index bc93b0047a40..3dded0d5b3a6 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
>  #
>  # Paths and names
>  #
> -DROPBEAR_VERSION	:= 2026.91
> -DROPBEAR_SHA256		:= defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34
> +DROPBEAR_VERSION	:= 2026.92
> +DROPBEAR_SHA256		:= 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
>  DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
>  DROPBEAR_SUFFIX		:= tar.bz2
>  DROPBEAR_URL		:= \
> @@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT 	:= \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
>  	--enable-shadow \
> -	--disable-plugin \
> +	--disable-plugin-deprecated \
>  	--disable-fuzz \
>  	--enable-bundled-libtom \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \