From 0e18760c3c036b1cca8891fd6f606d187e5637e1 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Tue, 25 Jun 2024 12:02:25 +0200 Subject: [PATCH 01/27] New version: alpha-4012 --- sdk_container/.repo/manifests/version.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 91cf37e1578..1f1ed832c8e 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4011.0.0+nightly-20240624-2100 -FLATCAR_VERSION_ID=4011.0.0 -FLATCAR_BUILD_ID="nightly-20240624-2100" -FLATCAR_SDK_VERSION=4011.0.0+nightly-20240624-2100 +FLATCAR_VERSION=4012 +FLATCAR_VERSION_ID=4012 +FLATCAR_BUILD_ID="" +FLATCAR_SDK_VERSION=4012.0.0 From 33fb1d16c1858da5bc4255574e70b3bbf2078224 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Tue, 25 Jun 2024 12:04:00 +0200 Subject: [PATCH 02/27] New version: alpha-4012.0.0 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 1f1ed832c8e..62b6de458eb 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012 -FLATCAR_VERSION_ID=4012 +FLATCAR_VERSION=4012.0.0 +FLATCAR_VERSION_ID=4012.0.0 FLATCAR_BUILD_ID="" FLATCAR_SDK_VERSION=4012.0.0 From a11df45012596c6feff3d351035afdc6539ce745 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Fri, 28 Jun 2024 07:13:57 +0000 Subject: [PATCH 03/27] sys-kernel/coreos-sources: Update from 6.6.35 to 6.6.36 --- changelog/updates/2024-06-28-linux-6.6.36-update.md | 1 + ...{coreos-kernel-6.6.35.ebuild => coreos-kernel-6.6.36.ebuild} | 0 ...oreos-modules-6.6.35.ebuild => coreos-modules-6.6.36.ebuild} | 0 .../coreos-overlay/sys-kernel/coreos-sources/Manifest | 2 +- ...oreos-sources-6.6.35.ebuild => coreos-sources-6.6.36.ebuild} | 0 5 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-06-28-linux-6.6.36-update.md rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-6.6.35.ebuild => coreos-kernel-6.6.36.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-6.6.35.ebuild => coreos-modules-6.6.36.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.6.35.ebuild => coreos-sources-6.6.36.ebuild} (100%) diff --git a/changelog/updates/2024-06-28-linux-6.6.36-update.md b/changelog/updates/2024-06-28-linux-6.6.36-update.md new file mode 100644 index 00000000000..4d70abf8781 --- /dev/null +++ b/changelog/updates/2024-06-28-linux-6.6.36-update.md @@ -0,0 +1 @@ +- Linux ([6.6.36](https://lwn.net/Articles/979850)) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.35.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.36.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.35.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.36.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.35.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.36.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.35.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.36.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index e51401316c4..3595100912a 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.35.xz 2307260 BLAKE2B 79fdb1c3567356938cbd72bd0198cf07508e6ce790a7f46e72a04c692a39470b052631114b7d0ec9d7b70c0873b71fde776088fb04b273fea7f11dddf4ab2ea4 SHA512 e5f794ec8fcb5b3149ff10692274eea6367d59f7b4b42845040c31d28d1fcbcd2aa6fdfd24f69f250e89eddac88f7034f1dba3a3fc789f0648a1f7a3d8a01baa +DIST patch-6.6.36.xz 2352844 BLAKE2B 2745e627a9871b3ba3979d1e4384b4872f296d7ff8f6a2dcdd257c7b2784707d64314214170edca338f29c21742ac9b054c396c93e2d3ccf287014633f316b0e SHA512 a24b5f49c82817d65e8db2cf33d69cbaa99248e2733bbd9e112f152b656eebf95fe0383bd07cd207683e02dd88a257a8628a296293696ae72cd3d87064e7d961 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.35.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.36.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.35.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.36.ebuild From 35b8be027488c06c327bd80fc8062d8c366c98ef Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Fri, 28 Jun 2024 21:00:28 +0000 Subject: [PATCH 04/27] New version: alpha-4012.0.0-nightly-20240628-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 62b6de458eb..bfab88adab3 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.0 +FLATCAR_VERSION=4012.0.0+nightly-20240628-2100 FLATCAR_VERSION_ID=4012.0.0 -FLATCAR_BUILD_ID="" +FLATCAR_BUILD_ID="nightly-20240628-2100" FLATCAR_SDK_VERSION=4012.0.0 From 2f3a70467021c8ce7469a1454046b3ef584ea6ff Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Mon, 1 Jul 2024 07:21:16 +0000 Subject: [PATCH 05/27] app-misc/ca-certificates: Update from 3.101 to 3.101.1 --- changelog/updates/2024-07-01-ca-certificates-3.101.1-update.md | 1 + .../coreos-overlay/app-misc/ca-certificates/Manifest | 2 +- ...certificates-3.101.ebuild => ca-certificates-3.101.1.ebuild} | 0 3 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-01-ca-certificates-3.101.1-update.md rename sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/{ca-certificates-3.101.ebuild => ca-certificates-3.101.1.ebuild} (100%) diff --git a/changelog/updates/2024-07-01-ca-certificates-3.101.1-update.md b/changelog/updates/2024-07-01-ca-certificates-3.101.1-update.md new file mode 100644 index 00000000000..8916191955b --- /dev/null +++ b/changelog/updates/2024-07-01-ca-certificates-3.101.1-update.md @@ -0,0 +1 @@ +- ca-certificates ([3.101.1](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_101_1.html)) diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest index 64ac687e930..dda91af7282 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest @@ -1 +1 @@ -DIST nss-3.101.tar.gz 76317799 BLAKE2B 0401ed203b9be9bc9c32cbbf9763cc22ecda15f81100080c3419b55f327350e10c4a1316670515d78b42b00a5f93749825d40645520fef27dd060617556ece81 SHA512 b1596e7d74c654825eabbcc1f71b1410cf44d816c3044429576782bc800186073d43da9ad76de2fbd7de73c4460ebeb91aa244457da9d0d0cdc08a50a11a165f +DIST nss-3.101.1.tar.gz 76462490 BLAKE2B 578a5ce6c9157c25db801a3fe37e094d8005130967ecf1cca19f52a69dfd43195cc8a0c5310dce48936aab4faae424b4e8f24bae6e4f6ac02ea4914e5af4e2be SHA512 0752ad801d00db0180fa72c06d40ee62f88fff220b88880c26f181ba5b9380e785486faa15f8799aaf7145afa47fdd10a27554ec23605a98fbe258951654822d diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.1.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.ebuild rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.1.ebuild From b5f3460d569cb5a6d361b09c8ad35a704dbe1319 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 1 Jul 2024 17:55:17 +0530 Subject: [PATCH 06/27] net-misc/openssh: Move package from coreos-overlay -> portage-stable It's from Gentoo commit a5ae97f6c11e8b646e5510bdf780338fc1e2efa4. --- .../coreos-overlay/net-misc/openssh/Manifest | 2 - ...shmat-shmdt-in-preauth-privsep-child.patch | 18 - .../portage-stable/net-misc/openssh/Manifest | 6 + ...h-9.3_p1-disable-conch-interop-tests.patch | 0 .../openssh-9.3_p1-fix-putty-tests.patch | 0 ...SERVE-in-sandbox-seccomp-filter-maps.patch | 44 ++ .../files/openssh-9.6_p1-CVE-2024-6387.patch | 19 + .../files/openssh-9.6_p1-chaff-logic.patch | 16 + .../files/openssh-9.6_p1-fix-xmss-c99.patch | 20 + .../files/openssh-9.7_p1-config-tweaks.patch | 27 ++ .../net-misc/openssh/files/sshd-r1.confd | 0 .../net-misc/openssh/files/sshd-r1.initd | 0 .../net-misc/openssh/files/sshd.pam_include.2 | 0 .../net-misc/openssh/files/sshd.service.1 | 0 .../net-misc/openssh/files/sshd.socket | 0 .../net-misc/openssh/files/sshd_at.service.1 | 0 .../net-misc/openssh/metadata.xml | 0 .../openssh/openssh-9.6_p1-r3.ebuild} | 73 +-- .../net-misc/openssh/openssh-9.6_p1-r5.ebuild | 392 ++++++++++++++++ .../net-misc/openssh/openssh-9.7_p1-r6.ebuild | 400 ++++++++++++++++ .../net-misc/openssh/openssh-9.8_p1-r1.ebuild | 434 ++++++++++++++++++ 21 files changed, 1373 insertions(+), 78 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest delete mode 100644 sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/openssh-9.3_p1-disable-conch-interop-tests.patch (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/openssh-9.3_p1-fix-putty-tests.patch (100%) create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-CVE-2024-6387.patch create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-chaff-logic.patch create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-fix-xmss-c99.patch create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd-r1.confd (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd-r1.initd (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd.pam_include.2 (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd.service.1 (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd.socket (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/files/sshd_at.service.1 (100%) rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/net-misc/openssh/metadata.xml (100%) rename sdk_container/src/third_party/{coreos-overlay/net-misc/openssh/openssh-9.6_p1-r2.ebuild => portage-stable/net-misc/openssh/openssh-9.6_p1-r3.ebuild} (85%) create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r5.ebuild create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r1.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest deleted file mode 100644 index bbc5cf33ad5..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/Manifest +++ /dev/null @@ -1,2 +0,0 @@ -DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509 -DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch b/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch deleted file mode 100644 index 7e9334a781d..