gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

openssh: fix PKCS#11 key enumeration and pin entry (#466079)

Browse Source
This commit is contained in:
Philip Taron
2025-11-29 10:29:43 +00:00
committed by GitHub
parent 1524bd6859 b8d7d975b3
commit 94504aaa94
2 changed files with 27 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/tools/networking/openssh/common.nix
+27 -1
View File
@@ -67,9 +67,35 @@ stdenv.mkDerivation (finalAttrs: {
# See discussion in https://github.com/NixOS/nixpkgs/pull/16966
./dont_create_privsep_path.patch
# See discussion in https://github.com/NixOS/nixpkgs/issues/466049 and
# https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/23
(fetchpatch {
name = "pkcs11-fetchkey-error-to-debug.patch";
url = "https://github.com/openssh/openssh-portable/commit/607f337637f2077b34a9f6f96fc24237255fe175.patch";
hunks = [ "2-" ];
hash = "sha256-rdvKL6/rwrdhGKlcmdy6fxVgJgaaRsmngX0KkShXAhQ=";
})
(fetchpatch {
name = "pkcs11-fix-pinentry.patch";
url = "https://github.com/openssh/openssh-portable/commit/434ba7684054c0637ce8f2486aaacafe65d9b8aa.patch";
# only applies to Makefile.in (which doesn't have a date header) so no hunks= needed
hash = "sha256-3JQ3IJurngXclORrfC2Bx7xvmGA6w2nIh+eZ0zd0bLY=";
})
# See discussion in https://github.com/NixOS/nixpkgs/issues/453782 and
# https://github.com/openssh/openssh-portable/pull/602
./fix_pkcs11_tests.patch
(fetchpatch {
name = "pkcs11-tests-allow-module-path.patch";
url = "https://github.com/openssh/openssh-portable/commit/5e7c3f33b2693b668ecfbac84b85f2c0c84410c2.patch";
hunks = [ "2-" ];
hash = "sha256-mGpRGXurg8K9Wp8qoojG5MQ+3sZW2XKy2z0RDXLHaEc=";
})
(fetchpatch {
name = "ssh-agent-tests-increase-timeout.patch";
url = "https://github.com/openssh/openssh-portable/commit/1fdc3c61194819c16063dc430eeb84b81bf42dcf.patch";
hunks = [ "2-" ];
hash = "sha256-b9YCOav32kY5VEvIG3W1fyD87HaQxof6Zwq9Oo+/Lac=";
})
]
++ extraPatches;
pkgs/tools/networking/openssh/fix_pkcs11_tests.patch
-51
View File
@@ -1,51 +0,0 @@
From 642218d8dd1ec79fa0c8db491fd46faa3ab026f7 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 21 Oct 2025 01:15:55 -0700
Subject: [PATCH 1/2] test-exec: use -P for allowed PKCS#11 library when
starting agent
If we just loaded a PKCS#11 library, we should allow it so the
regression test can run.
Fixes: https://github.com/NixOS/nixpkgs/issues/453782
---
regress/test-exec.sh | 3 +++
1 file changed, 3 insertions(+)
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 5b0c91f3faa..30b3da8709d 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1023,6 +1023,9 @@ p11_ssh_add() {
start_ssh_agent() {
EXTRA_AGENT_ARGS="$1"
+ if [ "$PKCS11_OK" = "yes" ]; then
+ EXTRA_AGENT_ARGS="${EXTRA_AGENT_ARGS} -P${TEST_SSH_PKCS11}"
+ fi
SSH_AUTH_SOCK="$OBJ/agent.sock"
export SSH_AUTH_SOCK
rm -f $SSH_AUTH_SOCK $OBJ/agent.log
From 5ae735db7d81b38ee059d63a4011291cb4456aef Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 21 Oct 2025 01:50:23 -0700
Subject: [PATCH 2/2] test-exec: give more time for ssh-agent to start
---
regress/test-exec.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 30b3da8709d..56a7653b386 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1034,7 +1034,7 @@ start_ssh_agent() {
> $OBJ/agent.log 2>&1 &
AGENT_PID=$!
trap "kill $AGENT_PID" EXIT
- for x in 0 1 2 3 4 ; do
+ for x in $(seq 15); do
# Give it a chance to start
${SSHADD} -l > /dev/null 2>&1
r=$?