[scarthgap][PATCH] dropbear: Disable DSS correctly

[scarthgap][PATCH] dropbear: Disable DSS correctly

[mac]

From: Mike Crowe <mac@mcrowe.com>

Take upstream patch that stops sysoptions.h unconditionally turning
DROPBEAR_DSS back on even when it has been disabled (which is the
default).

Signed-off-by: Mike Crowe <mac@mcrowe.com>
---
 ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 29 +++++++++++++++++++
 .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch

diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
new file mode 100644
index 0000000000..b9705a2bbb
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
@@ -0,0 +1,29 @@
+From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Tue, 6 Dec 2022 22:34:11 +0800
+Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
+
+Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
+was missing fuzzing conditional
+
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
+---
+ sysoptions.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sysoptions.h b/sysoptions.h
+index fb6adc7..12db59c 100644
+--- a/sysoptions.h
++++ b/sysoptions.h
+@@ -383,9 +383,11 @@
+ #endif
+ 
+ /* Fuzzing expects all key types to be enabled */
++#if DROPBEAR_FUZZ
+ #if defined(DROPBEAR_DSS)
+ #undef DROPBEAR_DSS
+ #endif
+ #define DROPBEAR_DSS 1
++#endif
+ 
+ /* no include guard for this file */
diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2022.83.bb
index 93563aa3b4..d203fee34b 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.83.bb
+++ b/meta/recipes-core/dropbear/dropbear_2022.83.bb
@@ -28,6 +28,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch \
            file://0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch \
            file://0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch \
+           file://0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch \
            file://CVE-2025-47203.patch \
            file://CVE-2019-6111.patch \
            "
-- 
2.47.3

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Yoann Congal]

Hello,

On Mon Jun 29, 2026 at 6:50 PM CEST, Mike Crowe via lists.openembedded.org wrote:
> From: Mike Crowe <mac@mcrowe.com>
>
> Take upstream patch that stops sysoptions.h unconditionally turning
> DROPBEAR_DSS back on even when it has been disabled (which is the
> default).
>
> Signed-off-by: Mike Crowe <mac@mcrowe.com>
> ---
>  ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 29 +++++++++++++++++++
>  .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
>  2 files changed, 30 insertions(+)
>  create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
>
> diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> new file mode 100644
> index 0000000000..b9705a2bbb
> --- /dev/null
> +++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> @@ -0,0 +1,29 @@
> +From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
> +From: Matt Johnston <matt@ucc.asn.au>
> +Date: Tue, 6 Dec 2022 22:34:11 +0800
> +Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
> +
> +Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
> +was missing fuzzing conditional
> +
> +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]

This patch is missing your signed-off-by.
> +---
> + sysoptions.h | 2 ++
> + 1 file changed, 2 insertions(+)
> +

Regards,
-- 
Yoann Congal

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Mike Crowe]

Hi Yoann,

On Tuesday 07 July 2026 at 10:54:38 +0200, Yoann Congal wrote:
> On Mon Jun 29, 2026 at 6:50 PM CEST, Mike Crowe via lists.openembedded.org wrote:
> > From: Mike Crowe <mac@mcrowe.com>
> >
> > Take upstream patch that stops sysoptions.h unconditionally turning
> > DROPBEAR_DSS back on even when it has been disabled (which is the
> > default).
> >
> > Signed-off-by: Mike Crowe <mac@mcrowe.com>
> > ---
> >  ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 29 +++++++++++++++++++
> >  .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
> >  2 files changed, 30 insertions(+)
> >  create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> >
> > diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> > new file mode 100644
> > index 0000000000..b9705a2bbb
> > --- /dev/null
> > +++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> > @@ -0,0 +1,29 @@
> > +From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
> > +From: Matt Johnston <matt@ucc.asn.au>
> > +Date: Tue, 6 Dec 2022 22:34:11 +0800
> > +Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
> > +
> > +Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
> > +was missing fuzzing conditional
> > +
> > +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
> 
> This patch is missing your signed-off-by.

Well, it's not my patch. :)

I wasn't aware that I was expected to add one to the patch itself for a
backport.

https://docs.yoctoproject.org/scarthgap/contributor-guide/recipe-style-guide.html
doesn't seem to say that a SoB should be added to the patch. It does say:

| Of course, if another person later takes care of submitting this patch
| upstream, the status should be changed to Submitted [where], and an
| additional Signed-off-by: line should be added to the patch by the person
| claiming responsibility for upstreaming.

which sort of implies that a SoB should be added for original patches that
are suitable for upstreaming but this patch is a backport which originated
upstream (without a SoB) which isn't the same thing.

Adding a SoB to an unmodified upstream backport patch feels like
appropriation on my part, but I can do so if that's the policy.

Thanks.

Mike.