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- a/sandbox-seccomp-filter.c -+++ b/sandbox-seccomp-filter.c -@@ -257,6 +257,15 @@ static const struct sock_filter preauth_insns[] = { - #ifdef __NR_statx - SC_DENY(__NR_statx, EACCES), - #endif -+#ifdef __NR_shmget -+ SC_DENY(__NR_shmget, EACCES), -+#endif -+#ifdef __NR_shmat -+ SC_DENY(__NR_shmat, EACCES), -+#endif -+#ifdef __NR_shmdt -+ SC_DENY(__NR_shmdt, EACCES), -+#endif - - /* Syscalls to permit */ - #ifdef __NR_brk diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest new file mode 100644 index 00000000000..a99ea426fb9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest @@ -0,0 +1,6 @@ +DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509 +DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d +DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b SHA512 0cafc17d22851605a4a5495a1d82c2b3fbbe6643760aad226dbf2a25b5f49d4375c3172833706ea3cb6c05d5d02a40feb9a7e790eae5c4570dd344a43e94ca55 +DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf +DIST openssh-9.8p1.tar.gz 1910393 BLAKE2B 3bf983c4ef5358054ed0104cd51d3e0069fbc2b80d8522d0df644d5508ec1d26a67bf061b1b5698d1cdf0d2cbba16b4cdca12a4ce30da24429094576a075e192 SHA512 95dec2f18e58eb47994f3de4430253e0665e185564b65088ca5f4108870e05feddef8cda8d3c0a4b75f18b98cc2c024df0e27de53b48c1a16da8da483cb8292a +DIST openssh-9.8p1.tar.gz.asc 833 BLAKE2B 5291e8c03ab9a75acb44285cd7fc010f4a33551f142499624165dac708fc05a6d077df81555aa41037b45f6301e4e5db3161a7a23404473f8a233a877fc55cc3 SHA512 4df1f1be2c6ab7f3aebaedd0a773b0e8c8929abb30cd3415873ad55d012cfa113f792e888e5e772dd468c394aeb7e35d62893a514dbc0ab1a03acd79918657f7 diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-disable-conch-interop-tests.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.3_p1-disable-conch-interop-tests.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-disable-conch-interop-tests.patch rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.3_p1-disable-conch-interop-tests.patch diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-fix-putty-tests.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.3_p1-fix-putty-tests.patch similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/openssh-9.3_p1-fix-putty-tests.patch rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.3_p1-fix-putty-tests.patch diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch new file mode 100644 index 00000000000..379a3981d7e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch @@ -0,0 +1,44 @@ +From 45b491ce13fcf7dbc0b3bd6df986c9cf59190721 Mon Sep 17 00:00:00 2001 +From: Jordan R Abrahams-Whitehead +Date: Tue, 12 Dec 2023 22:54:02 +0000 +Subject: [PATCH] Allow MAP_NORESERVE in sandbox seccomp filter maps + +While debugging Scudo on ChromeOS, we found that the no reserve mode +immediately crashed `sshd`. We tracked it down to the +sandbox-seccomp-filter. + +Being able to mmap with MAP_NORESERVE is useful (if not necessary) for +some overcommitting allocators. + +During mmap calls, the flag MAP_NORESERVE is used by some allocators +such as LLVM's Scudo for layout optimisation. This causes the sandbox +seccomp filter for the client subprocess to die with some Scudo +configurations. + +Upstream patch submission: +https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-December/041095.html +--- + sandbox-seccomp-filter.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 23b40b643..a49c5ca99 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -190,9 +190,11 @@ + + #if defined(__NR_mmap) || defined(__NR_mmap2) + # ifdef MAP_FIXED_NOREPLACE +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_FIXED_NOREPLACE ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE|MAP_FIXED_NOREPLACE + # else +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE + # endif /* MAP_FIXED_NOREPLACE */ + /* Use this for both __NR_mmap and __NR_mmap2 variants */ + # define SC_MMAP(_nr) \ +-- +2.43.0.472.g3155946c3a-goog + diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-CVE-2024-6387.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-CVE-2024-6387.patch new file mode 100644 index 00000000000..7b7fb70380d --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-CVE-2024-6387.patch @@ -0,0 +1,19 @@ +https://bugs.gentoo.org/935271 +Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2. +--- a/log.c ++++ b/log.c +@@ -451,12 +451,14 @@ void + sshsigdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) + { ++#ifdef SYSLOG_R_SAFE_IN_SIGHAND + va_list args; + + va_start(args, fmt); + sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, + suffix, fmt, args); + va_end(args); ++#endif + _exit(1); + } + diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-chaff-logic.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-chaff-logic.patch new file mode 100644 index 00000000000..90544d1a457 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-chaff-logic.patch @@ -0,0 +1,16 @@ +"Minor logic error in ObscureKeystrokeTiming" +https://marc.info/?l=oss-security&m=171982317624594&w=2 +--- a/clientloop.c ++++ b/clientloop.c +@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout, + if (timespeccmp(&now, &chaff_until, >=)) { + /* Stop if there have been no keystrokes for a while */ + stop_reason = "chaff time expired"; +- } else if (timespeccmp(&now, &next_interval, >=)) { +- /* Otherwise if we were due to send, then send chaff */ ++ } else if (timespeccmp(&now, &next_interval, >=) && ++ !ssh_packet_have_data_to_write(ssh)) { ++ /* If due to send but have no data, then send chaff */ + if (send_chaff(ssh)) + nchaff++; + } diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-fix-xmss-c99.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-fix-xmss-c99.patch new file mode 100644 index 00000000000..cf06b80cd5f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.6_p1-fix-xmss-c99.patch @@ -0,0 +1,20 @@ +xmss_hash.c: In function ‘core_hash_SHA2’: +xmss_hash.c:56:5: error: implicit declaration of function ‘SHA256’ [-Wimplicit-function-declaration] + 56 | SHA256(buf, inlen + keylen + n, out); + | ^~~~~~ +xmss_hash.c:61:7: error: implicit declaration of function ‘SHA512’ [-Wimplicit-function-declaration] + 61 | SHA512(buf, inlen + keylen + n, out); + | ^~~~~~ + +diff --git a/xmss_hash.c b/xmss_hash.c +index 70c126ae2..cb17de2af 100644 +--- a/xmss_hash.c ++++ b/xmss_hash.c +@@ -12,6 +12,7 @@ Public domain. + #include "xmss_hash_address.h" + #include "xmss_commons.h" + #include "xmss_hash.h" ++#include + + #include + #ifdef HAVE_STDINT_H diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch new file mode 100644 index 00000000000..229f7484cff --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.7_p1-config-tweaks.patch @@ -0,0 +1,27 @@ +diff -Naur a/ssh_config b/ssh_config +--- a/ssh_config 2024-03-11 05:20:49.000000000 +0000 ++++ b/ssh_config 2024-06-10 16:30:15.863023773 +0100 +@@ -13,6 +13,9 @@ + # Thus, host-specific definitions should be at the beginning of the + # configuration file, and defaults at the end. + ++# Make sure that all Host and Match options are below this Include! ++Include "/etc/ssh/ssh_config.d/*.conf" ++ + # Site-wide defaults for some commonly used options. For a comprehensive + # list of available options, their meanings and defaults, please see the + # ssh_config(5) man page. +diff -Naur a/sshd_config b/sshd_config +--- a/sshd_config 2024-06-10 16:19:01.530491925 +0100 ++++ b/sshd_config 2024-06-10 16:32:49.766386759 +0100 +@@ -105,8 +105,8 @@ + # no default banner path + #Banner none + +-# override default of no subsystems +-Subsystem sftp /usr/libexec/sftp-server ++# Make sure that all Match options are below this Include! ++Include "/etc/ssh/sshd_config.d/*.conf" + + # Example of overriding settings on a per-user basis + #Match User anoncvs diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.confd b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd-r1.confd similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.confd rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd-r1.confd diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.initd b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd-r1.initd similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd-r1.initd rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd-r1.initd diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.pam_include.2 b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.pam_include.2 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.pam_include.2 rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.pam_include.2 diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.service.1 b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.service.1 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.service.1 rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.service.1 diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.socket similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd.socket rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd.socket diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd_at.service.1 b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd_at.service.1 similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/files/sshd_at.service.1 rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/files/sshd_at.service.1 diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/openssh/metadata.xml similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/metadata.xml rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/metadata.xml diff --git a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-9.6_p1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r3.ebuild similarity index 85% rename from sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-9.6_p1-r2.ebuild rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r3.ebuild index 4d5e6061460..c944856ebe5 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-misc/openssh/openssh-9.6_p1-r2.ebuild +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r3.ebuild @@ -1,10 +1,10 @@ -# Copyright 1999-2023 Gentoo Authors +# Copyright 1999-2024 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc -inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig +inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig # Make it more portable between straight releases # and _p? releases. @@ -22,7 +22,7 @@ LICENSE="BSD GPL-2" SLOT="0" KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris" # Probably want to drop ssl defaulting to on in a future version. -IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X xmss" +IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss" RESTRICT="!test? ( test )" @@ -68,25 +68,17 @@ RDEPEND=" !net-misc/openssh-contrib pam? ( >=sys-auth/pambase-20081028 ) !prefix? ( sys-apps/shadow ) - X? ( x11-apps/xauth ) " -# Weird dep construct for newer gcc-config for bug #872416 BDEPEND=" dev-build/autoconf virtual/pkgconfig - || ( - >=sys-devel/gcc-config-2.6 - >=sys-devel/clang-toolchain-symlinks-14-r1:14 - >=sys-devel/clang-toolchain-symlinks-15-r1:15 - >=sys-devel/clang-toolchain-symlinks-16-r1:* - ) verify-sig? ( sec-keys/openpgp-keys-openssh ) " PATCHES=( "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch" "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch" - "${FILESDIR}/${PN}-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch" + "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch" ) pkg_pretend() { @@ -128,10 +120,6 @@ pkg_pretend() { } src_prepare() { - sed -i \ - -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ - pathnames.h || die - # don't break .ssh/authorized_keys2 for fun sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die @@ -185,6 +173,8 @@ src_configure() { --datadir="${EPREFIX}"/usr/share/openssh --with-privsep-path="${EPREFIX}"/var/empty --with-privsep-user=sshd + # optional at runtime; guarantee a known path + --with-xauth="${EPREFIX}"/usr/bin/xauth # --with-hardening adds the following in addition to flags we # already set in our toolchain: @@ -244,37 +234,6 @@ src_test() { emake -j1 "${tests[@]}" "${src_config}" - rm -f "${copy}" || die -} - # Gentoo tweaks to default config files. tweak_ssh_configs() { local locale_vars=( @@ -288,9 +247,12 @@ tweak_ssh_configs() { ) dodir /etc/ssh/ssh_config.d /etc/ssh/sshd_config.d - - insert_include "${ED}"/etc/ssh/ssh_config 'Host,Match' "${EPREFIX}"/etc/ssh/ssh_config.d - insert_include "${ED}"/etc/ssh/sshd_config 'Match' "${EPREFIX}"/etc/ssh/sshd_config.d + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die + Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf" + EOF + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die + Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf" + EOF cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die # Send locale environment variables (bug #367017) @@ -309,10 +271,6 @@ tweak_ssh_configs() { ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== EOF - # Move sshd's Subsystem option to a drop-in file. - grep -ie 'subsystem' "${ED}"/etc/ssh/sshd_config >"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die - sed -i -e '/[Ss]ubsystem/d' "${ED}"/etc/ssh/sshd_config - cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die # Allow client to pass locale environment variables (bug #367017) AcceptEnv ${locale_vars[*]} @@ -338,10 +296,6 @@ tweak_ssh_configs() { PermitRootLogin Yes EOF fi - - local sshd_drop_ins=("${ED}"/etc/ssh/sshd_config.d/*.conf) - fperms 0700 /etc/ssh/sshd_config.d - fperms 0600 "${sshd_drop_ins[@]#${ED}}" } src_install() { @@ -376,6 +330,9 @@ pkg_preinst() { } pkg_postinst() { + # bug #139235 + optfeature "x11 forwarding" x11-apps/xauth + local old_ver for old_ver in ${REPLACING_VERSIONS}; do if ver_test "${old_ver}" -lt "5.8_p1"; then diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r5.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r5.ebuild new file mode 100644 index 00000000000..eaae6cd6082 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.6_p1-r5.ebuild @@ -0,0 +1,392 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc +inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig + +# Make it more portable between straight releases +# and _p? releases. +PARCH=${P/_} + +DESCRIPTION="Port of OpenBSD's free SSH release" +HOMEPAGE="https://www.openssh.com/" +SRC_URI=" + mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz + verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc ) +" +S="${WORKDIR}/${PARCH}" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris" +# Probably want to drop ssl defaulting to on in a future version. +IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + ldns? ( ssl ) + pie? ( !static ) + static? ( !kerberos !pam ) + xmss? ( ssl ) + test? ( ssl ) +" + +# tests currently fail with XMSS +REQUIRED_USE+="test? ( !xmss )" + +LIB_DEPEND=" + audit? ( sys-process/audit[static-libs(+)] ) + ldns? ( + net-libs/ldns[static-libs(+)] + net-libs/ldns[ecdsa(+),ssl(+)] + ) + libedit? ( dev-libs/libedit:=[static-libs(+)] ) + security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] ) + virtual/libcrypt:=[static-libs(+)] + >=sys-libs/zlib-1.2.3:=[static-libs(+)] +" +RDEPEND=" + acct-group/sshd + acct-user/sshd + !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + pam? ( sys-libs/pam ) + kerberos? ( virtual/krb5 ) +" +DEPEND=" + ${RDEPEND} + virtual/os-headers + kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) + static? ( ${LIB_DEPEND} ) +" +RDEPEND=" + ${RDEPEND} + !net-misc/openssh-contrib + pam? ( >=sys-auth/pambase-20081028 ) + !prefix? ( sys-apps/shadow ) +" +BDEPEND=" + dev-build/autoconf + virtual/pkgconfig + verify-sig? ( sec-keys/openpgp-keys-openssh ) +" + +PATCHES=( + "${FILESDIR}/${PN}-9.3_p1-disable-conch-interop-tests.patch" + "${FILESDIR}/${PN}-9.3_p1-fix-putty-tests.patch" + "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch" + "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch" + "${FILESDIR}/${PN}-9.6_p1-CVE-2024-6387.patch" + "${FILESDIR}/${PN}-9.6_p1-chaff-logic.patch" +) + +pkg_pretend() { + local i enabled_eol_flags disabled_eol_flags + for i in hpn sctp X509; do + if has_version "net-misc/openssh[${i}]"; then + enabled_eol_flags+="${i}," + disabled_eol_flags+="-${i}," + fi + done + + if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then + # Skip for binary packages entirely because of environment saving, bug #907892 + [[ ${MERGE_TYPE} == binary ]] && return + + ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore." + ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality," + ewarn "since these USE flags required third-party patches that often trigger bugs" + ewarn "and are of questionable provenance." + ewarn + ewarn "If you must continue relying on this functionality, switch to" + ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your" + ewarn "world file first: 'emerge --deselect net-misc/openssh'" + ewarn + ewarn "In order to prevent loss of SSH remote login access, we will abort the build." + ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib" + ewarn "variant, when re-emerging you will have to set" + ewarn + ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes" + + die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes" + fi + + # Make sure people who are using tcp wrappers are notified of its removal. #531156 + if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then + ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" + ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please." + fi +} + +src_prepare() { + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) + + default + + # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox + sed -e '/\t\tpercent \\/ d' \ + -i regress/Makefile || die + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + + # _XOPEN_SOURCE causes header conflicts on Solaris + [[ ${CHOST} == *-solaris* ]] && sed_args+=( + -e 's/-D_XOPEN_SOURCE//' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + + use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG + use static && append-ldflags -static + use xmss && append-cflags -DWITH_XMSS + + if [[ ${CHOST} == *-solaris* ]] ; then + # Solaris' glob.h doesn't have things like GLOB_TILDE, configure + # doesn't check for this, so force the replacement to be put in + # place + append-cppflags -DBROKEN_GLOB + fi + + # use replacement, RPF_ECHO_ON doesn't exist here + [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + # optional at runtime; guarantee a known path + --with-xauth="${EPREFIX}"/usr/bin/xauth + + # --with-hardening adds the following in addition to flags we + # already set in our toolchain: + # * -ftrapv (which is broken with GCC anyway), + # * -ftrivial-auto-var-init=zero (which is nice, but not the end of + # the world to not have) + # * -fzero-call-used-regs=used (history of miscompilations with + # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, + # gcc PR104820, gcc PR104817, gcc PR110934)). + # + # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK, + # so we cannot just disable -fzero-call-used-regs=used. + # + # Therefore, just pass --without-hardening, given it doesn't negate + # our already hardened toolchain defaults, and avoids adding flags + # which are known-broken in both Clang and GCC and haven't been + # proven reliable. + --without-hardening + + $(use_with audit audit linux) + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with pie) + $(use_with selinux) + $(use_with security-key security-key-builtin) + $(use_with ssl openssl) + $(use_with ssl ssl-engine) + ) + + if use elibc_musl; then + # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) + myconf+=( --disable-utmp --disable-wtmp ) + fi + + # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all + # bug #869839 (https://github.com/llvm/llvm-project/issues/57692) + tc-is-clang && myconf+=( --without-hardening ) + + econf "${myconf[@]}" +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will run a subset only." + tests+=( interop-tests ) + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 "${tests[@]}" > "${ED}"/etc/ssh/ssh_config || die + Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf" + EOF + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die + Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + if use pam ; then + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_install() { + emake install-nokeys DESTDIR="${D}" + fperms 600 /etc/ssh/sshd_config + dobin contrib/ssh-copy-id + newinitd "${FILESDIR}"/sshd-r1.initd sshd + newconfd "${FILESDIR}"/sshd-r1.confd sshd + + if use pam; then + newpamd "${FILESDIR}"/sshd.pam_include.2 sshd + fi + + tweak_ssh_configs + + doman contrib/ssh-copy-id.1 + dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config + + diropts -m 0700 + dodir /etc/skel/.ssh + rmdir "${ED}"/var/empty || die + + systemd_dounit "${FILESDIR}"/sshd.socket + systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service + systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service' +} + +pkg_preinst() { + if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then + show_ssl_warning=1 + fi +} + +pkg_postinst() { + # bug #139235 + optfeature "x11 forwarding" x11-apps/xauth + + local old_ver + for old_ver in ${REPLACING_VERSIONS}; do + if ver_test "${old_ver}" -lt "5.8_p1"; then + elog "Starting with openssh-5.8p1, the server will default to a newer key" + elog "algorithm (ECDSA). You are encouraged to manually update your stored" + elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." + fi + if ver_test "${old_ver}" -lt "7.0_p1"; then + elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." + elog "Make sure to update any configs that you might have. Note that xinetd might" + elog "be an alternative for you as it supports USE=tcpd." + fi + if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518 + elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" + elog "weak sizes. If you rely on these key types, you can re-enable the key types by" + elog "adding to your sshd_config or ~/.ssh/config files:" + elog " PubkeyAcceptedKeyTypes=+ssh-dss" + elog "You should however generate new keys using rsa or ed25519." + + elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" + elog "to 'prohibit-password'. That means password auth for root users no longer works" + elog "out of the box. If you need this, please update your sshd_config explicitly." + fi + if ver_test "${old_ver}" -lt "7.6_p1"; then + elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely." + elog "Furthermore, rsa keys with less than 1024 bits will be refused." + fi + if ver_test "${old_ver}" -lt "7.7_p1"; then + elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality." + elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option" + elog "if you need to authenticate against LDAP." + elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details." + fi + if ver_test "${old_ver}" -lt "8.2_p1"; then + ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you" + ewarn "will not be able to establish new sessions. Restarting sshd over a ssh" + ewarn "connection is generally safe." + fi + if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then + ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to" + ewarn "'Restart=on-failure', which causes the service to automatically restart if it" + ewarn "terminates with an unclean exit code or signal. This feature is useful for most users," + ewarn "but it can increase the vulnerability of the system in the event of a future exploit." + ewarn "If you have a web-facing setup or are concerned about security, it is recommended to" + ewarn "set 'Restart=no' in your sshd unit file." + fi + done + + if [[ -n ${show_ssl_warning} ]]; then + elog "Be aware that by disabling openssl support in openssh, the server and clients" + elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" + elog "and update all clients/servers that utilize them." + fi +} diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild new file mode 100644 index 00000000000..dfe20d9c227 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild @@ -0,0 +1,400 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc +inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig + +# Make it more portable between straight releases +# and _p? releases. +PARCH=${P/_} + +DESCRIPTION="Port of OpenBSD's free SSH release" +HOMEPAGE="https://www.openssh.com/" +SRC_URI=" + mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz + verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc ) +" +S="${WORKDIR}/${PARCH}" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris" +# Probably want to drop ssl defaulting to on in a future version. +IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + ldns? ( ssl ) + pie? ( !static ) + static? ( !kerberos !pam ) + xmss? ( ssl ) + test? ( ssl ) +" + +# tests currently fail with XMSS +REQUIRED_USE+="test? ( !xmss )" + +LIB_DEPEND=" + audit? ( sys-process/audit[static-libs(+)] ) + ldns? ( + net-libs/ldns[static-libs(+)] + net-libs/ldns[ecdsa(+),ssl(+)] + ) + libedit? ( dev-libs/libedit:=[static-libs(+)] ) + security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] ) + virtual/libcrypt:=[static-libs(+)] + >=sys-libs/zlib-1.2.3:=[static-libs(+)] +" +RDEPEND=" + acct-group/sshd + acct-user/sshd + !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + pam? ( sys-libs/pam ) + kerberos? ( virtual/krb5 ) +" +DEPEND=" + ${RDEPEND} + virtual/os-headers + kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) + static? ( ${LIB_DEPEND} ) +" +RDEPEND=" + ${RDEPEND} + !net-misc/openssh-contrib + pam? ( >=sys-auth/pambase-20081028 ) + !prefix? ( sys-apps/shadow ) +" +BDEPEND=" + dev-build/autoconf + virtual/pkgconfig + verify-sig? ( sec-keys/openpgp-keys-openssh ) +" + +PATCHES=( + "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch" + "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch" + "${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch" + "${FILESDIR}/${PN}-9.6_p1-CVE-2024-6387.patch" + "${FILESDIR}/${PN}-9.6_p1-chaff-logic.patch" +) + +pkg_pretend() { + local i enabled_eol_flags disabled_eol_flags + for i in hpn sctp X509; do + if has_version "net-misc/openssh[${i}]"; then + enabled_eol_flags+="${i}," + disabled_eol_flags+="-${i}," + fi + done + + if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then + # Skip for binary packages entirely because of environment saving, bug #907892 + [[ ${MERGE_TYPE} == binary ]] && return + + ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore." + ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality," + ewarn "since these USE flags required third-party patches that often trigger bugs" + ewarn "and are of questionable provenance." + ewarn + ewarn "If you must continue relying on this functionality, switch to" + ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your" + ewarn "world file first: 'emerge --deselect net-misc/openssh'" + ewarn + ewarn "In order to prevent loss of SSH remote login access, we will abort the build." + ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib" + ewarn "variant, when re-emerging you will have to set" + ewarn + ewarn " OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes" + + die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes" + fi + + # Make sure people who are using tcp wrappers are notified of its removal. #531156 + if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then + ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" + ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please." + fi +} + +src_prepare() { + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + [[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches ) + + default + + # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox + sed -e '/\t\tpercent \\/ d' \ + -i regress/Makefile || die + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + + # _XOPEN_SOURCE causes header conflicts on Solaris + [[ ${CHOST} == *-solaris* ]] && sed_args+=( + -e 's/-D_XOPEN_SOURCE//' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + + use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG + use static && append-ldflags -static + use xmss && append-cflags -DWITH_XMSS + + if [[ ${CHOST} == *-solaris* ]] ; then + # Solaris' glob.h doesn't have things like GLOB_TILDE, configure + # doesn't check for this, so force the replacement to be put in + # place + append-cppflags -DBROKEN_GLOB + fi + + # use replacement, RPF_ECHO_ON doesn't exist here + [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + # optional at runtime; guarantee a known path + --with-xauth="${EPREFIX}"/usr/bin/xauth + + # --with-hardening adds the following in addition to flags we + # already set in our toolchain: + # * -ftrapv (which is broken with GCC anyway), + # * -ftrivial-auto-var-init=zero (which is nice, but not the end of + # the world to not have) + # * -fzero-call-used-regs=used (history of miscompilations with + # Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086, + # gcc PR104820, gcc PR104817, gcc PR110934)). + # + # Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK, + # so we cannot just disable -fzero-call-used-regs=used. + # + # Therefore, just pass --without-hardening, given it doesn't negate + # our already hardened toolchain defaults, and avoids adding flags + # which are known-broken in both Clang and GCC and haven't been + # proven reliable. + --without-hardening + + $(use_with audit audit linux) + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with pie) + $(use_with selinux) + $(use_with security-key security-key-builtin) + $(use_with ssl openssl) + $(use_with ssl ssl-engine) + ) + + if use elibc_musl; then + # musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230) + myconf+=( --disable-utmp --disable-wtmp ) + fi + + # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all + # bug #869839 (https://github.com/llvm/llvm-project/issues/57692) + tc-is-clang && myconf+=( --without-hardening ) + + econf "${myconf[@]}" +} + +create_config_dropins() { + local locale_vars=( + # These are language variables that POSIX defines. + # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02 + LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME + + # These are the GNU extensions. + # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html + LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE + ) + + mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die + # override default of no subsystems + Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server + EOF + + if use pam ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_compile() { + default + create_config_dropins +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will run a subset only." + tests+=( interop-tests ) + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 "${tests[@]}" "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die + # override default of no subsystems + Subsystem sftp ${EPREFIX}/usr/$(get_libdir)/misc/sftp-server + EOF + + if use pam ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_compile() { + default + create_config_dropins +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will run a subset only." + tests+=( interop-tests ) + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 "${tests[@]}" /dev/null 2>&1; then + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'" + systemctl try-restart sshd + eend $? + elif [[ -d /run/openrc ]]; then + # We don't check for sshd -t here because the OpenRC init script + # has a stop_pre() which does checkconfig, i.e. we defer to it + # to give nicer output for a failed sanity check. + ewarn "The ebuild will now attempt to restart OpenSSH to avoid" + ewarn "bricking the running instance. See bug #709748." + ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'" + rc-service -q --ifstarted --nodeps sshd restart + eend $? + fi +} From be3f0358a6b7663a40720a237ae900f91da2821f Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 1 Jul 2024 19:28:42 +0530 Subject: [PATCH 07/27] .github: Add the net-misc/openssh package into automation Signed-off-by: Sayan Chowdhury --- .github/workflows/portage-stable-packages-list | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list index 8aff44662d2..3e4bc644771 100644 --- a/.github/workflows/portage-stable-packages-list +++ b/.github/workflows/portage-stable-packages-list @@ -439,6 +439,7 @@ net-misc/ethertypes net-misc/iperf net-misc/iputils net-misc/ntp +net-misc/openssh net-misc/rsync net-misc/socat net-misc/wget From 906afc17337ef52e4d947c6a6caa2487045d1925 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 1 Jul 2024 18:18:09 +0530 Subject: [PATCH 08/27] changelog: Add the changelog for openssh Signed-off-by: Sayan Chowdhury --- changelog/security/2024-07-01-openssh-9.7_p1-r6.md | 1 + changelog/updates/2024-07-01-openssh-9.7_p1-r6.md | 1 + 2 files changed, 2 insertions(+) create mode 100644 changelog/security/2024-07-01-openssh-9.7_p1-r6.md create mode 100644 changelog/updates/2024-07-01-openssh-9.7_p1-r6.md diff --git a/changelog/security/2024-07-01-openssh-9.7_p1-r6.md b/changelog/security/2024-07-01-openssh-9.7_p1-r6.md new file mode 100644 index 00000000000..595c0366315 --- /dev/null +++ b/changelog/security/2024-07-01-openssh-9.7_p1-r6.md @@ -0,0 +1 @@ +- openssh ([CVE-2024-6387](https://nvd.nist.gov/vuln/detail/CVE-2024-6387)) diff --git a/changelog/updates/2024-07-01-openssh-9.7_p1-r6.md b/changelog/updates/2024-07-01-openssh-9.7_p1-r6.md new file mode 100644 index 00000000000..84d12d93000 --- /dev/null +++ b/changelog/updates/2024-07-01-openssh-9.7_p1-r6.md @@ -0,0 +1 @@ +- openssh ([9.7_p1](https://www.openssh.com/txt/release-9.7)) From 01c861608a71296b2055e942d200d3d844078e4c Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Mon, 1 Jul 2024 21:00:24 +0000 Subject: [PATCH 09/27] New version: alpha-4012.0.0-nightly-20240701-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index bfab88adab3..df722a9126e 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.0+nightly-20240628-2100 +FLATCAR_VERSION=4012.0.0+nightly-20240701-2100 FLATCAR_VERSION_ID=4012.0.0 -FLATCAR_BUILD_ID="nightly-20240628-2100" +FLATCAR_BUILD_ID="nightly-20240701-2100" FLATCAR_SDK_VERSION=4012.0.0 From fddc6f73f2289dd9c473daa9373ff4f689b2aa01 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Mon, 1 Jul 2024 23:08:23 +0200 Subject: [PATCH 10/27] New version: alpha-4012.0.1 --- sdk_container/.repo/manifests/version.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index df722a9126e..e6eb3de3a50 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.0+nightly-20240701-2100 -FLATCAR_VERSION_ID=4012.0.0 -FLATCAR_BUILD_ID="nightly-20240701-2100" +FLATCAR_VERSION=4012.0.1 +FLATCAR_VERSION_ID=4012.0.1 +FLATCAR_BUILD_ID="" FLATCAR_SDK_VERSION=4012.0.0 From 714af30a38547fc9cce21878f9df262b6a0e7ff6 Mon Sep 17 00:00:00 2001 From: Krzesimir Nowak Date: Tue, 25 Jun 2024 18:33:37 +0200 Subject: [PATCH 11/27] ci-automation: Drop azure auth flags --- ci-automation/garbage_collect_cloud.sh | 2 +- ci-automation/release.sh | 2 -- ci-automation/vendor-testing/azure.sh | 1 - 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/ci-automation/garbage_collect_cloud.sh b/ci-automation/garbage_collect_cloud.sh index 8c038399aa9..a3e105ba9f9 100755 --- a/ci-automation/garbage_collect_cloud.sh +++ b/ci-automation/garbage_collect_cloud.sh @@ -4,7 +4,7 @@ source ci-automation/ci_automation_common.sh timeout --signal=SIGQUIT 60m ore aws gc --access-id "${AWS_ACCESS_KEY_ID}" --secret-key "${AWS_SECRET_ACCESS_KEY}" timeout --signal=SIGQUIT 60m ore do gc --config-file=<(echo "${DIGITALOCEAN_TOKEN_JSON}" | base64 --decode) timeout --signal=SIGQUIT 60m ore gcloud gc --json-key <(echo "${GCP_JSON_KEY}" | base64 --decode) -timeout --signal=SIGQUIT 60m ore azure gc --duration 6h --azure-identity +timeout --signal=SIGQUIT 60m ore azure gc --duration 6h timeout --signal=SIGQUIT 60m ore equinixmetal gc --duration 6h \ --project="${EQUINIXMETAL_PROJECT}" --gs-json-key=<(echo "${GCP_JSON_KEY}" | base64 --decode) --api-key="${EQUINIXMETAL_KEY}" timeout --signal=SIGQUIT 60m ore openstack gc --duration 6h \ diff --git a/ci-automation/release.sh b/ci-automation/release.sh index 65be545ef33..6035d81d7f2 100644 --- a/ci-automation/release.sh +++ b/ci-automation/release.sh @@ -108,7 +108,6 @@ function _inside_mantle() { --debug \ --platform="${platform}" \ --aws-credentials="${aws_credentials_config_file}" \ - --azure-identity \ --gce-json-key=none \ --board="${arch}-usr" \ --channel="${CHANNEL}" \ @@ -137,7 +136,6 @@ function _inside_mantle() { --publish-marketplace \ --access-role-arn="${AWS_MARKETPLACE_ARN}" \ --product-ids="${pid}" \ - --azure-identity \ --gce-json-key="${gcp_json_key_path}" \ --gce-release-key="${google_release_credentials_file}" \ --board="${arch}-usr" \ diff --git a/ci-automation/vendor-testing/azure.sh b/ci-automation/vendor-testing/azure.sh index bc7adf16ae6..069b3b34800 100755 --- a/ci-automation/vendor-testing/azure.sh +++ b/ci-automation/vendor-testing/azure.sh @@ -52,7 +52,6 @@ run_kola_tests() { --platform=azure \ --azure-image-file="${AZURE_IMAGE_NAME}" \ --azure-location="${AZURE_LOCATION}" \ - --azure-identity \ --tapfile="${instance_tapfile}" \ --azure-size="${instance_type}" \ --azure-hyper-v-generation="${hyperv_gen}" \ From 92fba28c9c3ca7f2d371623e92434f4419cce887 Mon Sep 17 00:00:00 2001 From: Krzesimir Nowak Date: Tue, 2 Jul 2024 17:07:19 +0200 Subject: [PATCH 12/27] Update mantle container image to latest HEAD --- sdk_container/.repo/manifests/mantle-container | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk_container/.repo/manifests/mantle-container b/sdk_container/.repo/manifests/mantle-container index 5c854a98c1a..424b010ab30 100644 --- a/sdk_container/.repo/manifests/mantle-container +++ b/sdk_container/.repo/manifests/mantle-container @@ -1 +1 @@ -ghcr.io/flatcar/mantle:git-60de9ff9f3d070f73c2cd69bdfdc088ea0d9f0f9 +ghcr.io/flatcar/mantle:git-3321b584ff11c5cab13bde61398c30b4d205b999 From 99856d60fb63696039f2c27db04de4a745085cab Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Tue, 2 Jul 2024 21:00:27 +0000 Subject: [PATCH 13/27] New version: alpha-4012.0.1-nightly-20240702-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index e6eb3de3a50..c77fde5dc9f 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1 +FLATCAR_VERSION=4012.0.1+nightly-20240702-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="" +FLATCAR_BUILD_ID="nightly-20240702-2100" FLATCAR_SDK_VERSION=4012.0.0 From 564f42513e5fa57f61c67a25eced0e89f533b3b2 Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Wed, 3 Jul 2024 21:00:28 +0000 Subject: [PATCH 14/27] New version: alpha-4012.0.1-nightly-20240703-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index c77fde5dc9f..8268d9dd83e 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240702-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240703-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240702-2100" +FLATCAR_BUILD_ID="nightly-20240703-2100" FLATCAR_SDK_VERSION=4012.0.0 From 7d74ea96e5c3d151bbc6bf1f28c0015f32d1953c Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Sat, 6 Jul 2024 07:11:59 +0000 Subject: [PATCH 15/27] sys-kernel/coreos-sources: Update from 6.6.36 to 6.6.37 --- changelog/updates/2024-07-06-linux-6.6.37-update.md | 1 + ...{coreos-kernel-6.6.36.ebuild => coreos-kernel-6.6.37.ebuild} | 0 ...oreos-modules-6.6.36.ebuild => coreos-modules-6.6.37.ebuild} | 0 .../coreos-overlay/sys-kernel/coreos-sources/Manifest | 2 +- ...oreos-sources-6.6.36.ebuild => coreos-sources-6.6.37.ebuild} | 0 5 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-06-linux-6.6.37-update.md rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-6.6.36.ebuild => coreos-kernel-6.6.37.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-6.6.36.ebuild => coreos-modules-6.6.37.