- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Update upgrade instructions for 4.0.0
by Lukas Fleischer 22 May '15

22 May '15

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- upgrading/4.0.0.txt | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/upgrading/4.0.0.txt b/upgrading/4.0.0.txt index b1582f2..023dec0 100644 --- a/upgrading/4.0.0.txt +++ b/upgrading/4.0.0.txt @@ -1,14 +1,18 @@ +WARNING! Following these upgrade instructions will reset all packages! If you +want to keep the package contents, please create a backup before starting the +upgrade process and import the source tarballs into the Git repositories +afterwards. + 1. Add a field for the SSH public key to the Users table: ---- ALTER TABLE Users ADD COLUMN SSHPubKey VARCHAR(4096) NULL DEFAULT NULL; ---- -2. Create a new user and set up a patched version of the sshd as -described in INSTALL. +2. Create a new user and configure the sshd as described in INSTALL. -3. Create a directory for the package base Git repositories and run -init-repos.py to initialize them. +3. Run gen-templates.py to initialize the Git repository template. Create a +directory for the Git repositories and run init-repos.py to initialize them. 4. Reset the packager field of all package bases: -- 2.4.1

1 0

[aur-dev] [PATCH] Make the type parameter of pkgreq_by_pkgbase() optional
by Lukas Fleischer 21 May '15

21 May '15

This simplifies the code a bit, improves maintainability and reduces the number of SQL queries when deleting a package. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgbasefuncs.inc.php | 5 +---- web/lib/pkgreqfuncs.inc.php | 9 ++++++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 3f02bc7..3e4b572 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -513,10 +513,7 @@ function pkgbase_delete ($base_ids, $merge_base_id, $via, $grant=false) { if (!$action) { $username = username_from_sid($_COOKIE['AURSID']); foreach ($base_ids as $base_id) { - $pkgreq_ids = array_merge( - pkgreq_by_pkgbase($base_id, 'deletion'), - pkgreq_by_pkgbase($base_id, 'merge'), - pkgreq_by_pkgbase($base_id, 'orphan')); + $pkgreq_ids = array_merge(pkgreq_by_pkgbase($base_id)); foreach ($pkgreq_ids as $pkgreq_id) { pkgreq_close(intval($pkgreq_id), 'accepted', 'The user ' . $username . diff --git a/web/lib/pkgreqfuncs.inc.php b/web/lib/pkgreqfuncs.inc.php index e4c63b5..c056d68 100644 --- a/web/lib/pkgreqfuncs.inc.php +++ b/web/lib/pkgreqfuncs.inc.php @@ -49,15 +49,18 @@ function pkgreq_list($offset, $limit) { * * @return array List of package request IDs */ -function pkgreq_by_pkgbase($baseid, $type) { +function pkgreq_by_pkgbase($baseid, $type=false) { $dbh = DB::connect(); $q = "SELECT PackageRequests.ID "; $q.= "FROM PackageRequests INNER JOIN RequestTypes ON "; $q.= "RequestTypes.ID = PackageRequests.ReqTypeID "; $q.= "WHERE PackageRequests.Status = 0 "; - $q.= "AND PackageRequests.PackageBaseID = " . intval($baseid) . " "; - $q.= "AND RequestTypes.Name = " . $dbh->quote($type); + $q.= "AND PackageRequests.PackageBaseID = " . intval($baseid); + + if ($type) { + $q .= " AND RequestTypes.Name = " . $dbh->quote($type); + } return $dbh->query($q)->fetchAll(PDO::FETCH_COLUMN, 0); } -- 2.4.1

1 0

[aur-dev] aur-dev no longer uses port 2222 for SSH
by Lukas Fleischer 21 May '15

21 May '15

Hi, If you are using the AUR 4.0.0 testing environment on aur-dev.archlinux.org, please note that we now use the default SSH port 22 instead of 2222. This means that you can drop the ":2222" part from your Git remote URIs or remove the "Port 2222" line from your local SSH configuration. We are currently preparing the migration to AUR 4.0.0 and we are going to inform all AUR users about the transition in a couple of days. Regards, Lukas

2 1

[aur-dev] [PATCH] Change default configuration to use SSH port 22
by Lukas Fleischer 21 May '15

21 May '15

We no longer run a separate SSH daemon on port 2222. Change the default configuration accordingly. Also remove some configuration files that are no longer needed. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- conf/aur-sshd.socket | 6 ------ conf/aur-sshd@.service | 8 -------- conf/cgitrc.proto | 2 +- conf/config.proto | 2 +- scripts/git-integration/sshd_config | 6 ------ 5 files changed, 2 insertions(+), 22 deletions(-) delete mode 100644 conf/aur-sshd.socket delete mode 100644 conf/aur-sshd@.service delete mode 100644 scripts/git-integration/sshd_config diff --git a/conf/aur-sshd.socket b/conf/aur-sshd.socket deleted file mode 100644 index 5b0c3df..0000000 --- a/conf/aur-sshd.socket +++ /dev/null @@ -1,6 +0,0 @@ -[Socket] -ListenStream=2222 -Accept=yes - -[Install] -WantedBy=sockets.target diff --git a/conf/aur-sshd@.service b/conf/aur-sshd@.service deleted file mode 100644 index 5ec410a..0000000 --- a/conf/aur-sshd@.service +++ /dev/null @@ -1,8 +0,0 @@ -[Unit] -Description=AUR OpenSSH Per-Connection Daemon - -[Service] -ExecStart=-/srv/http/aurweb/openssh/sshd -i -f /srv/http/aurweb/.ssh/sshd_config -User=aur -StandardInput=socket -StandardError=syslog diff --git a/conf/cgitrc.proto b/conf/cgitrc.proto index 86b410b..d9bde83 100644 --- a/conf/cgitrc.proto +++ b/conf/cgitrc.proto @@ -1,5 +1,5 @@ virtual-root=/cgit/ -clone-prefix=git+ssh://aur@aur.archlinux.org:2222 +clone-prefix=git+ssh://aur@aur.archlinux.org noheader=0 logo= css=/css/cgit.css diff --git a/conf/config.proto b/conf/config.proto index 99ab602..623d044 100644 --- a/conf/config.proto +++ b/conf/config.proto @@ -20,7 +20,7 @@ disable_http_login = 1 aur_location = https://aur.archlinux.org cgit_uri = https://aur.archlinux.org/cgit/ git_clone_uri_anon = https://aur.archlinux.org/cgit/%s.git/ -git_clone_uri_priv = ssh+git://aur@aur.archlinux.org:2222/%s.git/ +git_clone_uri_priv = ssh+git://aur@aur.archlinux.org/%s.git/ max_rpc_results = 5000 aur_request_ml = aur-requests(a)archlinux.org request_idle_time = 1209600 diff --git a/scripts/git-integration/sshd_config b/scripts/git-integration/sshd_config deleted file mode 100644 index d3d2f5a..0000000 --- a/scripts/git-integration/sshd_config +++ /dev/null @@ -1,6 +0,0 @@ -Port 2222 -HostKey ~/.ssh/ssh_host_rsa_key -PasswordAuthentication no -UsePrivilegeSeparation no -AuthorizedKeysCommand /srv/http/aurweb/scripts/git-integration/git-auth.py "%t" "%k" -AuthorizedKeysCommandUser aur -- 2.4.1

