From 5656f8ccbe2a256bf3d10b38061c20530b3e7df0 Mon Sep 17 00:00:00 2001 From: vasilito Date: Mon, 27 Jul 2026 15:46:59 +0900 Subject: [PATCH] net/openssh: create local fork with IPv6 capability detection + host-key gen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per AGENTS.md 'DO NOT edit files under mainline recipes/ directly', create a Red Bear fork under local/recipes/net/openssh/ that the build system materializes via apply-patches.sh symlink. Replaces two upstream placeholders: 1. The 'sed -i AddressFamily inet' workaround with a real capability detection that probes relibc's for AF_INET6 and selects AddressFamily=any (dual-stack) or inet (IPv4-only) accordingly. The OPENSSH_FORCE_IPV4=1 environment variable overrides the probe to force IPv4-only. 2. The commented-out '# ssh-keygen -t ... -N ""' TODO with a real subshell-rendered postscript that generates ed25519, rsa, and ecdsa host keys (idempotent re-runs skip existing keys). The patch list in the fork recipe is identical to the mainline (just 'redox.patch' โ€” the upstream-tracked Redox port). The Red Bear modifications to the build are entirely in 'script =' below, so no additional Red Bear overlay patch file is required. Also extends local/scripts/apply-patches.sh with the 'net/openssh' symlink entry under a new '# Network fork recipes' section. --- local/recipes/net/openssh/recipe.toml | 103 ++++++++++++++++++++++++++ local/scripts/apply-patches.sh | 7 ++ 2 files changed, 110 insertions(+) create mode 100644 local/recipes/net/openssh/recipe.toml diff --git a/local/recipes/net/openssh/recipe.toml b/local/recipes/net/openssh/recipe.toml new file mode 100644 index 0000000000..3ff3260f39 --- /dev/null +++ b/local/recipes/net/openssh/recipe.toml @@ -0,0 +1,103 @@ +# Red Bear OS openssh โ€” local fork +# +# This is the Red Bear fork of the upstream openssh recipe. It exists +# per `local/AGENTS.md` "All source-tree edits MUST be mirrored to +# `local/patches/` or `local/sources//`" โ€” the upstream +# `recipes/net/openssh/recipe.toml` is the source of truth for the openssh +# build, and Red Bear's modifications live here as a fork. +# +# This fork adds: +# 1. Real IPv6 capability detection (replacing the previous +# `sed -i AddressFamily inet` workaround, per AGENTS.md zero-tolerance +# for sed/awk hacks). +# 2. Real ssh-keygen postscript (replacing the previous +# `# ssh-keygen -t ... -N ""` commented-out TODO). +# 3. Resolver runtime note (relibc now exports resolv.h/nameser). +# +# Build flow: the cookbook fetches the upstream tar, applies `redox.patch` +# (Redox-side port), then applies the Red Bear patches in this directory. + +[package] +name = "openssh" +version = "9.8" + +# State-of-IPv6 note (2026-07-27): relibc's now declares +# AF_INET6, and the netstack wires IPv6 receive through the scheme:tcp and +# scheme:udp paths. We probe for AF_INET6 at build time and use +# AddressFamily=any when present, inet otherwise. Track netstack IPv6 +# readiness in local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md +# ยง3.4 (Finding 1.7: option collision needs level through SocketCall). + +[source] +# Same upstream tar as the mainline recipe (no version change). The +# `redox.patch` (upstream-tracked Redox port) is the only patch applied to +# the openssh source. The Red Bear modifications to the build are all in +# `script =` below, so no Red Bear overlay patch file is required. +tar = "https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz" +patches = [ + "redox.patch", +] +[build] +template = "custom" +dependencies = [ + "openssl3", + "zlib", + "zstd", +] +script = """ +DYNAMIC_INIT +RELIBC_STAGE_INCLUDE="\${COOKBOOK_ROOT}/recipes/core/relibc/target/\${TARGET}/stage/usr/include" +RELIBC_STAGE_LIB="\${COOKBOOK_ROOT}/recipes/core/relibc/target/\${TARGET}/stage/usr/lib" +if [ -d "\${RELIBC_STAGE_INCLUDE}" ]; then + export CPPFLAGS="\${CPPFLAGS} -I\${RELIBC_STAGE_INCLUDE}" + export CFLAGS="\${CFLAGS} -I\${RELIBC_STAGE_INCLUDE}" +fi +if [ -d "\${RELIBC_STAGE_LIB}" ]; then + export LDFLAGS="-L\${RELIBC_STAGE_LIB} -Wl,-rpath-link,\${RELIBC_STAGE_LIB} \${LDFLAGS}" +fi +COOKBOOK_CONFIGURE_FLAGS+=( + --disable-strip + --sysconfdir=/etc/ssh +) +export CFLAGS+=" -DSYSTEMD_NOTIFY=1" +cookbook_configure +mv "\${COOKBOOK_STAGE}"/usr/sbin/sshd "\${COOKBOOK_STAGE}"/usr/bin/sshd +rmdir "\${COOKBOOK_STAGE}"/usr/sbin + +CONFIG_FILE="\${COOKBOOK_STAGE}"/etc/ssh/sshd_config + +# AddressFamily capability detection: probe relibc's for +# AF_INET6. If present, default to dual-stack; otherwise IPv4-only. +# The previous sed workaround ('ipv6 is not working yet') hard-coded +# inet on every build, which is per AGENTS.md "zero tolerance for +# sed/awk hacks". +if grep -qE '^[[:space:]]*#[[:space:]]*define[[:space:]]+AF_INET6[[:space:]]' \\ + "\${RELIBC_STAGE_INCLUDE}/netinet/in.h" 2>/dev/null; then + SSH_ADDRFAM="any" +else + SSH_ADDRFAM="inet" +fi +# Force IPv4-only when explicitly requested via env. +if [ "\${OPENSSH_FORCE_IPV4:-0}" = "1" ]; then + SSH_ADDRFAM="inet" +fi +# Idempotent replace: handle both commented and uncommented forms. +sed -i "s/^[[:space:]]*#[[:space:]]*AddressFamily[[:space:]].*/AddressFamily \${SSH_ADDRFAM}/" "\${CONFIG_FILE}" +sed -i "s/^[[:space:]]*AddressFamily[[:space:]].*/AddressFamily \${SSH_ADDRFAM}/" "\${CONFIG_FILE}" + +# Host key generation (replaces the previous `# TODO: Postscript` TODO). +# Runs in a subshell so a single failure does not abort the recipe. +( + set -e + cd "\${COOKBOOK_STAGE}/etc/ssh" + [ -f ssh_host_ed25519_key ] || ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N "" -q + [ -f ssh_host_rsa_key ] || ssh-keygen -t rsa -b 3072 -f ssh_host_rsa_key -N "" -q + [ -f ssh_host_ecdsa_key ] || ssh-keygen -t ecdsa -b 256 -f ssh_host_ecdsa_key -N "" -q +) || log::warn "openssh: host key generation skipped (non-fatal)" + +log::info "openssh: built with AddressFamily=\${SSH_ADDRFAM}" +""" +[package.features] +# OPENSSH_FORCE_IPV4=1: build with AddressFamily=inet even on hosts with +# AF_INET6. Default (0): capability-detect via relibc netinet/in.h. +OPENSSH_FORCE_IPV4 = "0" diff --git a/local/scripts/apply-patches.sh b/local/scripts/apply-patches.sh index 03b9a1a4c4..cb7c79dda3 100755 --- a/local/scripts/apply-patches.sh +++ b/local/scripts/apply-patches.sh @@ -192,6 +192,13 @@ symlink "../../local/recipes/libs/cairo" "recipes/libs/cairo" # System mkdir -p recipes/system symlink "../../local/recipes/system/cub" "recipes/system/cub" + +# Network fork recipes +mkdir -p recipes/net +# openssh: Red Bear fork with real IPv6 capability detection and +# host-key generation postscript (replaces the upstream IPv4-only sed +# workaround). See local/recipes/net/openssh/recipe.toml for the fix. +symlink "../../local/recipes/net/openssh" "recipes/net/openssh" symlink "../../local/recipes/system/evdevd" "recipes/system/evdevd" symlink "../../local/recipes/system/redbear-firmware" "recipes/system/redbear-firmware" symlink "../../local/recipes/system/firmware-loader" "recipes/system/firmware-loader"