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Alex Kiernan]

On Thu, Jul 9, 2026 at 8:07 PM Mike Crowe via lists.openembedded.org
<mac=mcrowe.com@lists.openembedded.org> wrote:
>
> Hi Yoann,
>
> On Tuesday 07 July 2026 at 10:54:38 +0200, Yoann Congal wrote:
> > On Mon Jun 29, 2026 at 6:50 PM CEST, Mike Crowe via lists.openembedded.org wrote:
> > > From: Mike Crowe <mac@mcrowe.com>
> > >
> > > Take upstream patch that stops sysoptions.h unconditionally turning
> > > DROPBEAR_DSS back on even when it has been disabled (which is the
> > > default).
> > >
> > > Signed-off-by: Mike Crowe <mac@mcrowe.com>
> > > ---
> > >  ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 29 +++++++++++++++++++
> > >  .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
> > >  2 files changed, 30 insertions(+)
> > >  create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> > >
> > > diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> > > new file mode 100644
> > > index 0000000000..b9705a2bbb
> > > --- /dev/null
> > > +++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
> > > @@ -0,0 +1,29 @@
> > > +From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
> > > +From: Matt Johnston <matt@ucc.asn.au>
> > > +Date: Tue, 6 Dec 2022 22:34:11 +0800
> > > +Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
> > > +
> > > +Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
> > > +was missing fuzzing conditional
> > > +
> > > +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
> >
> > This patch is missing your signed-off-by.
>
> Well, it's not my patch. :)
>
> I wasn't aware that I was expected to add one to the patch itself for a
> backport.
>
> https://docs.yoctoproject.org/scarthgap/contributor-guide/recipe-style-guide.html
> doesn't seem to say that a SoB should be added to the patch. It does say:
>
> | Of course, if another person later takes care of submitting this patch
> | upstream, the status should be changed to Submitted [where], and an
> | additional Signed-off-by: line should be added to the patch by the person
> | claiming responsibility for upstreaming.
>
> which sort of implies that a SoB should be added for original patches that
> are suitable for upstreaming but this patch is a backport which originated
> upstream (without a SoB) which isn't the same thing.
>
> Adding a SoB to an unmodified upstream backport patch feels like
> appropriation on my part, but I can do so if that's the policy.
>

You're certifying that the patch you're submitting is appropriately
licensed; it says nothing about who authored it.

-- 
Alex Kiernan

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Yoann Congal]

On Thu Jul 9, 2026 at 9:33 PM CEST, Alex Kiernan wrote:
> On Thu, Jul 9, 2026 at 8:07 PM Mike Crowe via lists.openembedded.org
> <mac=mcrowe.com@lists.openembedded.org> wrote:
>>
>> Hi Yoann,
>>
>> On Tuesday 07 July 2026 at 10:54:38 +0200, Yoann Congal wrote:
>> > On Mon Jun 29, 2026 at 6:50 PM CEST, Mike Crowe via lists.openembedded.org wrote:
>> > > From: Mike Crowe <mac@mcrowe.com>
>> > >
>> > > Take upstream patch that stops sysoptions.h unconditionally turning
>> > > DROPBEAR_DSS back on even when it has been disabled (which is the
>> > > default).
>> > >
>> > > Signed-off-by: Mike Crowe <mac@mcrowe.com>
>> > > ---
>> > >  ...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 29 +++++++++++++++++++
>> > >  .../recipes-core/dropbear/dropbear_2022.83.bb |  1 +
>> > >  2 files changed, 30 insertions(+)
>> > >  create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
>> > >
>> > > diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
>> > > new file mode 100644
>> > > index 0000000000..b9705a2bbb
>> > > --- /dev/null
>> > > +++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
>> > > @@ -0,0 +1,29 @@
>> > > +From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
>> > > +From: Matt Johnston <matt@ucc.asn.au>
>> > > +Date: Tue, 6 Dec 2022 22:34:11 +0800
>> > > +Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
>> > > +
>> > > +Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
>> > > +was missing fuzzing conditional
>> > > +
>> > > +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
>> >
>> > This patch is missing your signed-off-by.
>>
>> Well, it's not my patch. :)
>>
>> I wasn't aware that I was expected to add one to the patch itself for a
>> backport.
>>
>> https://docs.yoctoproject.org/scarthgap/contributor-guide/recipe-style-guide.html
>> doesn't seem to say that a SoB should be added to the patch. It does say:
>>
>> | Of course, if another person later takes care of submitting this patch
>> | upstream, the status should be changed to Submitted [where], and an
>> | additional Signed-off-by: line should be added to the patch by the person
>> | claiming responsibility for upstreaming.
>>
>> which sort of implies that a SoB should be added for original patches that
>> are suitable for upstreaming but this patch is a backport which originated
>> upstream (without a SoB) which isn't the same thing.
>>
>> Adding a SoB to an unmodified upstream backport patch feels like
>> appropriation on my part, but I can do so if that's the policy.
>>
>
> You're certifying that the patch you're submitting is appropriately
> licensed; it says nothing about who authored it.

I agree with Alex: As the one requesting the backport, you are the one
signing-off on this particular operation. The original author had
nothing to do with that.