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.6.36.ebuild => coreos-sources-6.6.37.ebuild} (100%) diff --git a/changelog/updates/2024-07-06-linux-6.6.37-update.md b/changelog/updates/2024-07-06-linux-6.6.37-update.md new file mode 100644 index 00000000000..7dbfd2d3a7f --- /dev/null +++ b/changelog/updates/2024-07-06-linux-6.6.37-update.md @@ -0,0 +1 @@ +- Linux ([6.6.37](https://lwn.net/Articles/980860)) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.37.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.36.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.37.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.37.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.36.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.37.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 3595100912a..9abd50f043c 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.36.xz 2352844 BLAKE2B 2745e627a9871b3ba3979d1e4384b4872f296d7ff8f6a2dcdd257c7b2784707d64314214170edca338f29c21742ac9b054c396c93e2d3ccf287014633f316b0e SHA512 a24b5f49c82817d65e8db2cf33d69cbaa99248e2733bbd9e112f152b656eebf95fe0383bd07cd207683e02dd88a257a8628a296293696ae72cd3d87064e7d961 +DIST patch-6.6.37.xz 2392024 BLAKE2B f98bb743db2ff040a8c7f393205a69554be2f3ddca6916a2ca9d0a56c84232f05d41e4317d14ac2c739c61bf9eed41039b06ea22e07e31b6439c07abb02e048b SHA512 ed039eb4a78c37707cda86b402498c3070d54fed3ade9cfa12611c9a236a29078b0092ecfa549e0f7ff908d256637b0f7caa4bc1aa8a1b9121b3d20732e58ab5 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.36.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.37.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.36.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.37.ebuild From 17874057ed53d9ccca0d12a29dfb646b11f59602 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Mon, 8 Jul 2024 07:11:29 +0000 Subject: [PATCH 16/27] Update mantle container image to latest HEAD --- sdk_container/.repo/manifests/mantle-container | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk_container/.repo/manifests/mantle-container b/sdk_container/.repo/manifests/mantle-container index 424b010ab30..5ea2ca4cde6 100644 --- a/sdk_container/.repo/manifests/mantle-container +++ b/sdk_container/.repo/manifests/mantle-container @@ -1 +1 @@ -ghcr.io/flatcar/mantle:git-3321b584ff11c5cab13bde61398c30b4d205b999 +ghcr.io/flatcar/mantle:git-5c9351de5eeb17e1520930fade0b4dc783c452c7 From 3d40aea89d8dcb81be2576b2aec7ea8a16c73f06 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Mon, 8 Jul 2024 07:21:45 +0000 Subject: [PATCH 17/27] app-misc/ca-certificates: Update from 3.101 to 3.102 --- changelog/updates/2024-07-08-ca-certificates-3.102-update.md | 1 + .../coreos-overlay/app-misc/ca-certificates/Manifest | 2 +- ...certificates-3.101.1.ebuild => ca-certificates-3.102.ebuild} | 0 3 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-08-ca-certificates-3.102-update.md rename sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/{ca-certificates-3.101.1.ebuild => ca-certificates-3.102.ebuild} (100%) diff --git a/changelog/updates/2024-07-08-ca-certificates-3.102-update.md b/changelog/updates/2024-07-08-ca-certificates-3.102-update.md new file mode 100644 index 00000000000..51ae9270c33 --- /dev/null +++ b/changelog/updates/2024-07-08-ca-certificates-3.102-update.md @@ -0,0 +1 @@ +- ca-certificates ([3.102](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_102.html)) diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest index dda91af7282..5b7f13fe3b3 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest @@ -1 +1 @@ -DIST nss-3.101.1.tar.gz 76462490 BLAKE2B 578a5ce6c9157c25db801a3fe37e094d8005130967ecf1cca19f52a69dfd43195cc8a0c5310dce48936aab4faae424b4e8f24bae6e4f6ac02ea4914e5af4e2be SHA512 0752ad801d00db0180fa72c06d40ee62f88fff220b88880c26f181ba5b9380e785486faa15f8799aaf7145afa47fdd10a27554ec23605a98fbe258951654822d +DIST nss-3.102.tar.gz 76455599 BLAKE2B 78eb95279640dcc46c29decd35fc4c2a2a591c5a39b8dbfcb232d72a08d1ee44d836ce8ee06fff2fe677d3ea19a8b6219a1fe9296f9b56ebfbab7295583e71fe SHA512 2706f15447afd6c26f6784e56c01e8328456523b464a2df2b054f230b6e6b5db2fdeccac74f4f4f0d683d7d4471a8ec1321102082d8a22d91887153a60ffac5b diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.102.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.101.1.ebuild rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.102.ebuild From 49280b2599fed9edc00aa2a76024749a66f0dd2c Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Mon, 8 Jul 2024 21:00:26 +0000 Subject: [PATCH 18/27] New version: alpha-4012.0.1-nightly-20240708-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 8268d9dd83e..c3637610c3f 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240703-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240708-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240703-2100" +FLATCAR_BUILD_ID="nightly-20240708-2100" FLATCAR_SDK_VERSION=4012.0.0 From dafb9cfd3dca32947cc05f66674639e52597862d Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Tue, 9 Jul 2024 21:00:29 +0000 Subject: [PATCH 19/27] New version: alpha-4012.0.1-nightly-20240709-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index c3637610c3f..86c08c189f9 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240708-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240709-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240708-2100" +FLATCAR_BUILD_ID="nightly-20240709-2100" FLATCAR_SDK_VERSION=4012.0.0 From fa7fb27d91d60d65776f8ea947bda00127399b57 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Wed, 10 Jul 2024 07:15:42 +0000 Subject: [PATCH 20/27] sys-kernel/coreos-sources: Update from 6.6.37 to 6.6.38 --- changelog/updates/2024-07-10-linux-6.6.38-update.md | 1 + ...{coreos-kernel-6.6.37.ebuild => coreos-kernel-6.6.38.ebuild} | 0 ...oreos-modules-6.6.37.ebuild => coreos-modules-6.6.38.ebuild} | 0 .../coreos-overlay/sys-kernel/coreos-sources/Manifest | 2 +- ...oreos-sources-6.6.37.ebuild => coreos-sources-6.6.38.ebuild} | 0 5 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-10-linux-6.6.38-update.md rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-6.6.37.ebuild => coreos-kernel-6.6.38.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-6.6.37.ebuild => coreos-modules-6.6.38.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.6.37.ebuild => coreos-sources-6.6.38.ebuild} (100%) diff --git a/changelog/updates/2024-07-10-linux-6.6.38-update.md b/changelog/updates/2024-07-10-linux-6.6.38-update.md new file mode 100644 index 00000000000..db9802a71c6 --- /dev/null +++ b/changelog/updates/2024-07-10-linux-6.6.38-update.md @@ -0,0 +1 @@ +- Linux ([6.6.38](https://lwn.net/Articles/981255)) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.37.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.38.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.37.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.38.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.37.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.38.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.37.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.38.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 9abd50f043c..f0719592a89 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.37.xz 2392024 BLAKE2B f98bb743db2ff040a8c7f393205a69554be2f3ddca6916a2ca9d0a56c84232f05d41e4317d14ac2c739c61bf9eed41039b06ea22e07e31b6439c07abb02e048b SHA512 ed039eb4a78c37707cda86b402498c3070d54fed3ade9cfa12611c9a236a29078b0092ecfa549e0f7ff908d256637b0f7caa4bc1aa8a1b9121b3d20732e58ab5 +DIST patch-6.6.38.xz 2387992 BLAKE2B efb790ecad862e53fce6ebc90c9dc06d68ec15573f1ebc79f0aa924ad0dfe795329d7eb197b0bdf844541854a580e70835a50a32860c98650cc4d60ae9b675fa SHA512 8d595d4b103bc3f75a3ce0b2fed6690fba18475d33a0496c38f8362c5c9a8891b2641739df4c9b75219908cd2c2cf231483b892030345982622eb45f4c62db0a diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.37.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.38.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.37.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.38.ebuild From 59cb7077d20b7a7831121151eb0128e718d1d9ef Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Wed, 10 Jul 2024 21:00:26 +0000 Subject: [PATCH 21/27] New version: alpha-4012.0.1-nightly-20240710-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 86c08c189f9..44a39c6f455 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240709-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240710-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240709-2100" +FLATCAR_BUILD_ID="nightly-20240710-2100" FLATCAR_SDK_VERSION=4012.0.0 From 8a7d3cd68a8f820365555f803007d0effe01e533 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Fri, 12 Jul 2024 07:14:24 +0000 Subject: [PATCH 22/27] sys-kernel/coreos-sources: Update from 6.6.38 to 6.6.39 --- changelog/updates/2024-07-12-linux-6.6.39-update.md | 1 + ...{coreos-kernel-6.6.38.ebuild => coreos-kernel-6.6.39.ebuild} | 0 ...oreos-modules-6.6.38.ebuild => coreos-modules-6.6.39.ebuild} | 0 .../coreos-overlay/sys-kernel/coreos-sources/Manifest | 2 +- ...oreos-sources-6.6.38.ebuild => coreos-sources-6.6.39.ebuild} | 0 5 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-12-linux-6.6.39-update.md rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-6.6.38.ebuild => coreos-kernel-6.6.39.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-6.6.38.ebuild => coreos-modules-6.6.39.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.6.38.ebuild => coreos-sources-6.6.39.ebuild} (100%) diff --git a/changelog/updates/2024-07-12-linux-6.6.39-update.md b/changelog/updates/2024-07-12-linux-6.6.39-update.md new file mode 100644 index 00000000000..c8a37d32e4e --- /dev/null +++ b/changelog/updates/2024-07-12-linux-6.6.39-update.md @@ -0,0 +1 @@ +- Linux ([6.6.39](https://lwn.net/Articles/981719)) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.38.