From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 14 Aug 2026 17:39:44 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wuu0V-0035iL-1m for lore@lore.pengutronix.de; Fri, 14 Aug 2026 17:39:44 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wuu0K-0001Ws-57; Fri, 14 Aug 2026 17:39:32 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wutzZ-00077J-7y for ptxdist@pengutronix.de; Fri, 14 Aug 2026 17:38:47 +0200 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 09C5A201DE4; Fri, 14 Aug 2026 17:38:41 +0200 (CEST) Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wutzU-001Tw7-35; Fri, 14 Aug 2026 17:38:40 +0200 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1wutzU-00000007Yzu-3mxM; Fri, 14 Aug 2026 17:38:40 +0200 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 14 Aug 2026 17:38:40 +0200 Message-ID: <20260814153840.1802819-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260803121538.111425-1-ada@thorsis.com> References: <20260803121538.111425-1-ada@thorsis.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [APPLIED] dropbear: version bump 2026.92 -> 2026.94 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 2ab0d80a9056c98896a3339420b5278112e8e575. Michael [sent from post-receive hook] On Fri, 14 Aug 2026 17:38:40 +0200, Alexander Dahl wrote: > 2026.93 with one security fix, some minor hardening, > and the configuration patch gone upstream: > > - Security: Fix a use-after-free in X11 forwarding that could possibly lead > to memory corruption. This is vulnerable to authenticated users if X11 > forwarding is enabled. By default X11 forwarding is not built. > In 2026.89 the server is running as the authenticated user for X11 > forwarding, in earlier versions it runs as root. > This removes X11 "single connection" which has probably never been used. > Reported by @peter-pe > https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4 > > 2026.94 fixing a build regression introduced in 2026.93 and some minor > improvements. > > Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.93 > Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.94 > Signed-off-by: Alexander Dahl > Message-Id: <20260803121538.111425-1-ada@thorsis.com> > Signed-off-by: Michael Olbrich > > diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch > deleted file mode 100644 > index d12d292d273c..000000000000 > --- a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch > +++ /dev/null > @@ -1,109 +0,0 @@ > -From: Alexander Dahl > -Date: Wed, 8 Jul 2026 13:02:37 +0200 > -Subject: [PATCH] configure: Fix (deprecated) plugin option > - > -Actually two issues here. > - > -On one hand there was the incomplete rename from --enable-plugin to > ---enable-plugin-deprecated triggering new warnings with > -dropbear-2026.92. Technically new options where ignored while the old > ---enable-plugin and --disable-plugin where still considered. > - > -On the other hand the previous option was broken from the beginning, > -because when passing --enable-plugin or --disable-plugin explicitly the > -option was not evaluated correctly. > - > -Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html > -Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)") > -Fixes: #298 > -Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated") > -Signed-off-by: Alexander Dahl > -Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462] > ---- > - configure | 23 +++++++++++++++++------ > - configure.ac | 15 +++++++++++---- > - 2 files changed, 28 insertions(+), 10 deletions(-) > - > -diff --git a/configure b/configure > -index b8e90be06083..9b7b9b56f6f4 100755 > ---- a/configure > -+++ b/configure > -@@ -736,7 +736,7 @@ enable_pam > - enable_openpty > - enable_syslog > - enable_shadow > --enable_plugin > -+enable_plugin_deprecated > - enable_fuzz > - enable_bundled_libtom > - enable_lastlog > -@@ -5838,22 +5838,33 @@ fi > - > - > - # Plugin support will be removed soon. Open a github issue if you're using it. > --# Check whether --enable-plugin was given. > --if test ${enable_plugin+y} > -+# Check whether --enable-plugin-deprecated was given. > -+if test ${enable_plugin_deprecated+y} > - then : > -- enableval=$enable_plugin; > -+ enableval=$enable_plugin_deprecated; > -+ if test "x$enableval" = "xyes"; then > - > - printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h > - > -- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 > -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 > - printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;} > -- DROPBEAR_PLUGIN=1 > -+ DROPBEAR_PLUGIN=1 > -+ else > -+ > -+printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h > -+ > -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 > -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} > -+ DROPBEAR_PLUGIN=0 > -+ fi > - > - else $as_nop > - > - > - printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h > - > -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 > -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} > - DROPBEAR_PLUGIN=0 > - > - > -diff --git a/configure.ac b/configure.ac > -index 25a13ee78e88..6dfeacf1f57f 100644 > ---- a/configure.ac > -+++ b/configure.ac > -@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow, > - ) > - > - # Plugin support will be removed soon. Open a github issue if you're using it. > --AC_ARG_ENABLE(plugin, > -+AC_ARG_ENABLE(plugin-deprecated, > - [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])], > - [ > -- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) > -- AC_MSG_NOTICE(Enabling support for External Public Key Authentication) > -- DROPBEAR_PLUGIN=1 > -+ if test "x$enableval" = "xyes"; then > -+ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) > -+ AC_MSG_NOTICE(Enabling support for External Public Key Authentication) > -+ DROPBEAR_PLUGIN=1 > -+ else > -+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) > -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) > -+ DROPBEAR_PLUGIN=0 > -+ fi > - ], > - [ > - AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) > -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) > - DROPBEAR_PLUGIN=0 > - ] > - > diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series > deleted file mode 100644 > index b8f33b5c25c1..000000000000 > --- a/patches/dropbear-2026.92/series > +++ /dev/null > @@ -1,4 +0,0 @@ > -# generated by git-ptx-patches > -#tag:base --start-number 1 > -0001-configure-Fix-deprecated-plugin-option.patch > -# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic > diff --git a/rules/dropbear.make b/rules/dropbear.make > index 3dded0d5b3a6..eb720532d0d2 100644 > --- a/rules/dropbear.make > +++ b/rules/dropbear.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear > # > # Paths and names > # > -DROPBEAR_VERSION := 2026.92 > -DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e > +DROPBEAR_VERSION := 2026.94 > +DROPBEAR_SHA256 := e098034a843699200c8c977a991fff73159735bf795d5f72ef672c41a6b1ae81 > DROPBEAR := dropbear-$(DROPBEAR_VERSION) > DROPBEAR_SUFFIX := tar.bz2 > DROPBEAR_URL := \