Re: [ptxdist] [APPLIED] dropbear: version bump 2026.92 -> 2026.94

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as 2ab0d80a9056c98896a3339420b5278112e8e575.

Michael

[sent from post-receive hook]

On Fri, 14 Aug 2026 17:38:40 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> 2026.93 with one security fix, some minor hardening,
> and the configuration patch gone upstream:
> 
> - Security: Fix a use-after-free in X11 forwarding that could possibly lead
>   to memory corruption. This is vulnerable to authenticated users if X11
>   forwarding is enabled. By default X11 forwarding is not built.
>   In 2026.89 the server is running as the authenticated user for X11
>   forwarding, in earlier versions it runs as root.
>   This removes X11 "single connection" which has probably never been used.
>   Reported by @peter-pe
>   https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4
> 
> 2026.94 fixing a build regression introduced in 2026.93 and some minor
> improvements.
> 
> Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.93
> Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.94
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260803121538.111425-1-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> deleted file mode 100644
> index d12d292d273c..000000000000
> --- a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
> +++ /dev/null
> @@ -1,109 +0,0 @@
> -From: Alexander Dahl <ada@thorsis.com>
> -Date: Wed, 8 Jul 2026 13:02:37 +0200
> -Subject: [PATCH] configure: Fix (deprecated) plugin option
> -
> -Actually two issues here.
> -
> -On one hand there was the incomplete rename from --enable-plugin to
> ---enable-plugin-deprecated triggering new warnings with
> -dropbear-2026.92.  Technically new options where ignored while the old
> ---enable-plugin and --disable-plugin where still considered.
> -
> -On the other hand the previous option was broken from the beginning,
> -because when passing --enable-plugin or --disable-plugin explicitly the
> -option was not evaluated correctly.
> -
> -Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
> -Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
> -Fixes: #298
> -Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
> -Signed-off-by: Alexander Dahl <ada@thorsis.com>
> -Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
> ----
> - configure    | 23 +++++++++++++++++------
> - configure.ac | 15 +++++++++++----
> - 2 files changed, 28 insertions(+), 10 deletions(-)
> -
> -diff --git a/configure b/configure
> -index b8e90be06083..9b7b9b56f6f4 100755
> ---- a/configure
> -+++ b/configure
> -@@ -736,7 +736,7 @@ enable_pam
> - enable_openpty
> - enable_syslog
> - enable_shadow
> --enable_plugin
> -+enable_plugin_deprecated
> - enable_fuzz
> - enable_bundled_libtom
> - enable_lastlog
> -@@ -5838,22 +5838,33 @@ fi
> - 
> - 
> - # Plugin support will be removed soon. Open a github issue if you're using it.
> --# Check whether --enable-plugin was given.
> --if test ${enable_plugin+y}
> -+# Check whether --enable-plugin-deprecated was given.
> -+if test ${enable_plugin_deprecated+y}
> - then :
> --  enableval=$enable_plugin;
> -+  enableval=$enable_plugin_deprecated;
> -+		if test "x$enableval" = "xyes"; then
> - 
> - printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
> - 
> --		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> -+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
> - printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
> --		DROPBEAR_PLUGIN=1
> -+			DROPBEAR_PLUGIN=1
> -+		else
> -+
> -+printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> -+
> -+			{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> -+			DROPBEAR_PLUGIN=0
> -+		fi
> - 
> - else $as_nop
> - 
> - 
> - printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
> - 
> -+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
> -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
> - 		DROPBEAR_PLUGIN=0
> - 
> - 
> -diff --git a/configure.ac b/configure.ac
> -index 25a13ee78e88..6dfeacf1f57f 100644
> ---- a/configure.ac
> -+++ b/configure.ac
> -@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
> - )
> - 
> - # Plugin support will be removed soon. Open a github issue if you're using it.
> --AC_ARG_ENABLE(plugin,
> -+AC_ARG_ENABLE(plugin-deprecated,
> - 	[AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
> - 	[
> --		AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> --		AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> --		DROPBEAR_PLUGIN=1
> -+		if test "x$enableval" = "xyes"; then
> -+			AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
> -+			AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
> -+			DROPBEAR_PLUGIN=1
> -+		else
> -+			AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> -+			AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> -+			DROPBEAR_PLUGIN=0
> -+		fi
> - 	],
> - 	[
> - 		AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
> -+		AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
> - 		DROPBEAR_PLUGIN=0
> - 	]
> - 
> diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
> deleted file mode 100644
> index b8f33b5c25c1..000000000000
> --- a/patches/dropbear-2026.92/series
> +++ /dev/null
> @@ -1,4 +0,0 @@
> -# generated by git-ptx-patches
> -#tag:base --start-number 1
> -0001-configure-Fix-deprecated-plugin-option.patch
> -# 5e7edc37cce39b1dd92d69f9a2cf364c  - git-ptx-patches magic
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index 3dded0d5b3a6..eb720532d0d2 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
>  #
>  # Paths and names
>  #
> -DROPBEAR_VERSION	:= 2026.92
> -DROPBEAR_SHA256		:= 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
> +DROPBEAR_VERSION	:= 2026.94
> +DROPBEAR_SHA256		:= e098034a843699200c8c977a991fff73159735bf795d5f72ef672c41a6b1ae81
>  DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
>  DROPBEAR_SUFFIX		:= tar.bz2
>  DROPBEAR_URL		:= \