For 8.3/import openssh 9.9p1 27.el10.alma.1.src.rpm - #16
Open
LucienLassalle wants to merge 4 commits into
Open
Conversation
Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>
LucienLassalle
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
6 times, most recently
from
August 26, 2026 14:16
dfa39e6 to
90a755a
Compare
Contributor
Author
LucienLassalle
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
from
August 27, 2026 11:36
90a755a to
e942b1a
Compare
Contributor
Author
|
Scratch Build: https://koji.xcp-ng.org/taskinfo?taskID=112304 |
rzr
reviewed
Aug 31, 2026
| # XCP-ng ships its own hardened sshd_config/ssh_config in place of the | ||
| # upstream defaults; these fully replace them and are | ||
| # reinstalled on every package upgrade. | ||
| install -m644 %{SOURCE25} $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config |
Contributor
There was a problem hiding this comment.
Since you explicitly renamed the files then I would use the actual filename here instead of macro to make sure we're coping from the original source (to prevent other file to be listed in SOURCE25)
Contributor
Author
There was a problem hiding this comment.
It's your preferences; personally, I prefer having xcpng_sshd_conf, but since you removed it in favor of sshd_conf, I find it less clear.
rzr
reviewed
Aug 31, 2026
rzr
reviewed
Aug 31, 2026
| functions it adds to sshkey.c; unnamed parameters are invalid in a C | ||
| function definition and our build compiler rejects them with | ||
| "parameter name omitted". | ||
| - *** PREVIOUS CHANGELOG *** |
Contributor
There was a problem hiding this comment.
Is there other project using this form ?
Contributor
Author
There was a problem hiding this comment.
I don't know; it was recommended to me by @vxgmichel
Contributor
There was a problem hiding this comment.
ok, What do you think about just adding a line about "Rebase on new upstream and merge previous changes on XS-8.3 base:" listed as nested.
Contributor
Author
There was a problem hiding this comment.
Does that mean we'd lose the history? If so, I'm not very confident
Contributor
There was a problem hiding this comment.
I said adding not replacing (nothing will be lost) ;) just to keep trace of the strategy change
rzr
reviewed
Aug 31, 2026
LucienLassalle
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
from
August 31, 2026 14:38
e942b1a to
c6c6888
Compare
added 2 commits
August 31, 2026 16:43
….alma.1.src.rpm XCP-ng does not have the systemd-rpm-macros package, in order to compensate for this lack, certain macros have been adapted. XCP-ng does not need gtk3 because we disable gnome-askpass. Due to the fact that our gcc is old, our compiler refuses the parameters of a patch, patch 2000 was therefore added to ensure that it works on our platform. Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>
Version 9.9p1-30 does not yet have an src rpm to my knowledge, so I retrieved the fixes from their git, and I also integrated the fixes for CVE-2026-60000 and CVE-2026-60001. But as a result they correct the following CVE: - CVE-2026-59995 - CVE-2026-59999 - CVE-2026-73281 - CVE-2026-73282 - CVE-2026-73283 Knowing that CVE-2026-5996 and CVE-2026-60002 have already been corrected in the previous import. CVE-2026-59998 appears to be a documentation mistake. Only CVE-2026-59997 is not yet corrected, it is deferred on major distros, and as a result it requires highly improbable actions. Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>
p0sql
requested changes
Aug 31, 2026
rzr
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
from
August 31, 2026 15:01
c6c6888 to
796c94f
Compare
LucienLassalle
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
2 times, most recently
from
August 31, 2026 15:42
5e7c5f3 to
3ade70c
Compare
Redhat had their own configuration which could surpass ours, it will no longer be packaged. From now on, we keep maintaing the two configuration files with settings that do not regress to our previous version. Support for post-quantum algorithms is included, and brute-force protection remains enabled by default (hardening). The removal of the MOTD is due to the fact that PAM now handles it, rather than SSH. Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech> Signed-off-by: Philippe Coval <philippe.coval@vates.tech>
LucienLassalle
force-pushed
the
for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm
branch
from
August 31, 2026 16:32
3ade70c to
5e6111c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main information
Work Item Reference
XCPNG-3707
Related changes (optional)
flowchart LR A[OpenSSH] -->|BuildRequires| B[libfido2] --> | BuildRequires | C[libcbor] A[OpenSSH] --> | BuildRequires | D[OpenSSL > 3.5.0] B --> | BuildRequires | D style A fill:#4CAF50,color:#fffThe build order is important:
Context & Motivation
XenServer decided to disable OpenSSH by default, meaning they no longer backport most security patches.
Consequently, to ensure maintainability, the decision was made to use an Alma/CentOS base.
Choosing Alma provides a common base for XCP-ng 9, thereby eliminating the need to maintain two completely different versions.
This version of OpenSSH also introduces several features:
Release Target
I proposed "next+1" to follow OpenSSL.
Release Notes and Documentation
Explain the change to users
Updated to OpenSSH 9.9p1.
Fixed the following minor CVEs:
Support for user configurations in
/etc/ssh/ssh_client.d/Our OpenSSH now supports Post-Quantum Key Exchange!
Our OpenSSH now supports FIDO2 keys!
Additional key algorithms are also available.
Attention points
No breaking changes.
Documentation update needed
We need to explain how to generate a post-quantum key pair and how to use FIDO keys with OpenSSH on XCP-ng. We should also provide configuration advice for OpenSSH.
PR links: xcp-ng-org PR #531
Testing and regression avoidance
What tests have you performed?
Installation on a host, configuration verification, and use of each algorithm, including post-quantum ones.
I tested and it works with:
What manual tests should be performed after the build, and by whom?
In fact, the FIDO support should be rechecked. This test requires FIDO keys (Yubikey/Nitrokey for example)
ssh-keygen -t ed25519-sk -f ~/xcpng_test_openssh_sk_fido -N ""ssh-copy-id -i ~/xcpng_test_openssh_sk_fido root@{host}ssh -i ~/xcpng_test_openssh_sk_fido root@{host}What's covered by the xcp-ng-tests test suite?
Connect via standard SSH and verify an include statement in the configuration.
What tests have been or will be added to CI for this change? If none, explain why.
Verification of each algorithm, use of scp (via sftp and legacy), verification of FIDO support.
XCP-ng-tests PR#684
Xen Orchestra Impact
Does this affect existing features in Xen Orchestra, or add new features that could be useful?