I created a bug to request clarification in the doc on this point:
16356 – Clarify trailers usage (Signed-off-by, ...) in imported patches
https://bugzilla.yoctoproject.org/show_bug.cgi?id=16356

Regards,
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Mike Crowe]

On Friday 10 July 2026 at 09:27:39 +0200, Yoann Congal wrote:
> On Thu Jul 9, 2026 at 9:33 PM CEST, Alex Kiernan wrote:
> > On Thu, Jul 9, 2026 at 8:07 PM Mike Crowe via lists.openembedded.org
> > <mac=mcrowe.com@lists.openembedded.org> wrote:
> >> I wasn't aware that I was expected to add one to the patch itself for a
> >> backport.
> >>
> >> https://docs.yoctoproject.org/scarthgap/contributor-guide/recipe-style-guide.html
> >> doesn't seem to say that a SoB should be added to the patch. It does say:
> >>
> >> | Of course, if another person later takes care of submitting this patch
> >> | upstream, the status should be changed to Submitted [where], and an
> >> | additional Signed-off-by: line should be added to the patch by the person
> >> | claiming responsibility for upstreaming.
> >>
> >> which sort of implies that a SoB should be added for original patches that
> >> are suitable for upstreaming but this patch is a backport which originated
> >> upstream (without a SoB) which isn't the same thing.
> >>
> >> Adding a SoB to an unmodified upstream backport patch feels like
> >> appropriation on my part, but I can do so if that's the policy.

> > You're certifying that the patch you're submitting is appropriately
> > licensed; it says nothing about who authored it.

> I agree with Alex: As the one requesting the backport, you are the one
> signing-off on this particular operation. The original author had
> nothing to do with that.

I thought that I did that with the signed-off-by in the openembedded-core
commit message.

> I created a bug to request clarification in the doc on this point:
> 16356 – Clarify trailers usage (Signed-off-by, ...) in imported patches
> https://bugzilla.yoctoproject.org/show_bug.cgi?id=16356

Thanks. It feels like this needs an equivalent of
oe.qa.check_upstream_status(). Such a check would currently fail since
there are lots of existing patches that lack signed-off-bys and adding them
would be significant work because each one would need to be manually
checked. :( I suppose the check could also allow "Not-signed-off-by:
<openembedded-core@lists.openembedded.org>" or similar as a workaround for
existing patches with a plan to eventually remove it as the patches are
updated.

v2 sent with signed-off-by in the patch.

Thanks.

Mike.

Re: [OE-core] [scarthgap][PATCH] dropbear: Disable DSS correctly

[Yoann Congal]

On Fri Jul 10, 2026 at 11:07 AM CEST, Mike Crowe wrote:
> On Friday 10 July 2026 at 09:27:39 +0200, Yoann Congal wrote:
>> On Thu Jul 9, 2026 at 9:33 PM CEST, Alex Kiernan wrote:
>> > On Thu, Jul 9, 2026 at 8:07 PM Mike Crowe via lists.openembedded.org
>> > <mac=mcrowe.com@lists.openembedded.org> wrote:
>> >> I wasn't aware that I was expected to add one to the patch itself for a
>> >> backport.
>> >>
>> >> https://docs.yoctoproject.org/scarthgap/contributor-guide/recipe-style-guide.html
>> >> doesn't seem to say that a SoB should be added to the patch. It does say:
>> >>
>> >> | Of course, if another person later takes care of submitting this patch
>> >> | upstream, the status should be changed to Submitted [where], and an
>> >> | additional Signed-off-by: line should be added to the patch by the person
>> >> | claiming responsibility for upstreaming.
>> >>
>> >> which sort of implies that a SoB should be added for original patches that
>> >> are suitable for upstreaming but this patch is a backport which originated
>> >> upstream (without a SoB) which isn't the same thing.
>> >>
>> >> Adding a SoB to an unmodified upstream backport patch feels like
>> >> appropriation on my part, but I can do so if that's the policy.
>
>> > You're certifying that the patch you're submitting is appropriately
>> > licensed; it says nothing about who authored it.
>
>> I agree with Alex: As the one requesting the backport, you are the one
>> signing-off on this particular operation. The original author had
>> nothing to do with that.
>
> I thought that I did that with the signed-off-by in the openembedded-core
> commit message.
>
>> I created a bug to request clarification in the doc on this point:
>> 16356 – Clarify trailers usage (Signed-off-by, ...) in imported patches
>> https://bugzilla.yoctoproject.org/show_bug.cgi?id=16356
>
> Thanks. It feels like this needs an equivalent of
> oe.qa.check_upstream_status(). Such a check would currently fail since
> there are lots of existing patches that lack signed-off-bys and adding them
> would be significant work because each one would need to be manually
> checked. :( I suppose the check could also allow "Not-signed-off-by:
> <openembedded-core@lists.openembedded.org>" or similar as a workaround for
> existing patches with a plan to eventually remove it as the patches are
> updated.

We do have some kind of test in place, in patchtest:
https://git.openembedded.org/openembedded-core/tree/meta/lib/patchtest/tests/test_patch.py#n142
A proper check would be really hard to do without false-positive.

>
> v2 sent with signed-off-by in the patch.

Thanks! That's appreciated :)

>
> Thanks.
>
> Mike.
-- 
Yoann Congal
Smile ECS