From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Mon, 03 Aug 2026 14:16:01 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wqraK-005s5z-14 for lore@lore.pengutronix.de; Mon, 03 Aug 2026 14:16:01 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wqraI-0001Kx-Bx; Mon, 03 Aug 2026 14:15:58 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wqra0-0001KX-Sk for ptxdist@pengutronix.de; Mon, 03 Aug 2026 14:15:41 +0200 Received: from mail.thorsis.com (mail.thorsis.com [IPv6:2003:a:e28:26e4::10]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 5D3C020044D for ; Mon, 03 Aug 2026 14:15:40 +0200 (CEST) Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=thorsis.com header.s=dkim header.b=c4+DxfjA; spf=pass (mx1.white.stw.pengutronix.de: domain of ada@thorsis.com designates 2003:a:e28:26e4::10 as permitted sender) smtp.mailfrom=ada@thorsis.com; dmarc=pass (policy=quarantine) header.from=thorsis.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id C7836148FDAE for ; Mon, 03 Aug 2026 14:15:45 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thorsis.com; s=dkim; t=1785759346; h=from:subject:date:message-id:to:mime-version: content-transfer-encoding; bh=MytnucUp9YSuW5AmTjLRgshHNwhlkKqwdLKGxWCe17A=; b=c4+DxfjAEm5DVH8MqWziNrhHiqU9WeiKTd+EWr4cVeIj3Ha8BzyIZdGYNgPpq5YRa93AiR B8SzeQ0BpwPIQbu/O+FA2heVKmx8MmP4AyxbWbQxodzH2DO0bRZPRBdgS3U1c2l96SbzHd OBXbd+dxaumfKclOCWR+l3DSchYSTPYIRR8zXjk2o1ytmxZ7CtfQaoABQnbbYo4Jb+N8ur rJ4tRt8lgytKJRNQt0EKLBhUyDikCvzISIdjjGnXxyJgzLUxIPntS7fzThj8FoWRC66kXn 1IF7RGQTpm2Ybw+u2+trmtkScBjN/QjV+jhIPgQum/cLlkBjkVOd0F0MxsUhQA== To: ptxdist@pengutronix.de Date: Mon, 3 Aug 2026 14:15:38 +0200 Message-ID: <20260803121538.111425-1-ada@thorsis.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Last-TLS-Session-Version: TLSv1.3 X-Spamd-Result: default: False [-2.50 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[thorsis.com,quarantine]; R_SPF_ALLOW(-0.20)[+mx]; R_DKIM_ALLOW(-0.20)[thorsis.com:s=dkim]; MIME_GOOD(-0.10)[text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:3320, ipnet:2003::/19, country:DE]; MIME_TRACE(0.00)[0:+]; DKIM_TRACE(0.00)[thorsis.com:+]; NEURAL_HAM(-0.00)[-1.000]; RECEIVED_HELO_LOCALHOST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[ptxdist@pengutronix.de]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCVD_TLS_ALL(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: 5D3C020044D X-Stat-Signature: zq7fzdfn35by34dirfz9xsyrki5ishth X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] dropbear: version bump 2026.92 -> 2026.94 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Alexander Dahl via ptxdist Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false 2026.93 with one security fix, some minor hardening, and the configuration patch gone upstream: - Security: Fix a use-after-free in X11 forwarding that could possibly lead to memory corruption. This is vulnerable to authenticated users if X11 forwarding is enabled. By default X11 forwarding is not built. In 2026.89 the server is running as the authenticated user for X11 forwarding, in earlier versions it runs as root. This removes X11 "single connection" which has probably never been used. Reported by @peter-pe https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4 2026.94 fixing a build regression introduced in 2026.93 and some minor improvements. Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.93 Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.94 Signed-off-by: Alexander Dahl --- ...nfigure-Fix-deprecated-plugin-option.patch | 109 ------------------ patches/dropbear-2026.92/series | 4 - rules/dropbear.make | 4 +- 3 files changed, 2 insertions(+), 115 deletions(-) delete mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch delete mode 100644 patches/dropbear-2026.92/series diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch deleted file mode 100644 index d12d292d2..000000000 --- a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch +++ /dev/null @@ -1,109 +0,0 @@ -From: Alexander Dahl -Date: Wed, 8 Jul 2026 13:02:37 +0200 -Subject: [PATCH] configure: Fix (deprecated) plugin option - -Actually two issues here. - -On one hand there was the incomplete rename from --enable-plugin to ---enable-plugin-deprecated triggering new warnings with -dropbear-2026.92. Technically new options where ignored while the old ---enable-plugin and --disable-plugin where still considered. - -On the other hand the previous option was broken from the beginning, -because when passing --enable-plugin or --disable-plugin explicitly the -option was not evaluated correctly. - -Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html -Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)") -Fixes: #298 -Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated") -Signed-off-by: Alexander Dahl -Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462] ---- - configure | 23 +++++++++++++++++------ - configure.ac | 15 +++++++++++---- - 2 files changed, 28 insertions(+), 10 deletions(-) - -diff --git a/configure b/configure -index b8e90be06083..9b7b9b56f6f4 100755 ---- a/configure -+++ b/configure -@@ -736,7 +736,7 @@ enable_pam - enable_openpty - enable_syslog - enable_shadow --enable_plugin -+enable_plugin_deprecated - enable_fuzz - enable_bundled_libtom - enable_lastlog -@@ -5838,22 +5838,33 @@ fi - - - # Plugin support will be removed soon. Open a github issue if you're using it. --# Check whether --enable-plugin was given. --if test ${enable_plugin+y} -+# Check whether --enable-plugin-deprecated was given. -+if test ${enable_plugin_deprecated+y} - then : -- enableval=$enable_plugin; -+ enableval=$enable_plugin_deprecated; -+ if test "x$enableval" = "xyes"; then - - printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h - -- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 - printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;} -- DROPBEAR_PLUGIN=1 -+ DROPBEAR_PLUGIN=1 -+ else -+ -+printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h -+ -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} -+ DROPBEAR_PLUGIN=0 -+ fi - - else $as_nop - - - printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h - -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} - DROPBEAR_PLUGIN=0 - - -diff --git a/configure.ac b/configure.ac -index 25a13ee78e88..6dfeacf1f57f 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow, - ) - - # Plugin support will be removed soon. Open a github issue if you're using it. --AC_ARG_ENABLE(plugin, -+AC_ARG_ENABLE(plugin-deprecated, - [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])], - [ -- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) -- AC_MSG_NOTICE(Enabling support for External Public Key Authentication) -- DROPBEAR_PLUGIN=1 -+ if test "x$enableval" = "xyes"; then -+ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) -+ AC_MSG_NOTICE(Enabling support for External Public Key Authentication) -+ DROPBEAR_PLUGIN=1 -+ else -+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) -+ DROPBEAR_PLUGIN=0 -+ fi - ], - [ - AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) - DROPBEAR_PLUGIN=0 - ] - diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series deleted file mode 100644 index b8f33b5c2..000000000 --- a/patches/dropbear-2026.92/series +++ /dev/null @@ -1,4 +0,0 @@ -# generated by git-ptx-patches -#tag:base --start-number 1 -0001-configure-Fix-deprecated-plugin-option.patch -# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic diff --git a/rules/dropbear.make b/rules/dropbear.make index 3dded0d5b..eb720532d 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear # # Paths and names # -DROPBEAR_VERSION := 2026.92 -DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e +DROPBEAR_VERSION := 2026.94 +DROPBEAR_SHA256 := e098034a843699200c8c977a991fff73159735bf795d5f72ef672c41a6b1ae81 DROPBEAR := dropbear-$(DROPBEAR_VERSION) DROPBEAR_SUFFIX := tar.bz2 DROPBEAR_URL := \ base-commit: fccbfeb4cf9fbf8a6e53d5deb5fc45d9de70aaff -- 2.47.3