Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *openssh* to *10.6p1* has Succeeded.
Next steps:
- apply the patch: git am 0001-openssh-upgrade-10.5p1-10.6p1.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From dae49ade37fafe4dd27d3aec3d3fc39fe4ef6ad2 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Wed, 7 Oct 2026 05:22:35 +0000
Subject: [PATCH] openssh: upgrade 10.5p1 -> 10.6p1
.depend
update RPM spec files
upstream: openssh-10.6
upstream: Add test for proxycommand percent expansions.
upstream: backout regress bits related to multiplexing change
remove the --disable-fd-passing configure option
disable features when post-auth sshd runs as root
Don't automatically enable FORTIFY_SOURCE.
upstream: Further restrict the characters allowed in a command-line
Remove NetBSD 9.0 test target.
Replace native ARM runner with remote runner.
Pull older NetBSD sudo package from archive.
upstream: make StreamLocalBindMask properly first-match-wins;
upstream: make StreamLocalBindMask properly respect Host/Match
upstream: start process of deprecating the -R flag. This was the
upstream: mention default KDF rounds is now 32
upstream: Implement a maximum number of KDF rounds that will be
upstream: fix the bit length of ML-DSA 44/Ed25519 keys that was
upstream: sftp: be stricter in accepting paths returned by the
upstream: handle max-pk-ok path identically when the incoming user
upstream: Disallow nul byte in received scp -O filename. Not
upstream: backout
upstream: Check that compressed payloads don't inflate beyond the
upstream: ssh-agent: no unlink(2) on empty filename
upstream: ssh-agent: fix socket cleanup for -a option (no pathspec)
upstream: Disable LZ77 dictionary coder to avoid a potential
upstream: check ssh's handling of stale multiplexing sockets From Jens
upstream: avoid race between multiple processes attempting to
upstream: Include local and remote versions in ~I connection info.
Remove the NetBSD BROKEN_READ_COMPARISON workaround.
Ignore build/install status of netcat in tests.
Add FreeBSD 15 test targets.
upstream: Better wording.
upstream: use Nm instead of Xr to self
Don't deref NULL on STREAMS tty alloc failure.
upstream: Plug leak. CID 913600.
upstream: an abbreviation ending in a dot at EOL requires escaping
upstream: tweak 1.406: minor wording and markup OK djm@
upstream: draft-ietf-sshm-ssh-agent became RFC 9987 ok dtucker@
Remove leftover from testing.
Add fallback for mkdir_path() without openat().
upstream: Use >= instead of > for max comparison so that the
upstream: Use equality not assignment in ternary. CID 913600.
upstream: spelling; ok deraadt@
Also skip scp3 test on Darwin 26 and 27.
upstream: convert channel timeouts to use floating points, allows
upstream: masking signals requried sigaddset, not sigdelset; bz3981
upstream: bz3635 - ssh-add -P to skip PIN entry
upstream: simpler
upstream: leaks on error paths; spotted by Coverity CID 913598
upstream: fix inverted logic that could cause a memleak; spotted en
upstream: Add missing semicolon after return. CID 913599, ok
upstream: correctly check sshauthopt->restricted merging
unbreak readpassphrase.c sync
sync readpassphrase(3) with OpenBSD libc
upstream: whitespace
upstream: adapt to libsodium ed25519 implementation
upstream: missing part of previous commit: update script to
upstream: switch from SUPERCOP ed25519 to libsodium
upstream: Only store GSSAPI creds when authn succeeds
upstream: Reset GSSAPI client state before authentication
upstream: Correctly handle some options that accept "none"
upstream: Propagate authorized_keys "resrict" keyword
upstream: Check key and CA sig type during key parsing
upstream: Add WarnWeakCrypto to sshd
upstream: Allow specification of agent socket directories
upstream: Account pubkey checks separately to auth attempts
upstream: Extend TCPKeepAlive to support forwardings too
upstream: Mask SIGTERM/SIGQUIT when processing a SIGHUP restart
fix merge botch that put lines in wrong function
upstream: Correct handling of DST when converting dates
upstream: sk-usbhid: preserve UV requirement for resident keys
upstream: Fix memory leak on an error path in mkdir_path
upstream: sftp: don't crash when glob(3) results lack stat information
openpty: mark inputs const
upstream: replace testing of vendor PQ signature algorithm
upstream: minor leak of fingerprint text when printing
upstream: the default KDF rounds for keys generated by ssh-keygen
Don't link sshd against libselinux
upstream: warnings fixes (static vs missing prototype, sign conversion)
sshd doesn't need sshpty.c any more
upstream: wrap line
upstream: g/c prototype
upstream: disconnect_controlling_tty() is the only thing from sshpty.c
upstream: Fix ChannelTimeout specificity
allow madvise(..., MADV_DONTNEED_LOCKED)
upstream: fix case for ssh -G option output; bz4005, reported by
upstream: mux proxy sockets also share in and out fds, so using
upstream: don't attempt to set TCP_NODELAY on non-AF_INET[6]
upstream: add a "hexdump" export mode that dumps the key blob in
upstream: Add '-p' to sftp mkdir/lmkdir to create directories as
upstream: Use getexecpath(3); if it fails use argv[0] as before
upstream: Change three paragraphs in different parts of the manual
upstream: update fingerprint example from RSA to Ed25519 host key
upstream: Remove scp '-s' flag from synopsis, the flag has been a
set -Wno-error=discarded-qualifiers
seccomp sandbox:
[Changelog truncated as it exceeds 5000 characters;
the full changelog can be found in an attachment to the AUH email]
---
...1-regress-banner.sh-log-input-and-output-files-on-erro.patch | 2 +-
.../openssh/{openssh_10.5p1.bb => openssh_10.6p1.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-connectivity/openssh/{openssh_10.5p1.bb =>
openssh_10.6p1.bb} (99%)
diff --git
a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
index f424288e37..aa25f09537 100644
---
a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
+++
b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
@@ -1,4 +1,4 @@
-From 5cc897fe2effe549e1e280c2f606bce8b532b61e Mon Sep 17 00:00:00 2001
+From af460c6fc73213c41a498dc15f72e6e64f2342f1 Mon Sep 17 00:00:00 2001
From: Mikko Rapeli <[email protected]>
Date: Mon, 11 Sep 2023 09:55:21 +0100
Subject: [PATCH] regress/banner.sh: log input and output files on error
diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
b/meta/recipes-connectivity/openssh/openssh_10.6p1.bb
similarity index 99%
rename from meta/recipes-connectivity/openssh/openssh_10.5p1.bb
rename to meta/recipes-connectivity/openssh/openssh_10.6p1.bb
index 052686f289..6043f140b3 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.6p1.bb
@@ -25,7 +25,7 @@ SRC_URI =
"https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://sshd_check_keys \
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
"
-SRC_URI[sha256sum] =
"d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11"
+SRC_URI[sha256sum] =
"a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39"
CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to
OpenSSH with the pam opie which we don't build/use here."
--
2.47.1
0001-openssh-upgrade-10.5p1-10.6p1.patch
Description: Binary data
packages/x86-64-v3-poky-linux/openssh: SRC_URI changed from "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.5p1.tar.gz file://sshd_config file://ssh_config file://init file://sshd file://sshd.service file://sshd.socket file://[email protected] file://sshdgenkeys.service file://volatiles.99_sshd file://run-ptest file://sshd_check_keys file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch" to "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.6p1.tar.gz file://sshd_config file://ssh_config file://init file://sshd file://sshd.service file://sshd.socket file://[email protected] file://sshdgenkeys.service file://volatiles.99_sshd file://run-ptest file://sshd_check_keys file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch" packages/x86-64-v3-poky-linux/openssh: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-dbg: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-dbg: PKGSIZE changed from 41238880 to 41417456 (+0%) packages/x86-64-v3-poky-linux/openssh/openssh-dbg: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-dev: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-dev: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-doc: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-doc: PKGSIZE changed from 359571 to 363454 (+1%) packages/x86-64-v3-poky-linux/openssh/openssh-doc: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-keygen: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-keygen: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-locale: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-locale: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-misc: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-misc: PKGSIZE changed from 2481365 to 2501845 (+1%) packages/x86-64-v3-poky-linux/openssh/openssh-misc: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-ptest: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-ptest: PKGSIZE changed from 8473505 to 8499598 (+0%) packages/x86-64-v3-poky-linux/openssh/openssh-ptest: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-scp: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-scp: PKGSIZE changed from 231864 to 235960 (+2%) packages/x86-64-v3-poky-linux/openssh/openssh-scp: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-sftp-server: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-sftp-server: PKGSIZE changed from 170160 to 174256 (+2%) packages/x86-64-v3-poky-linux/openssh/openssh-sftp-server: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-sftp: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-sftp: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-src: FILELIST: directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/hostkeys -> /usr/src/debug/openssh/10.6p1/regress/unittests/hostkeys, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/bitmap -> /usr/src/debug/openssh/10.6p1/regress/unittests/bitmap, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/match -> /usr/src/debug/openssh/10.6p1/regress/unittests/match, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/crypto -> /usr/src/debug/openssh/10.6p1/regress/unittests/crypto, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/kex -> /usr/src/debug/openssh/10.6p1/regress/unittests/kex, directory renamed /usr/src/debug/openssh/10.5p1 -> /usr/src/debug/openssh/10.6p1, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/authopt -> /usr/src/debug/openssh/10.6p1/regress/unittests/authopt, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests /misc -> /usr/src/debug/openssh/10.6p1/regress/unittests/misc, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/test_helper -> /usr/src/debug/openssh/10.6p1/regress/unittests/test_helper, directory renamed /usr/src/debug/openssh/10.5p1/openbsd-compat -> /usr/src/debug/openssh/10.6p1/openbsd-compat, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/sshsig -> /usr/src/debug/openssh/10.6p1/regress/unittests/sshsig, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/sshkey -> /usr/src/debug/openssh/10.6p1/regress/unittests/sshkey, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/servconf -> /usr/src/debug/openssh/10.6p1/regress/unittests/servconf, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/sshbuf -> /usr/src/debug/openssh/10.6p1/regress/unittests/sshbuf, directory renamed /usr/src/debug/openssh/10.5p1/regress -> /usr/src/debug/openssh/10.6p1/regress, directory renamed /usr/src/debug/openssh/10.5p1/re gress/unittests/conversion -> /usr/src/debug/openssh/10.6p1/regress/unittests/conversion, directory renamed /usr/src/debug/openssh/10.5p1/regress/unittests/utf8 -> /usr/src/debug/openssh/10.6p1/regress/unittests/utf8 packages/x86-64-v3-poky-linux/openssh/openssh-src: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-src: PKGSIZE changed from 4839579 to 4856148 (+0%) packages/x86-64-v3-poky-linux/openssh/openssh-src: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-ssh: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-ssh: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-sshd: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-sshd: PKGSIZE changed from 3490200 to 3506584 (+0%) packages/x86-64-v3-poky-linux/openssh/openssh-sshd: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh-staticdev: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh-staticdev: PV changed from "10.5p1" to "10.6p1" packages/x86-64-v3-poky-linux/openssh/openssh: PKGV changed from 10.5p1 [default] to 10.6p1 [default] packages/x86-64-v3-poky-linux/openssh/openssh: PV changed from "10.5p1" to "10.6p1"
.depend update RPM spec files upstream: openssh-10.6 upstream: Add test for proxycommand percent expansions. upstream: backout regress bits related to multiplexing change remove the --disable-fd-passing configure option disable features when post-auth sshd runs as root Don't automatically enable FORTIFY_SOURCE. upstream: Further restrict the characters allowed in a command-line Remove NetBSD 9.0 test target. Replace native ARM runner with remote runner. Pull older NetBSD sudo package from archive. upstream: make StreamLocalBindMask properly first-match-wins; upstream: make StreamLocalBindMask properly respect Host/Match upstream: start process of deprecating the -R flag. This was the upstream: mention default KDF rounds is now 32 upstream: Implement a maximum number of KDF rounds that will be upstream: fix the bit length of ML-DSA 44/Ed25519 keys that was upstream: sftp: be stricter in accepting paths returned by the upstream: handle max-pk-ok path identically when the incoming user upstream: Disallow nul byte in received scp -O filename. Not upstream: backout upstream: Check that compressed payloads don't inflate beyond the upstream: ssh-agent: no unlink(2) on empty filename upstream: ssh-agent: fix socket cleanup for -a option (no pathspec) upstream: Disable LZ77 dictionary coder to avoid a potential upstream: check ssh's handling of stale multiplexing sockets From Jens upstream: avoid race between multiple processes attempting to upstream: Include local and remote versions in ~I connection info. Remove the NetBSD