1 0

[aur-dev] [PATCH] Remove the OpenSSH patch
by Lukas Fleischer 21 May '15

21 May '15

Extended AuthorizedKeysCommand parameters are now officially supported by OpenSSH. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- INSTALL | 41 +- .../0001-Patch-sshd-for-the-AUR.patch | 1094 -------------------- 2 files changed, 15 insertions(+), 1120 deletions(-) delete mode 100644 scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch diff --git a/INSTALL b/INSTALL index 34e1a00..2a67f9b 100644 --- a/INSTALL +++ b/INSTALL @@ -17,39 +17,28 @@ Setup on Arch Linux 4) Create a new MySQL database and a user and import the AUR SQL schema: - $ mysql -uaur -p AUR </srv/http/aurweb/schema/aur-schema.sql + $ mysql -uaur -p AUR </srv/http/aurweb/schema/aur-schema.sql 5) Generate templates for new Git repositories: - $ /srv/http/aurweb/scripts/git-integration/gen-templates.py + $ /srv/http/aurweb/scripts/git-integration/gen-templates.py -6) Clone the OpenSSH project, apply the aurweb sshd patch and run `make`: +6) Create a new user: - $ cd /srv/http/aurweb/ - $ git clone git://anongit.mindrot.org/openssh.git - $ cd openssh - $ git checkout V_6_8_P1 - $ git am ../scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch - $ autoreconf - $ ./configure - $ make + # useradd -U -d /srv/http/aurweb -c 'AUR user' aur -7) Create and edit the sshd configuration: +7) Install the git-auth wrapper script: - $ cd /srv/http/aurweb/ - $ umask 077 - $ mkdir .ssh/ - $ ssh-keygen -f .ssh/ssh_host_rsa_key -N '' -t rsa - $ cp scripts/git-integration/sshd_config .ssh/ + # cd /srv/http/aurweb/scripts/git-integration/ + # cp git-auth.sh /usr/local/bin/aur-git-auth + # chmod 755 /usr/local/bin/aur-git-auth -8) Create a new user and change ownership of the .ssh directory: +8) Configure sshd(8) for the AUR. Add the following lines at the end of your + sshd_config(5) and restart the sshd. Note that OpenSSH 6.9 or newer is + needed! - # useradd -U -d /srv/http/aurweb -c 'AUR user' aur - # chown aur:aur /srv/http/aurweb/.ssh/ + Match User aur + PasswordAuthentication no + AuthorizedKeysCommand /usr/local/bin/aur-git-auth "%t" "%k" + AuthorizedKeysCommandUser aur -9) Add, enable and start systemd unit files for the new sshd: - - # cp /srv/http/aurweb/conf/aur-sshd.socket /etc/systemd/system/ - # cp /srv/http/aurweb/conf/aur-sshd@.service /etc/systemd/system/ - # systemctl enable aur-sshd.socket - # systemctl start aur-sshd.socket diff --git a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch b/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch deleted file mode 100644 index 688b115..0000000 --- a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch +++ /dev/null @@ -1,1094 +0,0 @@ -From 6423ae83d38535687d52097b7854b3c81151fe34 Mon Sep 17 00:00:00 2001 -From: Lukas Fleischer <lfleischer(a)archlinux.org> -Date: Sat, 11 Apr 2015 12:57:46 +0200 -Subject: [PATCH] Patch sshd for the AUR - -* Apply the latest version of Damien Miller's patch to extend the - parameters to the AuthorizedKeysCommand. - -* Remove the secure path check for the AuthorizedKeysCommand. We are - running the sshd under a non-privileged user who has as little - permissions as possible. In particular, he does not own the directory - that contains the scripts for the Git backend. - -* Prevent from running the sshd as root. - -Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> ---- - auth2-pubkey.c | 530 +++++++++++++++++++++++++++++++++++++++++++-------------- - servconf.c | 35 ++++ - servconf.h | 8 +- - ssh.c | 5 + - sshd.c | 5 + - sshd_config.5 | 54 +++++- - sshkey.c | 172 +++++++++++-------- - sshkey.h | 1 + - 8 files changed, 606 insertions(+), 204 deletions(-) - -diff --git a/auth2-pubkey.c b/auth2-pubkey.c -index d943efa..2ce0a4b 100644 ---- a/auth2-pubkey.c -+++ b/auth2-pubkey.c -@@ -65,6 +65,9 @@ - #include "monitor_wrap.h" - #include "authfile.h" - #include "match.h" -+#include "ssherr.h" -+#include "channels.h" /* XXX for session.h */ -+#include "session.h" /* XXX for child_set_env(); refactor? */ - - /* import */ - extern ServerOptions options; -@@ -248,6 +251,227 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...) - free(extra); - } - -+/* -+ * Splits 's' into an argument vector. Handles quoted string and basic -+ * escape characters (\\, \", \'). Caller must free the argument vector -+ * and its members. -+ */ -+static int -+split_argv(const char *s, int *argcp, char ***argvp) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; -+ int argc = 0, quote, i, j; -+ char *arg, **argv = xcalloc(1, sizeof(*argv)); -+ -+ *argvp = NULL; -+ *argcp = 0; -+ -+ for (i = 0; s[i] != '\0'; i++) { -+ /* Skip leading whitespace */ -+ if (s[i] == ' ' || s[i] == '\t') -+ continue; -+ -+ /* Start of a token */ -+ quote = 0; -+ if (s[i] == '\\' && -+ (s[i + 1] == '\'' || s[i + 1] == '\"' || s[i + 1] == '\\')) -+ i++; -+ else if (s[i] == '\'' || s[i] == '"') -+ quote = s[i++]; -+ -+ argv = xrealloc(argv, (argc + 2), sizeof(*argv)); -+ arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1); -+ argv[argc] = NULL; -+ -+ /* Copy the token in, removing escapes */ -+ for (j = 0; s[i] != '\0'; i++) { -+ if (s[i] == '\\') { -+ if (s[i + 1] == '\'' || -+ s[i + 1] == '\"' || -+ s[i + 1] == '\\') { -+ i++; /* Skip '\' */ -+ arg[j++] = s[i]; -+ } else { -+ /* Unrecognised escape */ -+ arg[j++] = s[i]; -+ } -+ } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t')) -+ break; /* done */ -+ else if (quote != 0 && s[i] == quote) -+ break; /* done */ -+ else -+ arg[j++] = s[i]; -+ } -+ if (s[i] == '\0') { -+ if (quote != 0) { -+ /* Ran out of string looking for close quote */ -+ r = SSH_ERR_INVALID_FORMAT; -+ goto out; -+ } -+ break; -+ } -+ } -+ /* Success */ -+ *argcp = argc; -+ *argvp = argv; -+ argc = 0; -+ argv = NULL; -+ r = 0; -+ out: -+ if (argc != 0 && argv != NULL) { -+ for (i = 0; i < argc; i++) -+ free(argv[i]); -+ free(argv); -+ } -+ return r; -+} -+ -+/* -+ * Runs command in a subprocess. Returns pid on success and a FILE* to the -+ * subprocess' stdout or 0 on failure. -+ * NB. "command" is only used for logging. -+ */ -+static pid_t -+subprocess(const char *tag, struct passwd *pw, const char *command, -+ int ac, char **av, FILE **child) -+{ -+ FILE *f; -+ struct stat st; -+ int devnull, p[2], i; -+ pid_t pid; -+ char *cp, errmsg[512]; -+ u_int envsize; -+ char **child_env; -+ -+ *child = NULL; -+ -+ debug3("%s: %s command \"%s\" running as %s", __func__, -+ tag, command, pw->pw_name); -+ -+ /* Verify the path exists and is safe-ish to execute */ -+ if (*av[0] != '/') { -+ error("%s path is not absolute", tag); -+ return 0; -+ } -+ temporarily_use_uid(pw); -+ if (stat(av[0], &st) < 0) { -+ error("Could not stat %s \"%s\": %s", tag, -+ av[0], strerror(errno)); -+ restore_uid(); -+ return 0; -+ } -+ -+ /* -+ * Run the command; stderr is left in place, stdout is the -+ * authorized_keys output. -+ */ -+ if (pipe(p) != 0) { -+ error("%s: pipe: %s", tag, strerror(errno)); -+ restore_uid(); -+ return 0; -+ } -+ -+ /* -+ * Don't want to call this in the child, where it can fatal() and -+ * run cleanup_exit() code. -+ */ -+ restore_uid(); -+ -+ switch ((pid = fork())) { -+ case -1: /* error */ -+ error("%s: fork: %s", tag, strerror(errno)); -+ close(p[0]); -+ close(p[1]); -+ return 0; -+ case 0: /* child */ -+ /* Prepare a minimal environment for the child. */ -+ envsize = 5; -+ child_env = xcalloc(sizeof(*child_env), envsize); -+ child_set_env(&child_env, &envsize, "PATH", _PATH_STDPATH); -+ child_set_env(&child_env, &envsize, "USER", pw->pw_name); -+ child_set_env(&child_env, &envsize, "LOGNAME", pw->pw_name); -+ child_set_env(&child_env, &envsize, "HOME", pw->pw_dir); -+ if ((cp = getenv("LANG")) != NULL) -+ child_set_env(&child_env, &envsize, "LANG", cp); -+ -+ for (i = 0; i < NSIG; i++) -+ signal(i, SIG_DFL); -+ -+ if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { -+ error("%s: open %s: %s", tag, _PATH_DEVNULL, -+ strerror(errno)); -+ _exit(1); -+ } -+ /* Keep stderr around a while longer to catch errors */ -+ if (dup2(devnull, STDIN_FILENO) == -1 || -+ dup2(p[1], STDOUT_FILENO) == -1) { -+ error("%s: dup2: %s", tag, strerror(errno)); -+ _exit(1); -+ } -+ closefrom(STDERR_FILENO + 1); -+ -+ /* Don't use permanently_set_uid() here to avoid fatal() */ -+ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { -+ error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid, -+ strerror(errno)); -+ _exit(1); -+ } -+ if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { -+ error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid, -+ strerror(errno)); -+ _exit(1); -+ } -+ /* stdin is pointed to /dev/null at this point */ -+ if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { -+ error("%s: dup2: %s", tag, strerror(errno)); -+ _exit(1); -+ } -+ -+ execve(av[0], av, child_env); -+ error("%s exec \"%s\": %s", tag, command, strerror(errno)); -+ _exit(127); -+ default: /* parent */ -+ break; -+ } -+ -+ close(p[1]); -+ if ((f = fdopen(p[0], "r")) == NULL) { -+ error("%s: fdopen: %s", tag, strerror(errno)); -+ close(p[0]); -+ /* Don't leave zombie child */ -+ kill(pid, SIGTERM); -+ while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) -+ ; -+ return 0; -+ } -+ /* Success */ -+ debug3("%s: %s pid %ld", __func__, tag, (long)pid); -+ *child = f; -+ return pid; -+} -+ -+/* Returns 0 if pid exited cleanly, non-zero otherwise */ -+static int -+exited_cleanly(pid_t pid, const char *tag, const char *cmd) -+{ -+ int status; -+ -+ while (waitpid(pid, &status, 0) == -1) { -+ if (errno != EINTR) { -+ error("%s: waitpid: %s", tag, strerror(errno)); -+ return -1; -+ } -+ } -+ if (WIFSIGNALED(status)) { -+ error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status)); -+ return -1; -+ } else if (WEXITSTATUS(status) != 0) { -+ error("%s %s failed, status %d", tag, cmd, WEXITSTATUS(status)); -+ return -1; -+ } -+ return 0; -+} -+ - static int - match_principals_option(const char *principal_list, struct sshkey_cert *cert) - { -@@ -269,19 +493,13 @@ match_principals_option(const char *principal_list, struct sshkey_cert *cert) - } - - static int --match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) -+process_principals(FILE *f, char *file, struct passwd *pw, -+ struct sshkey_cert *cert) - { -- FILE *f; - char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts; - u_long linenum = 0; - u_int i; - -- temporarily_use_uid(pw); -- debug("trying authorized principals file %s", file); -- if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { -- restore_uid(); -- return 0; -- } - while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { - /* Skip leading whitespace. */ - for (cp = line; *cp == ' ' || *cp == '\t'; cp++) -@@ -309,24 +527,119 @@ match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) - } - for (i = 0; i < cert->nprincipals; i++) { - if (strcmp(cp, cert->principals[i]) == 0) { -- debug3("matched principal \"%.100s\" " -- "from file \"%s\" on line %lu", -- cert->principals[i], file, linenum); -+ debug3("%s:%lu: matched principal \"%.100s\"", -+ file == NULL ? "(command)" : file, -+ linenum, cert->principals[i]); - if (auth_parse_options(pw, line_opts, - file, linenum) != 1) - continue; -- fclose(f); -- restore_uid(); - return 1; - } - } - } -+ return 0; -+} -+ -+static int -+match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) -+{ -+ FILE *f; -+ int success; -+ -+ temporarily_use_uid(pw); -+ debug("trying authorized principals file %s", file); -+ if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { -+ restore_uid(); -+ return 0; -+ } -+ success = process_principals(f, file, pw, cert); - fclose(f); - restore_uid(); -- return 0; -+ return success; - } - - /* -+ * Checks whether principal is allowed in output of command. -+ * returns 1 if