Patch Openssh for Roundup #15

[grahamc]

Motivation for this change

#21457 (comment)

cc @vcunat @aneeshusa @LnL7

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

[mention-bot]

@grahamc, thanks for your PR! By analyzing the history of the files in this pull request, we identified @vcunat, @edolstra and @peti to be potential reviewers.

[LnL7]

looks good to me

[grahamc]

I'm feeling a bit inclined to wait for @vcunat to take a look. What do y'all think?

[vcunat]

No need for that, really. If you had a look and are convinced it will work...

[aneeshusa]

Just woke up, but the reason I haven't updated openssh yet is I've been waiting for updated GSSAPI patches from upstream (Debian). I ran some quick builds and I couldn't get this to build with GSSAPI enabled, hence why I hadn't made a PR. Can you get this to build with GSSAPI?

If not, we'll need to weigh leaving open CVEs w/ an old version of openssh, or breaking GSSAPI support.

I haven't looked at the systemd stuff yet.

[vcunat]

GSSAPI hpn version is marked as broken. It didn't build before update and doesn't build after.

[aneeshusa]

I only remember hpnSupport being broken, and I remember testing GSSAPI as working when I did #17493; let me double-check...

[vcunat]

I was wrong (edited above immediately). I haven't tested anything that has no top-level attribute :-)

[vcunat]

Yeah, it builds on master and this PR breaks it.

[aneeshusa]

I think Debian has updated the GSSAPI patch, looking at the git log for the master branch at https://anonscm.debian.org/cgit/pkg-ssh/openssh.git, if we want to give that a try.

[aneeshusa]

Specifically https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/plain/debian/patches/gssapi.patch?id=255b8554a50b5c75fca63f76b1ac837c0d4fb7aa may be an updated version, I believe.

[vcunat]

Yes, applies and I'm testing the build already.

[vcunat]

@grahamc: second-order PR submitted at grahamc#5 ;-)

[aneeshusa]

Changes around daemonization and testing LGTM as well. Building + testing this locally now.

[grahamc]

LMK how it goes @aneeshusa and I'll merge / backport straight away. :)

[grahamc]

Also -- I really appreciate all the help on this one.

[aneeshusa]

Built and tested, everything looks good. Thanks for keeping me in the loop!

[vcunat]

Nice teamwork :-)