BROKEN_READ_COMPARISON workaround. Ignore build/install status of netcat in tests. Add FreeBSD 15 test targets. upstream: Better wording. upstream: use Nm instead of Xr to self Don't deref NULL on STREAMS tty alloc failure. upstream: Plug leak. CID 913600. upstream: an abbreviation ending in a dot at EOL requires escaping upstream: tweak 1.406: minor wording and markup OK djm@ upstream: draft-ietf-sshm-ssh-agent became RFC 9987 ok dtucker@ Remove leftover from testing. Add fallback for mkdir_path() without openat(). upstream: Use >= instead of > for max comparison so that the upstream: Use equality not assignment in ternary. CID 913600. upstream: spelling; ok deraadt@ Also skip scp3 test on Darwin 26 and 27. upstream: convert channel timeouts to use floating points, allows upstream: masking signals requried sigaddset, not sigdelset; bz3981 upstream: bz3635 - ssh-add -P to skip PIN entry upstream: simpler upstream: leaks on error paths; spotted by Coverity CID 913598 upstream: fix inverted logic that could cause a memleak; spotted en upstream: Add missing semicolon after return. CID 913599, ok upstream: correctly check sshauthopt->restricted merging unbreak readpassphrase.c sync sync readpassphrase(3) with OpenBSD libc upstream: whitespace upstream: adapt to libsodium ed25519 implementation upstream: missing part of previous commit: update script to upstream: switch from SUPERCOP ed25519 to libsodium upstream: Only store GSSAPI creds when authn succeeds upstream: Reset GSSAPI client state before authentication upstream: Correctly handle some options that accept "none" upstream: Propagate authorized_keys "resrict" keyword upstream: Check key and CA sig type during key parsing upstream: Add WarnWeakCrypto to sshd upstream: Allow specification of agent socket directories upstream: Account pubkey checks separately to auth attempts upstream: Extend TCPKeepAlive to support forwardings too upstream: Mask SIGTERM/SIGQUIT when processing a SIGHUP restart fix merge botch that put lines in wrong function upstream: Correct handling of DST when converting dates upstream: sk-usbhid: preserve UV requirement for resident keys upstream: Fix memory leak on an error path in mkdir_path upstream: sftp: don't crash when glob(3) results lack stat information openpty: mark inputs const upstream: replace testing of vendor PQ signature algorithm upstream: minor leak of fingerprint text when printing upstream: the default KDF rounds for keys generated by ssh-keygen Don't link sshd against libselinux upstream: warnings fixes (static vs missing prototype, sign conversion) sshd doesn't need sshpty.c any more upstream: wrap line upstream: g/c prototype upstream: disconnect_controlling_tty() is the only thing from sshpty.c upstream: Fix ChannelTimeout specificity allow madvise(..., MADV_DONTNEED_LOCKED) upstream: fix case for ssh -G option output; bz4005, reported by upstream: mux proxy sockets also share in and out fds, so using upstream: don't attempt to set TCP_NODELAY on non-AF_INET[6] upstream: add a "hexdump" export mode that dumps the key blob in upstream: Add '-p' to sftp mkdir/lmkdir to create directories as upstream: Use getexecpath(3); if it fails use argv[0] as before upstream: Change three paragraphs in different parts of the manual upstream: update fingerprint example from RSA to Ed25519 host key upstream: Remove scp '-s' flag from synopsis, the flag has been a set -Wno-error=discarded-qualifiers seccomp sandbox: restrict mremap flags upstream: reenable ssh-mldsa44-ed25519 at a low priority position upstream: IANA has allocated a non-vendor codepoint for upstream: grammar; a -> an upstream: Bump size of key comment buffers. Prevents warnings on allow PAMServiceName in Match (regressed in 10.4) Move le32toh and friends to after platform flags. Skip scp3 test on macosx 26 until debugged. Remove ubuntu-26.04-arm kitchensink test target. special treatment for a more Turkic languages Group command for Yubico PPA correctly. Make FIDO2 packages optional. Update dependencies for Debian derivatives. Install libcrypt-dev package. Fix quoting in failed log output step. Add newer OS X and Ubunty 26.04 test targets. Require kSBXProfilePureComputation for OS X sandbox. upstream: Refer to id_mldsa44_ed25519.pub in the pubkey list. bz#3989. Add instructions for pin_actions. Update NetBSD vmaction pin to pick up 11.0 release. Update x11-ssh-askpass upstream location. Add NetBSD 11.0 test targets. Add 10.5 branch to test status display. whitespace at eol
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247360): https://lists.openembedded.org/g/openembedded-core/message/247360 Mute This Topic: https://lists.openembedded.org/mt/121623406/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