the principal is allowed or 0 otherwise. -+ */ -+static int -+match_principals_command(struct passwd *user_pw, struct sshkey *key) -+{ -+ FILE *f = NULL; -+ int ok, found_principal = 0; -+ struct passwd *pw; -+ int i, ac = 0, uid_swapped = 0; -+ pid_t pid; -+ char *username = NULL, *command = NULL, **av = NULL; -+ void (*osigchld)(int); -+ -+ if (options.authorized_principals_command == NULL) -+ return 0; -+ if (options.authorized_principals_command_user == NULL) { -+ error("No user for AuthorizedPrincipalsCommand specified, " -+ "skipping"); -+ return 0; -+ } -+ -+ /* -+ * NB. all returns later this function should go via "out" to -+ * ensure the original SIGCHLD handler is restored properly. -+ */ -+ osigchld = signal(SIGCHLD, SIG_DFL); -+ -+ /* Prepare and verify the user for the command */ -+ username = percent_expand(options.authorized_principals_command_user, -+ "u", user_pw->pw_name, (char *)NULL); -+ pw = getpwnam(username); -+ if (pw == NULL) { -+ error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s", -+ username, strerror(errno)); -+ goto out; -+ } -+ -+ command = percent_expand(options.authorized_principals_command, -+ "u", user_pw->pw_name, "h", user_pw->pw_dir, (char *)NULL); -+ -+ /* Turn the command into an argument vector */ -+ if (split_argv(command, &ac, &av) != 0) { -+ error("AuthorizedPrincipalsCommand \"%s\" contains " -+ "invalid quotes", command); -+ goto out; -+ } -+ if (ac == 0) { -+ error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments", -+ command); -+ goto out; -+ } -+ -+ if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command, -+ ac, av, &f)) == 0) -+ goto out; -+ -+ uid_swapped = 1; -+ temporarily_use_uid(pw); -+ -+ ok = process_principals(f, NULL, pw, key->cert); -+ -+ if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command)) -+ goto out; -+ -+ /* Read completed successfully */ -+ found_principal = ok; -+ out: -+ if (f != NULL) -+ fclose(f); -+ signal(SIGCHLD, osigchld); -+ for (i = 0; i < ac; i++) -+ free(av[i]); -+ free(av); -+ if (uid_swapped) -+ restore_uid(); -+ free(command); -+ free(username); -+ return found_principal; -+} -+/* - * Checks whether key is allowed in authorized_keys-format file, - * returns 1 if the key is allowed or 0 otherwise. - */ -@@ -448,7 +761,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) - { - char *ca_fp, *principals_file = NULL; - const char *reason; -- int ret = 0; -+ int ret = 0, found_principal = 0; - - if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL) - return 0; -@@ -470,14 +783,20 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) - * against the username. - */ - if ((principals_file = authorized_principals_file(pw)) != NULL) { -- if (!match_principals_file(principals_file, pw, key->cert)) { -- reason = "Certificate does not contain an " -- "authorized principal"; -+ if (match_principals_file(principals_file, pw, key->cert)) -+ found_principal = 1; -+ } -+ /* Try querying command if specified */ -+ if (!found_principal && match_principals_command(pw, key)) -+ found_principal = 1; -+ /* If principals file or command specify, then require a match here */ -+ if (!found_principal && (principals_file != NULL || -+ options.authorized_principals_command != NULL)) { -+ reason = "Certificate does not contain an authorized principal"; - fail_reason: -- error("%s", reason); -- auth_debug_add("%s", reason); -- goto out; -- } -+ error("%s", reason); -+ auth_debug_add("%s", reason); -+ goto out; - } - if (key_cert_check_authority(key, 0, 1, - principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) -@@ -526,144 +845,105 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) - static int - user_key_command_allowed2(struct passwd *user_pw, Key *key) - { -- FILE *f; -- int ok, found_key = 0; -+ FILE *f = NULL; -+ int r, ok, found_key = 0; - struct passwd *pw; -- struct stat st; -- int status, devnull, p[2], i; -+ int i, uid_swapped = 0, ac = 0; - pid_t pid; -- char *username, errmsg[512]; -+ char *username = NULL, *key_fp = NULL, *keytext = NULL; -+ char *command = NULL, **av = NULL; -+ void (*osigchld)(int); - -- if (options.authorized_keys_command == NULL || -- options.authorized_keys_command[0] != '/') -+ if (options.authorized_keys_command == NULL) - return 0; -- - if (options.authorized_keys_command_user == NULL) { - error("No user for AuthorizedKeysCommand specified, skipping"); - return 0; - } - -+ /* -+ * NB. all returns later this function should go via "out" to -+ * ensure the original SIGCHLD handler is restored properly. -+ */ -+ osigchld = signal(SIGCHLD, SIG_DFL); -+ -+ /* Prepare and verify the user for the command */ - username = percent_expand(options.authorized_keys_command_user, - "u", user_pw->pw_name, (char *)NULL); - pw = getpwnam(username); - if (pw == NULL) { - error("AuthorizedKeysCommandUser \"%s\" not found: %s", - username, strerror(errno)); -- free(username); -- return 0; -+ goto out; - } -- free(username); -- -- temporarily_use_uid(pw); - -- if (stat(options.authorized_keys_command, &st) < 0) { -- error("Could not stat AuthorizedKeysCommand \"%s\": %s", -- options.authorized_keys_command, strerror(errno)); -+ /* Prepare AuthorizedKeysCommand */ -+ if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash, -+ SSH_FP_DEFAULT)) == NULL) { -+ error("%s: sshkey_fingerprint failed", __func__); - goto out; - } -- if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0, -- errmsg, sizeof(errmsg)) != 0) { -- error("Unsafe AuthorizedKeysCommand: %s", errmsg); -+ if ((r = sshkey_to_base64(key, &keytext)) != 0) { -+ error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r)); - goto out; - } -- -- if (pipe(p) != 0) { -- error("%s: pipe: %s", __func__, strerror(errno)); -+ command = percent_expand(options.authorized_keys_command, -+ "u", user_pw->pw_name, "h", user_pw->pw_dir, -+ "t", sshkey_ssh_name(key), "f", key_fp, "k", keytext, (char *)NULL); -+ -+ /* Turn the command into an argument vector */ -+ if (split_argv(command, &ac, &av) != 0) { -+ error("AuthorizedKeysCommand \"%s\" contains invalid quotes", -+ command); -+ goto out; -+ } -+ if (ac == 0) { -+ error("AuthorizedKeysCommand \"%s\" yielded no arguments", -+ command); - goto out; - } -- -- debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"", -- options.authorized_keys_command, user_pw->pw_name, pw->pw_name); - - /* -- * Don't want to call this in the child, where it can fatal() and -- * run cleanup_exit() code. -+ * If AuthorizedKeysCommand was run without arguments -+ * then fall back to the old behaviour of passing the -+ * target username as a single argument. - */ -- restore_uid(); -- -- switch ((pid = fork())) { -- case -1: /* error */ -- error("%s: fork: %s", __func__, strerror(errno)); -- close(p[0]); -- close(p[1]); -- return 0; -- case 0: /* child */ -- for (i = 0; i < NSIG; i++) -- signal(i, SIG_DFL); -- -- if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { -- error("%s: open %s: %s", __func__, _PATH_DEVNULL, -- strerror(errno)); -- _exit(1); -- } -- /* Keep stderr around a while longer to catch errors */ -- if (dup2(devnull, STDIN_FILENO) == -1 || -- dup2(p[1], STDOUT_FILENO) == -1) { -- error("%s: dup2: %s", __func__, strerror(errno)); -- _exit(1); -- } -- closefrom(STDERR_FILENO + 1); -- -- /* Don't use permanently_set_uid() here to avoid fatal() */ -- if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { -- error("setresgid %u: %s", (u_int)pw->pw_gid, -- strerror(errno)); -- _exit(1); -- } -- if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { -- error("setresuid %u: %s", (u_int)pw->pw_uid, -- strerror(errno)); -- _exit(1); -- } -- /* stdin is pointed to /dev/null at this point */ -- if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { -- error("%s: dup2: %s", __func__, strerror(errno)); -- _exit(1); -- } -- -- execl(options.authorized_keys_command, -- options.authorized_keys_command, user_pw->pw_name, NULL); -- -- error("AuthorizedKeysCommand %s exec failed: %s", -- options.authorized_keys_command, strerror(errno)); -- _exit(127); -- default: /* parent */ -- break; -+ if (ac == 1) { -+ av = xrealloc(av, ac + 2, sizeof(*av)); -+ av[1] = xstrdup(user_pw->pw_name); -+ av[2] = NULL; -+ /* Fix up command too, since it is used in log messages */ -+ free(command); -+ xasprintf(&command, "%s %s", av[0], av[1]); - } - -+ if ((pid = subprocess("AuthorizedKeysCommand", pw, command, -+ ac, av, &f)) == 0) -+ goto out; -+ -+ uid_swapped = 1; - temporarily_use_uid(pw); - -- close(p[1]); -- if ((f = fdopen(p[0], "r")) == NULL) { -- error("%s: fdopen: %s", __func__, strerror(errno)); -- close(p[0]); -- /* Don't leave zombie child */ -- kill(pid, SIGTERM); -- while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) -- ; -- goto out; -- } - ok = check_authkeys_file(f, options.authorized_keys_command, key, pw); -- fclose(f); - -- while (waitpid(pid, &status, 0) == -1) { -- if (errno != EINTR) { -- error("%s: waitpid: %s", __func__, strerror(errno)); -- goto out; -- } -- } -- if (WIFSIGNALED(status)) { -- error("AuthorizedKeysCommand %s exited on signal %d", -- options.authorized_keys_command, WTERMSIG(status)); -+ if (exited_cleanly(pid, "AuthorizedKeysCommand", command)) - goto out; -- } else if (WEXITSTATUS(status) != 0) { -- error("AuthorizedKeysCommand %s returned status %d", -- options.authorized_keys_command, WEXITSTATUS(status)); -- goto out; -- } -+ -+ /* Read completed successfully */ - found_key = ok; - out: -- restore_uid(); -+ if (f != NULL) -+ fclose(f); -+ signal(SIGCHLD, osigchld); -+ for (i = 0; i < ac; i++) -+ free(av[i]); -+ free(av); -+ if (uid_swapped) -+ restore_uid(); -+ free(command); -+ free(username); -+ free(key_fp); -+ free(keytext); - return found_key; - } - -diff --git a/servconf.c b/servconf.c -index 3185462..510cdde 100644 ---- a/servconf.c -+++ b/servconf.c -@@ -159,6 +159,8 @@ initialize_server_options(ServerOptions *options) - options->revoked_keys_file = NULL; - options->trusted_user_ca_keys = NULL; - options->authorized_principals_file = NULL; -+ options->authorized_principals_command = NULL; -+ options->authorized_principals_command_user = NULL; - options->ip_qos_interactive = -1; - options->ip_qos_bulk = -1; - options->version_addendum = NULL; -@@ -396,6 +398,7 @@ typedef enum { - sUsePrivilegeSeparation, sAllowAgentForwarding, - sHostCertificate, - sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, -+ sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser, - sKexAlgorithms, sIPQoS, sVersionAddendum, - sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, - sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, -@@ -528,6 +531,8 @@ static struct { - { "ipqos", sIPQoS, SSHCFG_ALL }, - { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, - { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, -+ { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL }, -+ { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL }, - { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, - { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, - { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL }, -@@ -1697,6 +1702,34 @@ process_server_config_line(ServerOptions *options, char *line, - *charptr = xstrdup(arg); - break; - -+ case sAuthorizedPrincipalsCommand: -+ if (cp == NULL) -+ fatal("%.200s line %d: Missing argument.", filename, -+ linenum); -+ len = strspn(cp, WHITESPACE); -+ if (*activep && -+ options->authorized_principals_command == NULL) { -+ if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0) -+ fatal("%.200s line %d: " -+ "AuthorizedPrincipalsCommand must be " -+ "an absolute path", filename, linenum); -+ options->authorized_principals_command = -+ xstrdup(cp + len); -+ } -+ return 0; -+ -+ case sAuthorizedPrincipalsCommandUser: -+ charptr = &options->authorized_principals_command_user; -+ -+ arg = strdelim(&cp); -+ if (!arg || *arg == '\0') -+ fatal("%s line %d: missing " -+ "AuthorizedPrincipalsCommandUser argument.", -+ filename, linenum); -+ if (*activep && *charptr == NULL) -+ *charptr = xstrdup(arg); -+ break; -+ - case sAuthenticationMethods: - if (*activep && options->num_auth_methods == 0) { - while ((arg = strdelim(&cp)) && *arg != '\0') { -@@ -2166,6 +2199,8 @@ dump_config(ServerOptions *o) - dump_cfg_string(sVersionAddendum, o->version_addendum); - dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command); - dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user); -+ dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command); -+ dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user); - dump_cfg_string(sHostKeyAgent, o->host_key_agent); - dump_cfg_string(sKexAlgorithms, - o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX); -diff --git a/servconf.h b/servconf.h -index 9922f0c..35d6673 100644 ---- a/servconf.h -+++ b/servconf.h -@@ -176,9 +176,11 @@ typedef struct { - char *chroot_directory; - char *revoked_keys_file; - char *trusted_user_ca_keys; -- char *authorized_principals_file; - char *authorized_keys_command; - char *authorized_keys_command_user; -+ char *authorized_principals_file; -+ char *authorized_principals_command; -+ char *authorized_principals_command_user; - - int64_t rekey_limit; - int rekey_interval; -@@ -214,9 +216,11 @@ struct connection_info { - M_CP_STROPT(banner); \ - M_CP_STROPT(trusted_user_ca_keys); \ - M_CP_STROPT(revoked_keys_file); \ -- M_CP_STROPT(authorized_principals_file); \ - M_CP_STROPT(authorized_keys_command); \ - M_CP_STROPT(authorized_keys_command_user); \ -+ M_CP_STROPT(authorized_principals_file); \ -+ M_CP_STROPT(authorized_principals_command); \ -+ M_CP_STROPT(authorized_principals_command_user); \ - M_CP_STROPT(hostbased_key_types); \ - M_CP_STROPT(pubkey_key_types); \ - M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ -diff --git a/ssh.c b/ssh.c -index 0ad82f0..abf4e54 100644 ---- a/ssh.c -+++ b/ssh.c -@@ -548,6 +548,11 @@ main(int ac, char **av) - original_real_uid = getuid(); - original_effective_uid = geteuid(); - -+ if (original_effective_uid == 0) { -+ fprintf(stderr, "this is a patched version of the sshd that must not be run as root.\n"); -+ exit(1); -+ } -+ - /* - * Use uid-swapping to give up root privileges for the duration of - * option processing. We will re-instantiate the rights when we are -diff --git a/sshd.c b/sshd.c -index 6aa17fa..672c486 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -1694,6 +1694,11 @@ main(int ac, char **av) - strcasecmp(options.authorized_keys_command, "none") != 0)) - fatal("AuthorizedKeysCommand set without " - "AuthorizedKeysCommandUser"); -+ if (options.authorized_principals_command_user == NULL && -+ (options.authorized_principals_command != NULL && -+ strcasecmp(options.authorized_principals_command, "none") != 0)) -+ fatal("AuthorizedPrincipalsCommand set without " -+ "AuthorizedPrincipalsCommandUser"); - - /* - * Check whether there is any path through configured auth methods. -diff --git a/sshd_config.5 b/sshd_config.5 -index 6dce0c7..a267af9 100644 ---- a/sshd_config.5 -+++ b/sshd_config.5 -@@ -230,9 +230,21 @@ The default is not to require multiple authentication; successful completion - of a single authentication method is sufficient. - .It Cm AuthorizedKeysCommand - Specifies a program to be used to look up the user's public keys. --The program must be owned by root and not writable by group or others. --It will be invoked with a single argument of the username --being authenticated, and should produce on standard output zero or -+The program must be owned by root, not writable by group or others and -+specified by an absolute path. -+.Pp -+Arguments to -+.Cm AuthorizedKeysCommand -+may be provided using the following tokens, which will be expanded -+at runtime: %% is replaced by a literal '%', %u is replaced by the -+username being authenticated, %h is replaced by the home directory -+of the user being authenticated, %t is replaced with the key type -+offered for authentication, %f is replaced with the fingerprint of -+the key, and %k is replaced with the key being offered for authentication. -+If no arguments are specified then the username of the target user -+will be supplied. -+.Pp -+The program should produce on standard output zero or - more lines of authorized_keys output (see AUTHORIZED_KEYS in - .Xr sshd 8 ) . - If a key supplied by AuthorizedKeysCommand does not successfully authenticate -@@ -271,6 +283,42 @@ directory. - Multiple files may be listed, separated by whitespace. - The default is - .Dq .ssh/authorized_keys .ssh/authorized_keys2 . -+.It Cm AuthorizedPrincipalsCommand -+Specifies a program to be used to generate the list of allowed -+certificate principals as per -+.Cm AuthorizedPrincipalsFile . -+The program must be owned by root, not writable by group or others and -+specified by an absolute path. -+.Pp -+Arguments to -+.Cm AuthorizedPrincipalsCommand -+may be provided using the following tokens, which will be expanded -+at runtime: %% is replaced by a literal '%', %u is replaced by the -+username being authenticated and %h is replaced by the home directory -+of the user being authenticated. -+.Pp -+The program should produce on standard output zero or -+more lines of -+.Cm AuthorizedPrincipalsFile -+output. -+If either -+.Cm AuthorizedPrincipalsCommand -+or -+.Cm AuthorizedPrincipalsFile -+is specified, then certificates offered by the client for authentication -+must contain a principal that is listed. -+By default, no AuthorizedPrincipalsCommand is run. -+.It Cm AuthorizedPrincipalsCommandUser -+Specifies the user under whose account the AuthorizedPrincipalsCommand is run. -+It is recommended to use a dedicated user that