Subject: bug#67948: closed (Re: [bug#67948] [PATCH] gnu: openssh: Update to 9.6p1 [security-fixes].)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 21 Dec 2023 19:29:02 +0000

Your bug report

#67948: [PATCH] gnu: openssh: Update to 9.6p1 [security-fixes].

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
67948: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=67948
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#67948] [PATCH] gnu: openssh: Update to 9.6p1 [security-fixes].
From: John Kehayias <[email-masked]>
To: Jack Hill <[email-masked]>
Cc: [email-masked]
Date: Thu, 21 Dec 2023 19:28:08 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

On Thu, Dec 21, 2023 at 12:33 AM, Jack Hill wrote:

> Fixes CVE-2023-48795.
>
> * gnu/packages/ssh.scm (openssh): Update to 9.6p1
> [arguments]<#:parallel-tests?>: Disable.
>
> Change-Id: I8b7707894d904ec8bcccb943908fff2e69a1a027
> ---
>
> This may fix additional security problem as well, but the openssh
> release notes don't list them:
>
> https://www.openssh.com/releasenotes.html#9.6p1
>
>
>  gnu/packages/ssh.scm | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
> index 47089b197d..565ac3b079 100644
> --- a/gnu/packages/ssh.scm
> +++ b/gnu/packages/ssh.scm
> @@ -198,7 +198,7 @@ (define-public libssh2
>  (define-public openssh
>    (package
>     (name "openssh")
> -   (version "9.5p1")
> +   (version "9.6p1")
>     (source
>      (origin
>        (method url-fetch)
> @@ -206,11 +206,14 @@ (define-public openssh
>                            "openssh-" version ".tar.gz"))
>        (patches (search-patches "openssh-trust-guix-store-directory.patch"))
>        (sha256
> -       (base32 "0sq8hqk6f0x6djgvqawjbwwxpwd8r1nzjahqfl7m9yx7kfvyf9ph"))))
> +       (base32 "0z3pgam8b4z05lvdb78iv06p204qwl7b94a3cnnwba2mfb0120li"))))
>     (build-system gnu-build-system)
>     (arguments
>      (list
>       #:test-target "tests"
> +     ;; Not all of the tests can be run in parallel
> +     ;; https://marc.info/?l=openssh-unix-dev&m=170313565518842&w=2
> +     #:parallel-tests? #f
>       ;; Otherwise, the test scripts try to use a nonexistent directory and fail.
>       #:make-flags
>       #~(list "REGRESSTMP=\"$${BUILDDIR}/regress\"")
>
> base-commit: aa22cdd363d3b2cf64586ccee918531aa53ef365

Thanks for this one as well! Pushed as
04b63ea195cbcbcf519b7dd52546c6d56be6741b.

Subject: [PATCH] gnu: openssh: Update to 9.6p1 [security-fixes].
From: Jack Hill <[email-masked]>
To: [email-masked]
Date: Thu, 21 Dec 2023 00:33:08 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

Fixes CVE-2023-48795.

* gnu/packages/ssh.scm (openssh): Update to 9.6p1
[arguments]<#:parallel-tests?>: Disable.

Change-Id: I8b7707894d904ec8bcccb943908fff2e69a1a027
---

This may fix additional security problem as well, but the openssh
release notes don't list them:

https://www.openssh.com/releasenotes.html#9.6p1

 gnu/packages/ssh.scm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index 47089b197d..565ac3b079 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -198,7 +198,7 @@ (define-public libssh2
 (define-public openssh
   (package
    (name "openssh")
-   (version "9.5p1")
+   (version "9.6p1")
    (source
     (origin
       (method url-fetch)
@@ -206,11 +206,14 @@ (define-public openssh
                           "openssh-" version ".tar.gz"))
       (patches (search-patches "openssh-trust-guix-store-directory.patch"))
       (sha256
-       (base32 "0sq8hqk6f0x6djgvqawjbwwxpwd8r1nzjahqfl7m9yx7kfvyf9ph"))))
+       (base32 "0z3pgam8b4z05lvdb78iv06p204qwl7b94a3cnnwba2mfb0120li"))))
    (build-system gnu-build-system)
    (arguments
     (list
      #:test-target "tests"
+     ;; Not all of the tests can be run in parallel
+     ;; https://marc.info/?l=openssh-unix-dev&m=170313565518842&w=2
+     #:parallel-tests? #f
      ;; Otherwise, the test scripts try to use a nonexistent directory and fail.
      #:make-flags
      #~(list "REGRESSTMP=\"$${BUILDDIR}/regress\"")

base-commit: aa22cdd363d3b2cf64586ccee918531aa53ef365
-- 
2.41.0