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.39.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.38.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.39.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.38.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.39.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.38.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.39.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index f0719592a89..7d03becea11 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.38.xz 2387992 BLAKE2B efb790ecad862e53fce6ebc90c9dc06d68ec15573f1ebc79f0aa924ad0dfe795329d7eb197b0bdf844541854a580e70835a50a32860c98650cc4d60ae9b675fa SHA512 8d595d4b103bc3f75a3ce0b2fed6690fba18475d33a0496c38f8362c5c9a8891b2641739df4c9b75219908cd2c2cf231483b892030345982622eb45f4c62db0a +DIST patch-6.6.39.xz 2417252 BLAKE2B 573ba2859436c31791d8d0ab62093763d255ebb3392081623b7e38e854e283222ce591f8100a3688661e371b2645ae9e88ddd099c9c1797e8c9b6bab5b6b001e SHA512 b77d49ebac1fd77073a22f1f9443624b8a4b58619a05b39627a44cbd822808eb63ed11eb0214aebed5e8906ca476b8e881e9e3ec45e53a81d9a9f622493064b7 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.38.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.39.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.38.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.39.ebuild From 39650f0af5c5af2a2f9ffbb08a0fb9833d11c313 Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Mon, 15 Jul 2024 21:00:25 +0000 Subject: [PATCH 23/27] New version: alpha-4012.0.1-nightly-20240715-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 44a39c6f455..80a870acbbe 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240710-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240715-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240710-2100" +FLATCAR_BUILD_ID="nightly-20240715-2100" FLATCAR_SDK_VERSION=4012.0.0 From 9f3c67d71aa0f017286e2e8e5cc94e40442141f8 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Tue, 16 Jul 2024 07:14:10 +0000 Subject: [PATCH 24/27] sys-kernel/coreos-sources: Update from 6.6.39 to 6.6.40 --- changelog/updates/2024-07-16-linux-6.6.40-update.md | 1 + ...{coreos-kernel-6.6.39.ebuild => coreos-kernel-6.6.40.ebuild} | 0 ...oreos-modules-6.6.39.ebuild => coreos-modules-6.6.40.ebuild} | 0 .../coreos-overlay/sys-kernel/coreos-sources/Manifest | 2 +- ...oreos-sources-6.6.39.ebuild => coreos-sources-6.6.40.ebuild} | 0 5 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/updates/2024-07-16-linux-6.6.40-update.md rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/{coreos-kernel-6.6.39.ebuild => coreos-kernel-6.6.40.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/{coreos-modules-6.6.39.ebuild => coreos-modules-6.6.40.ebuild} (100%) rename sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/{coreos-sources-6.6.39.ebuild => coreos-sources-6.6.40.ebuild} (100%) diff --git a/changelog/updates/2024-07-16-linux-6.6.40-update.md b/changelog/updates/2024-07-16-linux-6.6.40-update.md new file mode 100644 index 00000000000..5edb92d427d --- /dev/null +++ b/changelog/updates/2024-07-16-linux-6.6.40-update.md @@ -0,0 +1 @@ +- Linux ([6.6.40](https://lwn.net/Articles/982050)) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.39.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.40.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.39.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.6.40.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.39.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.40.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.39.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/coreos-modules-6.6.40.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest index 7d03becea11..a0e0eea646f 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest @@ -1,2 +1,2 @@ DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35 -DIST patch-6.6.39.xz 2417252 BLAKE2B 573ba2859436c31791d8d0ab62093763d255ebb3392081623b7e38e854e283222ce591f8100a3688661e371b2645ae9e88ddd099c9c1797e8c9b6bab5b6b001e SHA512 b77d49ebac1fd77073a22f1f9443624b8a4b58619a05b39627a44cbd822808eb63ed11eb0214aebed5e8906ca476b8e881e9e3ec45e53a81d9a9f622493064b7 +DIST patch-6.6.40.xz 2417316 BLAKE2B 1e0fe072ac47b28a6807a33ca026d0472934465c38040e8190777fa99182106b69ab11cf68838d91e61905688bf5c440bd76357610c02fbc0845255442c547a3 SHA512 3c53fc7179a684a0bd7ae21a0ace2d0779f01b32b497d01496f2b4f0e7852ad5a8a840fffe8731d218373b6e42d62fc3fcba1f5a3ebf6bf4734571381b411e12 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.39.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.40.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.39.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/coreos-sources-6.6.40.ebuild From f7fd023c58dba771c3605c0419c9b0120c55ebe1 Mon Sep 17 00:00:00 2001 From: flatcar-ci Date: Tue, 16 Jul 2024 21:00:28 +0000 Subject: [PATCH 25/27] New version: alpha-4012.0.1-nightly-20240716-2100 --- sdk_container/.repo/manifests/version.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk_container/.repo/manifests/version.txt b/sdk_container/.repo/manifests/version.txt index 80a870acbbe..0f5ee0843ba 100644 --- a/sdk_container/.repo/manifests/version.txt +++ b/sdk_container/.repo/manifests/version.txt @@ -1,4 +1,4 @@ -FLATCAR_VERSION=4012.0.1+nightly-20240715-2100 +FLATCAR_VERSION=4012.0.1+nightly-20240716-2100 FLATCAR_VERSION_ID=4012.0.1 -FLATCAR_BUILD_ID="nightly-20240715-2100" +FLATCAR_BUILD_ID="nightly-20240716-2100" FLATCAR_SDK_VERSION=4012.0.0 From 697ede895bc0c9121a81fc48662d01457a7d4184 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Tue, 16 Jul 2024 21:00:46 +0000 Subject: [PATCH 26/27] Update mantle container image to latest HEAD --- sdk_container/.repo/manifests/mantle-container | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk_container/.repo/manifests/mantle-container b/sdk_container/.repo/manifests/mantle-container index 5ea2ca4cde6..73a8db5f94e 100644 --- a/sdk_container/.repo/manifests/mantle-container +++ b/sdk_container/.repo/manifests/mantle-container @@ -1 +1 @@ -ghcr.io/flatcar/mantle:git-5c9351de5eeb17e1520930fade0b4dc783c452c7 +ghcr.io/flatcar/mantle:git-1adf266089c795c4021addaa9d595627662d9e0d From 54afa928c145317742879f43e9c638266b8d001a Mon Sep 17 00:00:00 2001 From: Adrian Vladu Date: Wed, 17 Jul 2024 18:10:44 +0300 Subject: [PATCH 27/27] riscv: added riscv profile POC TBD: test if an SDK can be bootstrapped Signed-off-by: Adrian Vladu --- build_library/ebuild_aci_util.sh | 1 + build_library/prefix_util.sh | 5 +++++ build_library/toolchain_util.sh | 12 ++++++++++++ common.sh | 16 ++++++++++++++++ .../coreos-overlay/profiles/coreos/riscv/README | 4 ++++ .../profiles/coreos/riscv/generic/dev/parent | 2 ++ .../profiles/coreos/riscv/generic/make.defaults | 2 ++ .../profiles/coreos/riscv/generic/oem-aci/parent | 2 ++ .../profiles/coreos/riscv/generic/parent | 2 ++ .../profiles/coreos/riscv/generic/prod/parent | 2 ++ .../profiles/coreos/riscv/make.defaults | 2 ++ .../profiles/coreos/riscv/package.provided | 1 + .../profiles/coreos/riscv/package.use | 4 ++++ .../profiles/coreos/riscv/packages | 3 +++ .../coreos-overlay/profiles/coreos/riscv/parent | 2 ++ .../profiles/coreos/riscv/sdk/make.defaults | 2 ++ .../profiles/coreos/riscv/sdk/package.use | 3 +++ .../profiles/coreos/riscv/sdk/parent | 2 ++ .../profiles/coreos/riscv/use.mask | 1 + .../profiles/coreos/targets/sdk/make.defaults | 6 +++--- .../profiles/coreos/targets/sdk/package.use | 2 +- .../coreos-overlay/profiles/profiles.desc | 5 +++++ .../app-emulation/qemu/qemu-8.1.5.ebuild | 2 +- 23 files changed, 78 insertions(+), 5 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/README create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/dev/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/make.defaults create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/oem-aci/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/prod/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/make.defaults create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.provided create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.use create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/packages create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/make.defaults create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/package.use create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/parent create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/use.mask diff --git a/build_library/ebuild_aci_util.sh b/build_library/ebuild_aci_util.sh index b25449bc197..d606a2abfe6 100644 --- a/build_library/ebuild_aci_util.sh +++ b/build_library/ebuild_aci_util.sh @@ -42,6 +42,7 @@ ebuild_aci_write_manifest() { case "${BOARD}" in amd64-usr) appc_arch=amd64 ;; arm64-usr) appc_arch=aarch64 ;; + riscv-usr) appc_arch=riscv64 ;; *) die_notrace "Cannot map \"${BOARD}\" to an appc arch" ;; esac diff --git a/build_library/prefix_util.sh b/build_library/prefix_util.sh index a3c3db8a4d1..4dbc921bfa2 100644 --- a/build_library/prefix_util.sh +++ b/build_library/prefix_util.sh @@ -32,6 +32,10 @@ function set_prefix_vars() { PREFIX_CHOST="aarch64-cros-linux-gnu" PREFIX_KEYWORDS="arm64 -~arm64" ;; + riscv-usr) + PREFIX_CHOST="riscv64-cros-linux-gnu" + PREFIX_KEYWORDS="riscv -~riscv" + ;; esac export EPREFIX PREFIXNAME STAGINGDIR STAGINGROOT FINALDIR FINALROOT CB_ROOT \ @@ -71,6 +75,7 @@ function setup_prefix_dirs() { case "${PREFIX_BOARD}" in amd64-usr) profile="${profile}/amd64/17.1/no-multilib/prefix/kernel-3.2+";; arm64-usr) profile="${profile}/arm64/17.0/prefix/kernel-3.2+";; + riscv-usr) profile="${profile}/riscv/20.0/rv64gc/lp64d/prefix/kernel-3.2+";; esac sudo ln -s "${profile}" "${STAGINGROOT}${EPREFIX}/etc/portage/make.profile" diff --git a/build_library/toolchain_util.sh b/build_library/toolchain_util.sh index 8afd45e49f3..3f90d50a1c4 100644 --- a/build_library/toolchain_util.sh +++ b/build_library/toolchain_util.sh @@ -16,6 +16,7 @@ TOOLCHAIN_PKGS=( declare -A CROSS_PROFILES CROSS_PROFILES["x86_64-cros-linux-gnu"]="coreos:coreos/amd64/generic" CROSS_PROFILES["aarch64-cros-linux-gnu"]="coreos:coreos/arm64/generic" +CROSS_PROFILES["riscv64-cros-linux-gnu"]="coreos:coreos/riscv/generic" # Map board names to CHOSTs and portage profiles. This is the # definitive list, there is assorted code new and old that either @@ -27,6 +28,9 @@ BOARD_PROFILES["amd64-usr"]="coreos:coreos/amd64/generic" BOARD_CHOSTS["arm64-usr"]="aarch64-cros-linux-gnu" BOARD_PROFILES["arm64-usr"]="coreos:coreos/arm64/generic" +BOARD_CHOSTS["riscv-usr"]="riscv64-cros-linux-gnu" +BOARD_PROFILES["riscv-usr"]="coreos:coreos/riscv/generic" + BOARD_NAMES=( "${!BOARD_CHOSTS[@]}" ) # Declare the above globals as read-only to avoid accidental conflicts. @@ -57,6 +61,7 @@ get_portage_arch() { s390*) echo s390;; sh*) echo sh;; x86_64*) echo amd64;; + riscv*) echo riscv;; *) die "Unknown CHOST '$1'";; esac } @@ -79,6 +84,7 @@ get_kernel_arch() { s390*) echo s390;; sh*) echo sh;; x86_64*) echo x86;; + riscv*) echo riscv;; *) die "Unknown CHOST '$1'";; esac } @@ -488,6 +494,12 @@ install_cross_rust() { [ ! -d /usr/lib/rustlib/aarch64-unknown-linux-gnu ] && ("${sudo[@]}" emerge --unmerge dev-lang/rust || true) "${sudo[@]}" emerge "${emerge_flags[@]}" dev-lang/rust fi + if [ "${cbuild}" = "x86_64-pc-linux-gnu" ] && [ "${cross_chost}" = "riscv64-cros-linux-gnu" ]; then + echo "Building Rust for riscv64" + # If no aarch64 folder exists, try to remove any existing Rust packages. + [ ! -d /usr/lib/rustlib/riscv64-unknown-linux-gnu ] && ("${sudo[@]}" emerge --unmerge dev-lang/rust || true) + "${sudo[@]}" emerge "${emerge_flags[@]}" dev-lang/rust + fi } # Update to the latest binutils profile for a given CHOST if required diff --git a/common.sh b/common.sh index 3dbb8040dc3..2968c5c9d96 100644 --- a/common.sh +++ b/common.sh @@ -1009,6 +1009,15 @@ setup_qemu_static() { die "Missing basic layout in target rootfs" fi ;; + riscv-usr) + if [[ -f "${root_fs_dir}/sbin/ldconfig" ]]; then + sudo cp /usr/bin/qemu-riscv64 "${root_fs_dir}"/usr/bin/qemu-riscv64-static + echo export QEMU_LD_PREFIX=\"/build/risc-usr/\" | sudo tee /etc/profile.d/qemu-riscv64.sh + . /etc/profile.d/qemu-riscv64.sh + else + die "Missing basic layout in target rootfs" + fi + ;; *) die "Unsupported arch" ;; esac } @@ -1024,6 +1033,13 @@ clean_qemu_static() { die "File not found" fi ;; + arm64-usr) + if [[ -f "${root_fs_dir}/usr/bin/qemu-riscv64-static" ]]; then + sudo rm "${root_fs_dir}"/usr/bin/qemu-riscv64-static + else + die "File not found" + fi + ;; *) die "Unsupported arch" ;; esac } diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/README b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/README new file mode 100644 index 00000000000..0e500caef1a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/README @@ -0,0 +1,4 @@ +This profile (and its sub-profiles) should *only* contain +architecture specific settings. Architecture independent settings should +go under coreos/base (applies to everything) or coreos/targets/* +(applies to the sdk, amd64-usr, etc.). diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/dev/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/dev/parent new file mode 100644 index 00000000000..35ac69992e2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/dev/parent @@ -0,0 +1,2 @@ +.. +:coreos/targets/generic/dev diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/make.defaults new file mode 100644 index 00000000000..a7f431d3ca2 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/make.defaults @@ -0,0 +1,2 @@ +CFLAGS="-O2 -pipe -mtune=generic -g" +CXXFLAGS="${CFLAGS}" diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/oem-aci/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/oem-aci/parent new file mode 100644 index 00000000000..cfacbaa8c89 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/oem-aci/parent @@ -0,0 +1,2 @@ +.. +:coreos/targets/generic/oem-aci diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/parent new file mode 100644 index 00000000000..767f0859011 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/parent @@ -0,0 +1,2 @@ +.. +:coreos/targets/generic diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/prod/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/prod/parent new file mode 100644 index 00000000000..89b629a19ea --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/generic/prod/parent @@ -0,0 +1,2 @@ +.. +:coreos/targets/generic/prod diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/make.defaults new file mode 100644 index 00000000000..94b0ffe8f72 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/make.defaults @@ -0,0 +1,2 @@ +# platform "pc" is not supported for target CPU "arm64" +GRUB_PLATFORMS="efi-64" diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.provided new file mode 100644 index 00000000000..5ba4e598ed9 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.provided @@ -0,0 +1 @@ +# arm64 provided diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.use new file mode 100644 index 00000000000..d9c79b5d07c --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/package.use @@ -0,0 +1,4 @@ +# arm64 use + +# Disable gssapi for arm64 to avoid build errors +net-dns/bind-tools -gssapi diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/packages b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/packages new file mode 100644 index 00000000000..511adccb209 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/packages @@ -0,0 +1,3 @@ +# Disable PAX utilities, we don't use grsec kernels +-*sys-apps/paxctl +-*sys-apps/elfix diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/parent new file mode 100644 index 00000000000..e3de8f68979 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/parent @@ -0,0 +1,2 @@ +portage-stable:default/linux/riscv/20.0/rv64gc/lp64d/systemd +:coreos/base diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/make.defaults new file mode 100644 index 00000000000..01f715c2c21 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/make.defaults @@ -0,0 +1,2 @@ +CFLAGS="-O2 -pipe -mtune=generic" +CXXFLAGS="${CFLAGS}" diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/package.use new file mode 100644 index 00000000000..c3e3f1eaed4 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/package.use @@ -0,0 +1,3 @@ +# Don't build the user space emulator for this arch. It's not needed and gets in +# the way when using Catalyst with QEMU. +app-emulation/qemu -qemu_user_targets_aarch64 diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/parent new file mode 100644 index 00000000000..f0c938676d6 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/sdk/parent @@ -0,0 +1,2 @@ +.. +:coreos/targets/sdk diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/use.mask new file mode 100644 index 00000000000..ff5beb9b416 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/riscv/use.mask @@ -0,0 +1 @@ +-ldap diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/make.defaults index 4017242e593..6fd80cde82b 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/make.defaults +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/make.defaults @@ -5,13 +5,13 @@ USE="man -pam" CROS_SDK_HOST="cros-sdk-host" # Enable CPU architectures needed by Rust builds -LLVM_TARGETS="X86 AArch64" +LLVM_TARGETS="X86 AArch64 RISCV" # Both x86_64 and i386 targets are required for grub testing -QEMU_SOFTMMU_TARGETS="x86_64 i386 aarch64" +QEMU_SOFTMMU_TARGETS="x86_64 i386 aarch64 riscv64" # For cross build support. -QEMU_USER_TARGETS="aarch64" +QEMU_USER_TARGETS="aarch64 riscv64" # add cros_host to bootstrapping USE flags so SDK / toolchains bootstrapping # will use vim's vimrc instead of baselayouts', diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use index 82cd27b1a9b..dee4ca391a3 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use @@ -9,7 +9,7 @@ app-crypt/gnupg smartcard usb # for qemu app-arch/bzip2 static-libs -app-emulation/qemu -doc -jpeg ncurses python static-user virtfs qemu_softmmu_targets_x86_64 qemu_softmmu_targets_aarch64 +app-emulation/qemu -doc -jpeg ncurses python static-user virtfs qemu_softmmu_targets_x86_64 qemu_softmmu_targets_aarch64 qemu_softmmu_targets_riscv64 +riscv64 dev-libs/glib static-libs dev-libs/libaio static-libs dev-libs/libpcre2 static-libs diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/profiles.desc b/sdk_container/src/third_party/coreos-overlay/profiles/profiles.desc index 10c522161f2..7a173106466 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/profiles.desc +++ b/sdk_container/src/third_party/coreos-overlay/profiles/profiles.desc @@ -7,3 +7,8 @@ arm64 coreos/arm64/generic dev arm64 coreos/arm64/generic/dev dev arm64 coreos/arm64/generic/prod dev arm64 coreos/arm64/sdk dev + +riscv coreos/riscv/generic dev +riscv coreos/riscv/generic/dev dev +riscv coreos/riscv/generic/prod dev +riscv coreos/riscv/sdk dev diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.5.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.5.ebuild index 05d55122f85..51e9be1d66d 100644 --- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.5.ebuild +++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.5.ebuild @@ -60,7 +60,7 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG} ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux +slirp - smartcard snappy spice ssh static-user systemtap test udev usb + smartcard snappy spice ssh +static-user systemtap test udev usb usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen zstd"