has no other role on the host -+than running authorized principals commands. -+If -+.Cm AuthorizedPrincipalsCommand -+is specified but -+.Cm AuthorizedPrincipalsCommandUser -+is not, then -+.Xr sshd 8 -+will refuse to start. - .It Cm AuthorizedPrincipalsFile - Specifies a file that lists principal names that are accepted for - certificate authentication. -diff --git a/sshkey.c b/sshkey.c -index 3cc3f44..ecb61fd 100644 ---- a/sshkey.c -+++ b/sshkey.c -@@ -761,6 +761,12 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) - if (key == NULL) - return SSH_ERR_INVALID_ARGUMENT; - -+ if (sshkey_is_cert(key)) { -+ if (key->cert == NULL) -+ return SSH_ERR_EXPECTED_CERT; -+ if (sshbuf_len(key->cert->certblob) == 0) -+ return SSH_ERR_KEY_LACKS_CERTBLOB; -+ } - type = force_plain ? sshkey_type_plain(key->type) : key->type; - typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); - -@@ -1409,98 +1415,116 @@ sshkey_read(struct sshkey *ret, char **cpp) - } - - int --sshkey_write(const struct sshkey *key, FILE *f) -+sshkey_to_base64(const struct sshkey *key, char **b64p) - { -- int ret = SSH_ERR_INTERNAL_ERROR; -- struct sshbuf *b = NULL, *bb = NULL; -+ int r = SSH_ERR_INTERNAL_ERROR; -+ struct sshbuf *b = NULL; - char *uu = NULL; -+ -+ if (b64p != NULL) -+ *b64p = NULL; -+ if ((b = sshbuf_new()) == NULL) -+ return SSH_ERR_ALLOC_FAIL; -+ if ((r = sshkey_putb(key, b)) != 0) -+ goto out; -+ if ((uu = sshbuf_dtob64(b)) == NULL) { -+ r = SSH_ERR_ALLOC_FAIL; -+ goto out; -+ } -+ /* Success */ -+ if (b64p != NULL) { -+ *b64p = uu; -+ uu = NULL; -+ } -+ r = 0; -+ out: -+ sshbuf_free(b); -+ free(uu); -+ return r; -+} -+ -+static int -+sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; - #ifdef WITH_SSH1 - u_int bits = 0; - char *dec_e = NULL, *dec_n = NULL; --#endif /* WITH_SSH1 */ - -- if (sshkey_is_cert(key)) { -- if (key->cert == NULL) -- return SSH_ERR_EXPECTED_CERT; -- if (sshbuf_len(key->cert->certblob) == 0) -- return SSH_ERR_KEY_LACKS_CERTBLOB; -+ if (key->rsa == NULL || key->rsa->e == NULL || -+ key->rsa->n == NULL) { -+ r = SSH_ERR_INVALID_ARGUMENT; -+ goto out; - } -- if ((b = sshbuf_new()) == NULL) -- return SSH_ERR_ALLOC_FAIL; -- switch (key->type) { --#ifdef WITH_SSH1 -- case KEY_RSA1: -- if (key->rsa == NULL || key->rsa->e == NULL || -- key->rsa->n == NULL) { -- ret = SSH_ERR_INVALID_ARGUMENT; -- goto out; -- } -- if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || -- (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -- goto out; -- } -- /* size of modulus 'n' */ -- if ((bits = BN_num_bits(key->rsa->n)) <= 0) { -- ret = SSH_ERR_INVALID_ARGUMENT; -- goto out; -- } -- if ((ret = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) -- goto out; -+ if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || -+ (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { -+ r = SSH_ERR_ALLOC_FAIL; -+ goto out; -+ } -+ /* size of modulus 'n' */ -+ if ((bits = BN_num_bits(key->rsa->n)) <= 0) { -+ r = SSH_ERR_INVALID_ARGUMENT; -+ goto out; -+ } -+ if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) -+ goto out; -+ -+ /* Success */ -+ r = 0; -+ out: -+ if (dec_e != NULL) -+ OPENSSL_free(dec_e); -+ if (dec_n != NULL) -+ OPENSSL_free(dec_n); - #endif /* WITH_SSH1 */ -- break; --#ifdef WITH_OPENSSL -- case KEY_DSA: -- case KEY_DSA_CERT_V00: -- case KEY_DSA_CERT: -- case KEY_ECDSA: -- case KEY_ECDSA_CERT: -- case KEY_RSA: -- case KEY_RSA_CERT_V00: -- case KEY_RSA_CERT: --#endif /* WITH_OPENSSL */ -- case KEY_ED25519: -- case KEY_ED25519_CERT: -- if ((bb = sshbuf_new()) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -- goto out; -- } -- if ((ret = sshkey_putb(key, bb)) != 0) -- goto out; -- if ((uu = sshbuf_dtob64(bb)) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -+ -+ return r; -+} -+ -+static int -+sshkey_format_text(const struct sshkey *key, struct sshbuf *b) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; -+ char *uu = NULL; -+ -+ if (key->type == KEY_RSA1) { -+ if ((r = sshkey_format_rsa1(key, b)) != 0) - goto out; -- } -- if ((ret = sshbuf_putf(b, "%s ", sshkey_ssh_name(key))) != 0) -+ } else { -+ /* Unsupported key types handled in sshkey_to_base64() */ -+ if ((r = sshkey_to_base64(key, &uu)) != 0) - goto out; -- if ((ret = sshbuf_put(b, uu, strlen(uu))) != 0) -+ if ((r = sshbuf_putf(b, "%s %s", -+ sshkey_ssh_name(key), uu)) != 0) - goto out; -- break; -- default: -- ret = SSH_ERR_KEY_TYPE_UNKNOWN; -- goto out; - } -+ r = 0; -+ out: -+ free(uu); -+ return r; -+} -+ -+int -+sshkey_write(const struct sshkey *key, FILE *f) -+{ -+ struct sshbuf *b = NULL; -+ int r = SSH_ERR_INTERNAL_ERROR; -+ -+ if ((b = sshbuf_new()) == NULL) -+ return SSH_ERR_ALLOC_FAIL; -+ if ((r = sshkey_format_text(key, b)) != 0) -+ goto out; - if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { - if (feof(f)) - errno = EPIPE; -- ret = SSH_ERR_SYSTEM_ERROR; -+ r = SSH_ERR_SYSTEM_ERROR; - goto out; - } -- ret = 0; -+ /* Success */ -+ r = 0; - out: -- if (b != NULL) -- sshbuf_free(b); -- if (bb != NULL) -- sshbuf_free(bb); -- if (uu != NULL) -- free(uu); --#ifdef WITH_SSH1 -- if (dec_e != NULL) -- OPENSSL_free(dec_e); -- if (dec_n != NULL) -- OPENSSL_free(dec_n); --#endif /* WITH_SSH1 */ -- return ret; -+ sshbuf_free(b); -+ return r; - } - - const char * -diff --git a/sshkey.h b/sshkey.h -index 62c1c3e..98f1ca9 100644 ---- a/sshkey.h -+++ b/sshkey.h -@@ -163,6 +163,7 @@ int sshkey_from_blob(const u_char *, size_t, struct sshkey **); - int sshkey_fromb(struct sshbuf *, struct sshkey **); - int sshkey_froms(struct sshbuf *, struct sshkey **); - int sshkey_to_blob(const struct sshkey *, u_char **, size_t *); -+int sshkey_to_base64(const struct sshkey *, char **); - int sshkey_putb(const struct sshkey *, struct sshbuf *); - int sshkey_puts(const struct sshkey *, struct sshbuf *); - int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); --- -2.3.5 - -- 2.4.1

