* [ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92
@ 2026-07-08 11:47 Alexander Dahl via ptxdist
2026-07-15 10:01 ` [ptxdist] [APPLIED] " Michael Olbrich
0 siblings, 1 reply; 2+ messages in thread
From: Alexander Dahl via ptxdist @ 2026-07-08 11:47 UTC (permalink / raw)
To: ptxdist; +Cc: Alexander Dahl
Two security fixes. Adding a patch for a build issue.
Noteworthy compatibility/configuration changes from the changelog:
- >> server auth plugins have been deprecated, the configure option
has been renamed to --enable-plugin-deprecated.
Planned to be removed in future.
- >> Two factor auth "-t" has been deprecated, it now requires
a configuration option DEPRECATED_TWO_FACTOR.
Planned to be removed in future.
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6
Reported by nvidia
- >> authorized_keys is now limited to 300 lines.
- >> all programs and scp: Disallow following symlinks when writing output
files. This could prevent symlink attacks. Writing keys to an untrusted
directory is not recommended regardless.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
...nfigure-Fix-deprecated-plugin-option.patch | 109 ++++++++++++++++++
patches/dropbear-2026.92/series | 4 +
rules/dropbear.make | 6 +-
3 files changed, 116 insertions(+), 3 deletions(-)
create mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
create mode 100644 patches/dropbear-2026.92/series
diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
new file mode 100644
index 000000000..d12d292d2
--- /dev/null
+++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
@@ -0,0 +1,109 @@
+From: Alexander Dahl <ada@thorsis.com>
+Date: Wed, 8 Jul 2026 13:02:37 +0200
+Subject: [PATCH] configure: Fix (deprecated) plugin option
+
+Actually two issues here.
+
+On one hand there was the incomplete rename from --enable-plugin to
+--enable-plugin-deprecated triggering new warnings with
+dropbear-2026.92. Technically new options where ignored while the old
+--enable-plugin and --disable-plugin where still considered.
+
+On the other hand the previous option was broken from the beginning,
+because when passing --enable-plugin or --disable-plugin explicitly the
+option was not evaluated correctly.
+
+Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
+Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
+Fixes: #298
+Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
+Signed-off-by: Alexander Dahl <ada@thorsis.com>
+Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
+---
+ configure | 23 +++++++++++++++++------
+ configure.ac | 15 +++++++++++----
+ 2 files changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/configure b/configure
+index b8e90be06083..9b7b9b56f6f4 100755
+--- a/configure
++++ b/configure
+@@ -736,7 +736,7 @@ enable_pam
+ enable_openpty
+ enable_syslog
+ enable_shadow
+-enable_plugin
++enable_plugin_deprecated
+ enable_fuzz
+ enable_bundled_libtom
+ enable_lastlog
+@@ -5838,22 +5838,33 @@ fi
+
+
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-# Check whether --enable-plugin was given.
+-if test ${enable_plugin+y}
++# Check whether --enable-plugin-deprecated was given.
++if test ${enable_plugin_deprecated+y}
+ then :
+- enableval=$enable_plugin;
++ enableval=$enable_plugin_deprecated;
++ if test "x$enableval" = "xyes"; then
+
+ printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
+
+- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
+ printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
+- DROPBEAR_PLUGIN=1
++ DROPBEAR_PLUGIN=1
++ else
++
++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
++
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
++ DROPBEAR_PLUGIN=0
++ fi
+
+ else $as_nop
+
+
+ printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
+
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
+ DROPBEAR_PLUGIN=0
+
+
+diff --git a/configure.ac b/configure.ac
+index 25a13ee78e88..6dfeacf1f57f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
+ )
+
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-AC_ARG_ENABLE(plugin,
++AC_ARG_ENABLE(plugin-deprecated,
+ [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
+ [
+- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
+- AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
+- DROPBEAR_PLUGIN=1
++ if test "x$enableval" = "xyes"; then
++ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
++ AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
++ DROPBEAR_PLUGIN=1
++ else
++ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
++ DROPBEAR_PLUGIN=0
++ fi
+ ],
+ [
+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
+ DROPBEAR_PLUGIN=0
+ ]
+
diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
new file mode 100644
index 000000000..b8f33b5c2
--- /dev/null
+++ b/patches/dropbear-2026.92/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-configure-Fix-deprecated-plugin-option.patch
+# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index bc93b0047..3dded0d5b 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
#
# Paths and names
#
-DROPBEAR_VERSION := 2026.91
-DROPBEAR_SHA256 := defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34
+DROPBEAR_VERSION := 2026.92
+DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
DROPBEAR := dropbear-$(DROPBEAR_VERSION)
DROPBEAR_SUFFIX := tar.bz2
DROPBEAR_URL := \
@@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT := \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
--enable-shadow \
- --disable-plugin \
+ --disable-plugin-deprecated \
--disable-fuzz \
--enable-bundled-libtom \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
base-commit: ad8c2c3283df6fc624b7dfeb83a0449e2f4b92ed
--
2.47.3
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [ptxdist] [APPLIED] dropbear: version bump 2026.91 -> 2026.92
2026-07-08 11:47 [ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92 Alexander Dahl via ptxdist
@ 2026-07-15 10:01 ` Michael Olbrich
0 siblings, 0 replies; 2+ messages in thread
From: Michael Olbrich @ 2026-07-15 10:01 UTC (permalink / raw)
To: ptxdist; +Cc: Alexander Dahl
Thanks, applied as 70fff79697d92205e1d47478bc76186dc4584bbd.
Michael
[sent from post-receive hook]
On Wed, 15 Jul 2026 12:01:50 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Two security fixes. Adding a patch for a build issue.
