Add openssh 10.4p1 patch - #350
Open
julek-wolfssl wants to merge 4 commits into
Open
Conversation
configure is regenerated by the autoreconf step documented in the patch.
There was a problem hiding this comment.
Pull request overview
Adds a new wolfSSL compatibility patch targeting OpenSSH 10.4p1, mirroring the approach used for prior 10.2p1/10.3p1 patches while excluding the generated configure output (intended to be regenerated via autoreconf during build).
Changes:
- Introduces
openssh-10.4p1.patchwith wolfSSL build/configure integration and compatibility tweaks for OpenSSH 10.4p1. - Updates OpenSSH build/test plumbing in the patch (autoconf checks, logging/init hooks, crypto compatibility shims).
- Omits generated
configurefrom the patch (relying on autoreconf regeneration).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Use POSIX = instead of == in configure tests, guard against getrandom() returning 0 in the seed callback, and fix the wording of the OS X sandbox warning.
Fix indentation, reuse upstream WITH_OPENSSL description, make the FIPS version probe fail closed on unrelated compile errors, and silence unused parameter warning in the logging callback.
philljj
requested changes
Jul 29, 2026
Contributor
There was a problem hiding this comment.
Overall looks and tests good, but with 2 small things:
- First pass, openssh tests failed with:
test_sshbuf: ........................................................................................................................ 121 tests ok
test_sshkey: .........
regress/unittests/sshkey/test_sshkey.c:329 test #10 "generate KEY_RSA"
ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &kr), 0) failed:
sshkey_generate(KEY_RSA, 1024, &kr) = -22
0 = 0
make[1]: *** [Makefile:286: unit] Error 134I rebuilt wolfssl with -DRSA_MIN_SIZE=1024
./configure --enable-openssh --enable-dsa --with-max-rsa-bits=8192 CFLAGS="-DRSA_MIN_SIZE=1024"
and everything passed:
test_sshbuf: ........................................................................................................................ 121 tests ok
test_sshkey: ..................................................................................................... 101 tests ok
test_sshsig: ........ 8 tests ok
...
test_servconf: ...... 6 tests ok
test_crypto: .................. 18 tests ok
make[1]: Leaving directory '/home/jordan/work/openssh-portable/regress'
unit tests passed
echo all tests passed
all tests passedI'm sure this is because wolfssl's min RSA size define has changed recently.
Probably the patch instructions should have a note about this.
- The patch has trailing whitespace errors. You see them if you do
git applyinstead ofpatch:
git apply /home/jordan/work/julek-osp/openssh-patches/openssh-10.4p1.patch
/home/jordan/work/julek-osp/openssh-patches/openssh-10.4p1.patch:242: trailing whitespace.
/home/jordan/work/julek-osp/openssh-patches/openssh-10.4p1.patch:246: trailing whitespace.
/home/jordan/work/julek-osp/openssh-patches/openssh-10.4p1.patch:272: trailing whitespace.
warning: 3 lines add whitespace errors.
philljj
reviewed
Jul 29, 2026
| + [ --with-wolfssl=PATH PATH to wolfssl install (default /usr/local) ], | ||
| + [ | ||
| + wolfssl_install_dir=/usr/local | ||
| + |
philljj
reviewed
Jul 29, 2026
| + if test "x${withval}" != "xyes" ; then | ||
| + wolfssl_install_dir=${withval} | ||
| + fi | ||
| + |
philljj
reviewed
Jul 29, 2026
| + AC_TRY_LINK_FUNC([wolfSSL_Init], , | ||
| + [ | ||
| + AC_MSG_ERROR([wolfSSL isn't found. You can get it from $WOLFSSL_URL | ||
| + |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the wolfSSL patch for OpenSSH 10.4p1, following the same approach as the
10.2p1 and 10.3p1 patches.