1 1

[aur-dev] [PATCH] Fix email body of password reset emails
by Lukas Fleischer 17 May '15

17 May '15

When the password reset function was factored out in 5d31bb2 (Move reset key submission to a separate function, 2013-03-19), a semicolon was accidentally replaced by a concatenation operator. As a result of this, all password reset emails sent since mid-2013 only contained a password reset link without any description. Fix this by terminating the assignment with a semicolon again. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/passreset.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index fecefe4..d1b57a4 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -49,7 +49,7 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir $body = __('A password reset request was submitted for the account '. 'associated with your e-mail address. If you wish to reset '. 'your password follow the link below, otherwise ignore '. - 'this message and nothing will happen.'). + 'this message and nothing will happen.'); send_resetkey($email, $subject, $body); header('Location: ' . get_uri('/passreset/') . '?step=confirm'); -- 2.4.1

1 0

Re: [aur-dev] AUR 4 and licensing
by David Manouchehri 14 Apr '15

14 Apr '15

> I like this idea, but I don't think it's sound to consider something > GPL-licensed because the author checked a box or accepted the TOC. I doubt > that has any legal significance. I agree that accepting a one time ToS agreement is hardly binding. That's why I suggested printing out a message with a Git hook saying everything you push is going to be GPL, it's a bit harder to claim ignorance when you see that message every time. We're already in the gray area since there's thousands of packages with no license explicitly listed, and I don't think it's sane to suggest removing those. > Wouldn't it make more sense to use a mandatory two-line header like below? This switch to Git is already going to cost us a lot of maintainers who simply don't feel like learning it, I can't say I'm in favor for imposing any more requirements. I'm also not really a fan of littering my PKGBUILDs with static text either. Listing the current maintainer and contributors is already less than ideal (with the move to Git, I guess we could stop listing the contributors inline since they're in the logs).

4 3

Re: [aur-dev] AUR 4 and licensing
by David Manouchehri 14 Apr '15

14 Apr '15

> I don't really like the idea of all this red-tape, requiring one license or > another. So I have some concerns. Is there a plan to enforce this? If the > PKGBUILD is trivial can you reasonably defend a license? I don't think any of us expect there to be any real arguments from it. There's not going to be much "defending" going on, the only likely situation I can see is if somebody's package gets moved to [community] and they're annoyed that somebody else is maintaining it now. GPL would help clear that up. Another thing is that some people upload copyrighted binaries by mistake. Reminding the maintainer that the entire git/tar ball has to be under GPL would probably help them avoid making that mistake. Having the PKGBUILDs under GPL makes one less thing to worry about when migrating it over towards [community]. Right now in theory you have to make sure both the project /and/ PKGBUILD's license allows you to package it. By asking all PKGBUILDs to become GPL, now all any future maintainers have to do is look at the source. > If I write a patch/etc is it under GPL or is it under the project's original > license? I would say everything being tracked by the Git repo is GPL. So if it's an external patch hosted outside of Arch, then no. Same concept with packages like Dropbox that can't be repacked, so they list the source. This seems fair, if you want free hosting on Arch, you play by Arch's rules. > Get rid of the TOS. I don't think the TUs want to become the license police. I don't think any of us were asking the TUs to police anything. No one was suggesting having the TUs read through all 50,000 PKGBUILDs to check for GPL violations.

1 0

[aur-dev] AUR 4 and licensing
by Johannes Löthberg 14 Apr '15

14 Apr '15

Hello, Currently the content of the AUR is in a sort of gray zone. All of the contents are technically copyrighted, and since there is no explicit license it defaults to 'all rights reserved'. To mitigate this I’d propose making a ToS for the AUR that for one says that the user agrees to either license the PKGBUILD and accompanying scripts under a specific license, or that they agree to assign copyright to Arch Linux. While it wouldn’t be possible to apply it to the packages already upload, I’d suggest implementing this change during the migration to AUR 4.0.0 when the official AUR will be started afresh, causing all newly uploaded packages to fall under the ToS. Comments? -- Sincerely, Johannes Löthberg PGP Key ID: 0x50FB9B273A9D0BB5 https://theos.kyriasis.com/~kyrias/

5 9

Re: [aur-dev] AUR 4 and licensing
by David Manouchehri 13 Apr '15

13 Apr '15

Lukas Fleischer <lfleischer(a)archlinux.org> wrote: > In order to `git push` a package repository, you need to add your SSH > public key to the AUR profile which means you need to log into the web > interface and accept the ToS. No need for something complicated > involving Git hooks and email address filters. You're right, I forgot about that. The only real purpose of having a hook would just be to serve as a reminder. Johannes L?thberg <johannes(a)kyriasis.com> wrote: > This is Git, not SVN. Sorry, I mixed my hooks up. Didn't mean to start a fight with that one. Both Johannes and Dan are right; it's impossible to have a pre-commit hook on the server side, but it's entirely possible to have a pre-receive hook on the server side. I believe both would have the same result if you put `exit 1` in them though (failing to apply commit).

3 3