>
> Noteworthy compatibility/configuration changes from the changelog:
>
> - >> server auth plugins have been deprecated, the configure option
> has been renamed to --enable-plugin-deprecated.
> Planned to be removed in future.
>
> - >> Two factor auth "-t" has been deprecated, it now requires
> a configuration option DEPRECATED_TWO_FACTOR.
> Planned to be removed in future.
>
> - Security: server: Don't allow -B (accept blank password) with
> -t (two factor auth). If run with -t and -B a user configured with a
> blank password would be allowed to log in without pubkey auth.
> https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740
> Reported by nvidia
>
> - Security: server: Fix parsing of long authorized_keys lines.
> The remainder of a long line would be handled as the start of a new line.
> In the case where external programs add semi-trusted public keys to
> authorized_keys, a crafted key might bypass restrictions such as "command=".
> https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6
> Reported by nvidia
>
> - >> authorized_keys is now limited to 300 lines.
>
> - >> all programs and scp: Disallow following symlinks when writing output
> files. This could prevent symlink attacks. Writing keys to an untrusted
> directory is not recommended regardless.
>
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260708114733.3505462-1-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>
> diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> new file mode 100644
> index 000000000000..d12d292d273c
> --- /dev/null
> +++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> @@ -0,0 +1,109 @@
> +From: Alexander Dahl <ada@thorsis.com>
> +Date: Wed, 8 Jul 2026 13:02:37 +0200
> +Subject: [PATCH] configure: Fix (deprecated) plugin option
> +
> +Actually two issues here.
> +
> +On one hand there was the incomplete rename from --enable-plugin to
> +--enable-plugin-deprecated triggering new warnings with
> +dropbear-2026.92. Technically new options where ignored while the old
> +--enable-plugin and --disable-plugin where still considered.
> +
> +On the other hand the previous option was broken from the beginning,
> +because when passing --enable-plugin or --disable-plugin explicitly the
> +option was not evaluated correctly.
> +
> +Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
> +Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
> +Fixes: #298
> +Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
> +Signed-off-by: Alexander Dahl <ada@thorsis.com>
> +Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
> +---
> + configure | 23 +++++++++++++++++------
> + configure.ac | 15 +++++++++++----
> + 2 files changed, 28 insertions(+), 10 deletions(-)
> +
> +diff --git a/configure b/configure
> +index b8e90be06083..9b7b9b56f6f4 100755
> +--- a/configure
> ++++ b/configure
> +@@ -736,7 +736,7 @@ enable_pam
> + enable_openpty
> + enable_syslog
> + enable_shadow
> +-enable_plugin
> ++enable_plugin_deprecated
> + enable_fuzz
> + enable_bundled_libtom
> + enable_lastlog
> +@@ -5838,22 +5838,33 @@ fi
> +
> +
> + # Plugin support will be removed soon. Open a github issue if you're using it.
> +-# Check whether --enable-plugin was given.
> +-if test ${enable_plugin+y}
> ++# Check whether --enable-plugin-deprecated was given.
> ++if test ${enable_plugin_deprecated+y}
> + then :
> +- enableval=$enable_plugin;
> ++ enableval=$enable_plugin_deprecated;
> ++ if test "x$enableval" = "xyes"; then
> +
> + printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
> +
> +- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> + printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
> +- DROPBEAR_PLUGIN=1
> ++ DROPBEAR_PLUGIN=1
> ++ else
> ++
> ++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> ++
> ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> ++ DROPBEAR_PLUGIN=0
> ++ fi
> +
> + else $as_nop
> +
> +
> + printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> +
> ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> + DROPBEAR_PLUGIN=0
> +
> +
> +diff --git a/configure.ac b/configure.ac
> +index 25a13ee78e88..6dfeacf1f57f 100644
> +--- a/configure.ac
> ++++ b/configure.ac
> +@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
> + )
> +
> + # Plugin support will be removed soon. Open a github issue if you're using it.
> +-AC_ARG_ENABLE(plugin,
> ++AC_ARG_ENABLE(plugin-deprecated,
> + [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
> + [
> +- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> +- AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> +- DROPBEAR_PLUGIN=1
> ++ if test "x$enableval" = "xyes"; then
> ++ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> ++ AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> ++ DROPBEAR_PLUGIN=1
> ++ else
> ++ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> ++ DROPBEAR_PLUGIN=0
> ++ fi
> + ],
> + [
> + AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> + DROPBEAR_PLUGIN=0
> + ]
> +
> diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
> new file mode 100644
> index 000000000000..b8f33b5c25c1
> --- /dev/null
> +++ b/patches/dropbear-2026.92/series
> @@ -0,0 +1,4 @@
> +# generated by git-ptx-patches
> +#tag:base --start-number 1
> +0001-configure-Fix-deprecated-plugin-option.patch
> +# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index bc93b0047a40..3dded0d5b3a6 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
> #
> # Paths and names
> #
> -DROPBEAR_VERSION := 2026.91
> -DROPBEAR_SHA256 := defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34
> +DROPBEAR_VERSION := 2026.92
> +DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
> DROPBEAR := dropbear-$(DROPBEAR_VERSION)
> DROPBEAR_SUFFIX := tar.bz2
> DROPBEAR_URL := \
> @@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT := \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
> --enable-shadow \
> - --disable-plugin \
> + --disable-plugin-deprecated \
> --disable-fuzz \
> --enable-bundled-libtom \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-15 10:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-08 11:47 [ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92 Alexander Dahl via ptxdist
2026-07-15 10:01 ` [ptxdist] [APPLIED] " Michael Olbrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox